>Number:         16670
>Category:       kern
>Synopsis:       softdep panics "softdep_write_inodeblock: direct pointer #1 mismatch 0 != 4081488"
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat May 04 18:26:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     YAMAMOTO Takashi
>Release:        NetBSD 1.5ZC
>Organization:
>Environment:
	
	
System: NetBSD bear.yamanet 1.5ZC NetBSD 1.5ZC (build) #13: Wed Apr 3 03:54:19 JST 2002 takashi@bear.yamanet:/usr/home/takashi/work/kernel/build i386
Architecture: i386
Machine: i386
>Description:
	softdep panics
	"softdep_write_inodeblock: direct pointer #1 mismatch 0 != 4081488"
	with a particular operation.
	(repeatable for me.)

#26 0xc0240ad1 in panic (
    fmt=0xc0418900 "%s: direct pointer #%d mismatch %d != %d")
    at /sys/kern/subr_prf.c:237
#27 0xc01e89a2 in initiate_write_inodeblock (inodedep=0xc91e2150, 
    bp=0xc3305658) at /sys/ufs/ffs/ffs_softdep.c:3432
#28 0xc01e8479 in softdep_disk_io_initiation (bp=0xc3305658)
    at /sys/ufs/ffs/ffs_softdep.c:3270
#29 0xc026b2f4 in spec_strategy (v=0xc9391ab8)
    at /sys/miscfs/specfs/spec_vnops.c:517
#30 0xc02664e7 in VOP_STRATEGY (bp=0xc3305658) at /sys/kern/vnode_if.c:102
#31 0xc0259640 in bwrite (bp=0xc3305658) at /sys/kern/vfs_bio.c:353
#32 0xc01e0bd1 in ffs_update (v=0xc9391b6c) at /sys/ufs/ffs/ffs_inode.c:148
#33 0xc0266377 in VOP_UPDATE (vp=0xc9389db4, access=0x0, modify=0x0, flags=1)
    at /sys/kern/vnode_if.c:1498
#34 0xc01e1588 in ffs_truncate (v=0xc9391cf4) at /sys/ufs/ffs/ffs_inode.c:345
#35 0xc0266331 in VOP_TRUNCATE (vp=0xc9389db4, length=8192, flags=0, 
    cred=0xc0b74880, p=0xc90caad4) at /sys/kern/vnode_if.c:1465
#36 0xc01f06b2 in ffs_write (v=0xc9391e4c) at /sys/ufs/ufs/ufs_readwrite.c:451
#37 0xc0265b17 in VOP_WRITE (vp=0xc9389db4, uio=0xc9391ee0, ioflag=1, 
    cred=0xc0b74880) at /sys/kern/vnode_if.c:458
#38 0xc02657c4 in vn_write (fp=0xc92f18bc, offset=0xc92f18e4, uio=0xc9391ee0, 
    cred=0xc0b74880, flags=1) at /sys/kern/vfs_vnops.c:434
#39 0xc0244712 in dofilewrite (p=0xc90caad4, fd=3, fp=0xc92f18bc, buf=0x0, 
    nbyte=8192, offset=0xc92f18e4, flags=1, retval=0xc9391f78)
    at /sys/kern/sys_generic.c:346
#40 0xc024499e in sys_write (p=0xc90caad4, v=0xc9391f80, retval=0xc9391f78)
    at /sys/kern/sys_generic.c:303
#41 0xc0323567 in syscall_plain (frame={tf_gs = 31, tf_fs = 31, tf_es = 31, 
      tf_ds = 31, tf_edi = -1077945768, tf_esi = 134519888, 
      tf_ebp = -1077945880, tf_ebx = 134519932, tf_edx = 0, 
      tf_ecx = 1208934816, tf_eax = 4, tf_trapno = 3, tf_err = 2, 
      tf_eip = 1208875219, tf_cs = 23, tf_eflags = 647, tf_esp = -1077954116, 
      tf_ss = 31, tf_vm86_es = 0, tf_vm86_ds = 0, tf_vm86_fs = 0, 
      tf_vm86_gs = 0}) at /sys/arch/i386/i386/syscall.c:140
#42 0xc0100f56 in syscall1 ()

>How-To-Repeat:
	1. enable SOFTDEP and DIAGNOSTIC.
	2. mount ffs partition with softdep.
	3. run following program on it.

====================
#include <err.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>

#define	BUFSIZE	8192
const char *test = "test";

int
main()
{
	char tmp[BUFSIZE];
	char *bad_ptr = 0;
	int fd, fd_to;

	fd_to = open(test, O_WRONLY|O_CREAT|O_TRUNC, 0777);
	if (fd_to < 0)
		err(1, "open");

	if (write(fd_to, tmp, BUFSIZE) != BUFSIZE)
		err(1, "write0");

	if (write(fd_to, bad_ptr, BUFSIZE) != BUFSIZE) /* panic here */
		err(1, "write");

	fprintf(stderr, "success\n");
}
====================
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted: