kern/39943: mount_udf reliably crashes kernel

[christos%zoulas.com@localhost]

>Number:         39943
>Category:       kern
>Synopsis:       mount_udf reliably crashes kernel
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Nov 17 19:05:00 +0000 2008
>Originator:     Christos Zoulas
>Release:        NetBSD 5.99.01
>Organization:
        Someone else's fingers.
>Environment:
System: NetBSD t61.localnet 5.99.01 NetBSD 5.99.01 (T61) #0: Tue Nov 11 
18:30:40 EST 2008  
ljt%t61.localnet@localhost:/s/NetBSD/obj/sys/arch/amd64/compile/T61 amd64
Architecture: amd64
Machine: amd64
>Description:

        mount -r -t udf /dev/cd1d /mnt

causes a crash.  This worked a few months ago.  It also happens with
/dev/cd0d (my internal drive), and with /dev/cd1a, FWTW.  /dev/cd1[ad]
is my external drive hanging off a USB-IDE adapter, but that seems
irrelevant as the internal drive has the same problem.

NetBSD t61.localnet 5.99.01 NetBSD 5.99.01 (T61) #0: Tue Nov 11 18:30:40 ES=
T 2008  ljt%t61.localnet@localhost:/s/NetBSD/obj/sys/arch/amd64/compile/T61 
amd64

Kernel and userland sources tagged 2008.11.11.16.00.00.  The kernel is
basically a DEBUG/LOCKDEBUG/DIAGNOSTIC GENERIC kernel (also attached).

The crash also happens with udf_strat_rmw.c 1.12 committed 11/15.

0 ljt:staff@t61/~$ ident /netbsd.test | fgrep udf
     $NetBSD: udf_osta.c,v 1.7 2008/05/19 20:12:36 reinoud Exp $
     $NetBSD: udf_vfsops.c,v 1.52 2008/10/29 18:09:47 reinoud Exp $
     $NetBSD: udf_vnops.c,v 1.30 2008/07/17 19:10:22 reinoud Exp $
     $NetBSD: udf_subr.c,v 1.73 2008/09/27 13:05:34 reinoud Exp $
     $NetBSD: udf_readwrite.c,v 1.8 2008/08/29 15:04:18 reinoud Exp $
     $NetBSD: udf_strat_bootstrap.c,v 1.2 2008/08/29 15:04:18 reinoud Exp $
     $NetBSD: udf_strat_sequential.c,v 1.5 2008/08/29 15:04:18 reinoud Exp =
$
     $NetBSD: udf_strat_direct.c,v 1.5 2008/08/29 15:04:18 reinoud Exp $
     $NetBSD: udf_strat_rmw.c,v 1.12 2008/11/15 18:26:50 reinoud Exp $
     $NetBSD: udf_allocation.c,v 1.18 2008/08/29 15:04:18 reinoud Exp $
0 ljt:staff@t61/~$=20

Kernel config:

# $Id: T61,v 1.2 2008/09/23 13:38:55 ljt Exp $

include "arch/amd64/conf/GENERIC"

makeoptions DEBUG="-g"

file-system     UDF             # experimental - OSTA UDF CD/DVD file-system

spdmem* at iic? addr 0x44
spdmem* at iic? addr 0x54
spdmem* at iic? addr 0x55
spdmem* at iic? addr 0x56
spdmem* at iic? addr 0x5c

options         PCKBD_LAYOUT="(KB_US | KB_SWAPCTRLCAPS)"
options         UKBD_LAYOUT="(KB_US | KB_SWAPCTRLCAPS)"

options         BUFQ_READPRIO
options         BUFQ_PRIOCSCAN

options         PCI_ADDR_FIXUP          # fixup PCI I/O addresses
options         PCI_BUS_FIXUP           # fixup PCI bus numbering
options         PCI_INTR_FIXUP          # fixup PCI interrupt routing

options         DIAGNOSTIC
options         DEBUG
options         LOCKDEBUG
options         MALLOCLOG

>How-To-Repeat:
        mount -r -t udf /dev/cd1d /mnt
>Fix:
        ?