kern/38121: "panic: buf mem pool index 23" crash apparently caused by mounting msdos floppy image

["Greg A. Woods" <woods%planix.com@localhost>]

>Number:         38121
>Category:       kern
>Synopsis:       "panic: buf mem pool index 23" crash apparently caused by 
>mounting msdos floppy image
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Feb 28 22:05:00 +0000 2008
>Originator:     Greg A. Woods
>Release:        NetBSD 4.0_STABLE
>Organization:
Planix, Inc.; Toronto, Ontario; Canada
>Environment:
System: NetBSD 4.0_STABLE GENERIC.MP
Architecture: i386
Machine: i386
>Description:

panic: buf mem pool index 23
Stopped in pid 13.1 (ioflush) at        netbsd:cpu_Debugger+0x4:        popl    
%ebp
db{0}> trace
cpu_Debugger(c0959581,d9092718,b7d59dae,202,c09da440) at netbsd:cpu_Debugger+0x4
panic(c093264f,17,60e,246,d909272c) at netbsd:panic+0x155
allocbuf(da9a45fc,0,1,c04335c7,da9a4448) at netbsd:allocbuf+0x4a7
getblk(d930c590,a,0,0,0) at netbsd:getblk+0x2d5
bread(d930c590,a,0,0,ffffffff) at netbsd:bread+0x62
pcbmap(da9a5c80,300,d9092914,0,0) at netbsd:pcbmap+0x198
msdosfs_bmap(d9092890,d000,d90928ac,c07c4820,da9a368c) at 
netbsd:msdosfs_bmap+0x5f
VOP_BMAP(da9a368c,300,0,d9092924,d9092914) at netbsd:VOP_BMAP+0x40
genfs_do_io(ce03e000,d000,11,1,c03d8040) at netbsd:genfs_do_io+0x24f
genfs_gop_write(da9a368c,d9092aa4,d,11,d9092aa8) at netbsd:genfs_gop_write+0x61
genfs_do_putpages(da9a368c,0,0,0,0) at netbsd:genfs_do_putpages+0xb4b
genfs_putpages(d9092b40,c024,b7d59dae,c07c4a60,da9a368c) at 
netbsd:genfs_putpages+0x3d
VOP_PUTPAGES(da9a368c,0,0,0,0) at netbsd:VOP_PUTPAGES+0x40
vflushbuf(da9a368c,0,d9092bcc,c048b0f5,da9a3718) at netbsd:vflushbuf+0x61
msdosfs_fsync(d9092bf8,10012,d9092c1c,c048689f,da9a368c) at 
netbsd:msdosfs_fsync+0x27
VOP_FSYNC(da9a368c,d0020f04,8,0,0) at netbsd:VOP_FSYNC+0x49
sched_sync(d002f6b8,0,c01002d2,fbff,c01002d2) at netbsd:sched_sync+0x22b
db{0}> reboot
syncing disks... panic: lockmgr: locking against myself
Stopped in pid 13.1 (ioflush) at        netbsd:cpu_Debugger+0x4:        popl    
%ebp
db{0}> reboot
rebooting...

>How-To-Repeat:

        I had mounted a floppy image containing drdos in hopes of
        creating a bootable ISO with a BIOS update for my Dell PE2650.
        (Earlier attempts with an msdos622 image failed due to the
        update program being "too big to fit in memory")

        The image file came from the drdflash.zip file commonly
        available for download at many sites (I'm pretty sure my copy
        came from bootdisk.com).

16:48 [2000] # mkdir drdflash
16:49 [2001] # cd drdflash
16:49 [2002] # unzip ../drdflash.zip
Archive:  ../drdflash.zip
  inflating: LICENCE.TXT             
  inflating: README.TXT              
  inflating: FIRM.COM                
  inflating: DRDFLASH.IMG            
16:49 [2003] # cd ..
16:49 [2004] # cp drdflash/DRDFLASH.IMG PE2650-A21-boot-drdfloppy.image
16:50 [2005] # vnconfig -c vnd0 PE2650-A21-boot-drdfloppy.image
16:50 [2006] # fsck_msdos /dev/vnd0a
** /dev/vnd0a
** Phase 1 - Read and Compare FATs
** Phase 2 - Check Cluster Chains
** Phase 3 - Checking Directories
** Phase 4 - Checking for Lost Files
5 files, 1302 free (2605 clusters)
16:50 [2007] # mount -t msdos /dev/vnd0a /floppy


        I then copied the BIOS update program to the /floppy filesystem
        and some moments later, just as I was about to type the "umount"
        command, the system crashed, presumably while trying to flush
        the pending I/Os out to the vnd device.

>Fix:

        unknown