Mangled file system directory panic

[Jarle Greipsland <jarle%uninett.no@localhost>]

Hi,

I have a system where I can almost deterministally provoke a
kernel panic by doing a 'tar -zxpf comp.tgz'.

The panic messages reported by crash is something like:
System panicked: /mnt: bad dir ino 42369 at offset 560: NUL in name [] i=0, namlen=4

The directory mangling is quite severe, so that fsck does not
always manage to fix the problems.  I have had to newfs the
partition a number of times, including zeroing it out completely.
I have since also managed to duplicate the problem on a file
backed vnd, which makes the recovery somewhat smoother.

The backtrace below is from after doing:

# vndconfig vnd0 /home/testdisk.dsk
# newfs -O 2 /dev/rvnd0a
# mount /dev/vnd0a /mnt
# cd /mnt
# tar -zxpf /usr/rel/i386/binary/sets/comp.tgz

The backtrace from the kernel core dump is:
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NPNPBIOS(0,104,c0112c44,104,c040ef6c,c7a9cbd4,c03001db,104,0,c1128ca
c) at 0
__kernel_end(104,0,c1128cac,0,c7cb8230,c7a9cbe4,c0300250,c040ef6c,c7a9cbf0,c7a9c
ca4) at c7a9cbf0
vpanic(c040ef6c,c7a9cbf0,c7a9cca4,c0278b11,c040ef6c,c0e13100,a581,0,230,c04d18e0
) at vpanic+0x11b
snprintf(c040ef6c,c0e13100,a581,0,230,c04d18e0,200,0,1ff,0) at snprintf
ufs_lookup(c7a9ccb4,c1126b84,c03e9000,c1126ae0,c7a9ccf8,c7a9ced0,c7a9ccf8,c1126a
e0,c7a9cd08,c03432c6) at ufs_lookup+0x4e1
VOP_LOOKUP(c1126ae0,c7a9ccf8,c7a9ced0,c0368816,c7a9cdc0,c7a9cea8,c7a9cd08,c7a9cd
68,c7a9ced0,0) at VOP_LOOKUP+0x31
lookup_once(c7a9cd6c,c02f9c5f,c0908408,c0f55f20,c7a9cd34,c02f9c5f,c0908408,0,0,c
7a9cd50) at lookup_once+0x166
namei_tryemulroot(0,c10fad30,c7a9cea8,c7a9ced0,20,0,0,0,c7a9cea8,c7a9ce84) at na
mei_tryemulroot+0x4c7
namei(c7a9cea8,ffffffff,c10e3780,c10fad3d,c08fad80,c5b5d211,297,c02f8d00,0,c10fa
d28) at namei+0x22
vn_open(c7a9cea8,a03,180,0,c0bcd004,c107d500,8,0,c10fad30,c0b93800) at vn_open+0
x83
do_open(c0f55d40,0,c10fad30,a02,180,c7a9cf3c,0,c10fad30,c0f55d40,c7a9cfa8) at do
_open+0xb0
do_sys_openat(a02,180,c7a9cf3c,c7a9cf60,c7a9cf9c,c012fa7e,c0f55d40,c7a9cf68,c7a9
cf60,c0496264) at do_sys_openat+0x58
sys_open(c0f55d40,c7a9cf68,c7a9cf60,c0496264,c7a9cf68,5,0,0,bb9010e0,a02) at sys
_open+0x22
syscall() at syscall+0x7e
--- syscall (number 5) ---
bba7b747:

The dmesg:
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 7.99.34 (DARLING) #1: Sat Jul 30 20:01:15 CEST 2016
	jarle%singsaker.uninett.no@localhost:/usr/obj/sys/arch/i386/compile/DARLING
total memory = 127 MB
avail memory = 120 MB
timecounter: Timecounters tick every 10.000 msec
timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
Generic PC
mainbus0 (root)
cpu0 at mainbus0
cpu0: Intel 486-class
eisa0 at mainbus0
isa0 at mainbus0
lpt0 at isa0 port 0x378-0x37b irq 7
aic0 at isa0 port 0x340-0x35f irq 11
scsibus0 at aic0: 8 targets, 8 luns per target
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
pckbc0 at isa0 port 0x60-0x64
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
attimer0 at isa0 port 0x40-0x43
wdc0 at isa0 port 0x1f0-0x1f7 irq 14
atabus0 at wdc0 channel 0
we0 at isa0 port 0x280-0x29f iomem 0xd0000-0xd3fff irq 9
we0: WD8013EBT Ethernet (16-bit)
we0: Ethernet address 00:00:c0:32:63:1c
vga0 at isa0 port 0x3b0-0x3df iomem 0xa0000-0xbffff
wsdisplay0 at vga0 kbdmux 1: console (80x25, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
sysbeep0 at pcppi0
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
attimer0: attached to pcppi0
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
scsibus0: waiting 2 seconds for devices to settle...
fd0 at fdc0 drive 0: 1.44MB, 80 cyl, 2 head, 18 sec
IPsec: Initialized Security Association Processing.
wd0 at atabus0 drive 0
wd0: <WDC WD1200JB-00CRA1>
wd0: drive supports 16-sector PIO transfers, LBA addressing
wd0: 111 GB, 232581 cyl, 16 head, 63 sec, 512 bytes/sect x 234441648 sectors
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 5 (Ultra/100)
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
kern.module.path=/stand/i386/7.99.34/modules
fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeoutfd0a: hard error reading fsbn 0 of 0-2 (st0 0x20<seek_cmplt> st1 0x0 st2 0x0 cyl 0 head 0 sec 0)
wsdisplay0: screen 1 added (80x25, vt100 emulation)
wsdisplay0: screen 2 added (80x25, vt100 emulation)
wsdisplay0: screen 3 added (80x25, vt100 emulation)
wsdisplay0: screen 4 added (80x25, vt100 emulation)
we0: warning - receiver ring buffer overrun
fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<4>we0: warning - receiver ring buffer overrun
fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeout<3>fdcresult: timeout
 (st0 0x20<seek_cmplt> cyl 0)
fd0: timeoutfd0a: hard error reading fsbn 0 of 0-2 (st0 0x20<seek_cmplt> st1 0x0 st2 0x0 cyl 0 head 0 sec 0)

Any guidance for how to debug this problem further?

					-jarle