kern/41725: uvm fault and problems unmounting file sytems at shutdown

[apb%cequrux.com@localhost]

>Number:         41725
>Category:       kern
>Synopsis:       uvm fault and problems unmounting file sytems at shutdown
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 14 19:00:00 +0000 2009
>Originator:     Alan Barrett
>Release:        NetBSD 5.99.15
>Organization:
Not much
>Environment:
System: NetBSD 5.99.11 i386
>Description:
        During an attempt to shutdown, the system crashes with a uvm
        fault, and appears to detach devices before unmounting file
        sytems that use those devices.

>How-To-Repeat:
        The root file system is a memory disk, provided using a custom
        miniroot.kmod, loaded from the boot loaded via "load /miniroot.kmod".

        The memory disk file system contains an /etc/rc script that
        configures a cgd device, mounts an ffs+wapbl file system from
        the cgd device, sets sysctl -w init.chroot=/cgd1a, and exits.
        All userland activity then proceeds inside the chroot.

        Press the power button.

        The event is passed to powerd, which performs "/sbin/shutdown -p
        now".

        shutdown(8) executes all the rc.d shutdown scripts.  Note that
        this is still inside the chroot.

        The kernel detaches all or most devices, ending with:

        ppb2: detached
        ppb1: detached
        ppb0: detached
        audio1: detached
        md0: detached

        unmounting 0xd0358605 /cgd1a/ (/dev/cgd1a)...
        unmounting 0xd022f770 / (/dev/md0a)...
        forcefully unmounting /cgd1a/ (/dev/cgd1a)...forcefully unmounted
        /dev/cgd1a on /cgd1a/ type ffs

        unmounting 0xd022f770 / (/dev/md0a)...
        forcefully unmounting / (/dev/md0a)...uvm_fault(0xd07606a4, 0, 1)
        -> 0xe
        fatal page fault in supervisor mode
        trap type 6 code 0 eip c0521e4c cs 8 eflags 10246 cr2 60 ilevel 0
        kernel: supervisor trap page fault, code=0
        stopped in pid 10670.1 (halt) at netbsd:mdstrategy+0x3c: movl
        0x60(%eax),%eax
        db{0}> bt
        mdstrategy ...
        bdev_strategy ...
        spec_strategy ...
        VOP_STRATEGY ...
        bwrite ...
        ffs_sbupdate ...
        ffs_cgupdate ...
        ffs_unmount ...
        VFS_UNMOUNT ...
        dounmount ...
        vfs_unmount_forceone ...
        cpu_reboot ...
        sys_reboot ...
        syscall ...

>Fix:
        Unknown.  There seem to be at least three things wrong with
        this picture:  (1) why was md0 detached before the file system
        on md0a was unmounted, (2) why was it necessary to forecefully
        unmount the cgd1a and md0a file systems instead of gracefully
        unmounting them, and (3) why was there a uvm fault?

        I don't know whether cgd1 was detached too early; if it was,
        then the relevant line had scrolled off the screen before I saw
        the problem.