kern/41442: kernel panic ufsdirhash_lookup: bad offset in hash array

[o.vd.linden%quicknet.nl@localhost]

>Number:         41442
>Category:       kern
>Synopsis:       kernel panic ufsdirhash_lookup: bad offset in hash array
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat May 16 12:15:01 +0000 2009
>Originator:     Onno van der Linden
>Release:        5.99.11
>Organization:
>Environment:
NetBSD sheep 5.99.11 NetBSD 5.99.11 (GENERIC) #0: Wed May  6 15:59:23 MEST 2009 
 onno@sheep:/usr/src/sys/arch/i386/compile/GENERIC i386
>Description:
Kernel crash at 3:16AM. Just after /etc/daily gets started from root's crontab 
and with one
(completed) torrent still serving client connections. 

# crash -M netbsd.0.core
Crash version 5.99.11, image version 5.99.11.
System panicked: ufsdirhash_lookup: bad offset in hash array
Backtrace from time of crash is available.
crash>bt
_KERNEL_OPT_NAPMBIOS(0,104,c04737b6,104,1,cb83a388,c05863d8,104,0,c09413c0) at 0

exec_script_execsw(104,0,c09413c0,cc49d320,c091a420,6,0,cb83a394,10246,c091a30e)
 at 0xcb83a434
panic(c091a2d4,0,cb83a434,c05babc3,e3,cc367008,6,a,40000040,15e3) at 0xc05863d8
trap() at 0xc05ba399
--- trap (number 6) ---
db_read_bytes(25dc,4,cb83a4a4,c011d4df,83a4b8,0,0,cb83a994,cb83a994,0) at 0xc024
1b00
db_get_value(25dc,4,0,0,1934e00,0,ce2b994c,14e04d3,c0941408,c09413c0) at 0xc023d
0ce
db_stack_trace_print(cb83a994,1,ffff,c0923c63,c0585940,cb83a9a8,c09413c0,cc49d32
0,cb8ade54,2) at 0xc0243c78
panic(c0b18d98,cd4a1734,cb83a9fc,c0af40cd,ca8254d0,cc49d4e0,0,c065af60,cd4a1734,
ffffffff) at 0xc05863aa
ufsdirhash_lookup(cd4a0694,cc74f00a,5,cd4a06f8,cb83aaac,0,1,ffffffff,cb8addb4,cb
8addb4) at 0xc0af413d
ufs_lookup(cb83aad8,0,cb83aaec,c0645592,cb8addb4,c08a7e20,cd4a1734,cb83ac04,cb83
ac18,cb83ab2c) at 0xc0af71bc
VOP_LOOKUP(cd4a1734,cb83ac04,cb83ac18,cb83abf0,20,0,0,0,cb83ac18,cc49d320) at 0x
c065be2d
lookup(cb83abf0,20002,400,cb83ac0c,1,f17aeb9a,cb83ac0c,c04e04d3,0,cc74f000) at 0
xc0640425
namei(cb83abf0,0,cb83ac3c,c0647af9,0,0,cc1643b0,bb90e2b4,0,0) at 0xc0640b49
do_sys_stat(bb90e2b4,40,cb83ac58,c0100716,cb83ad00,0,cb83acd0,cc1c8ef0,bb90d000,
1000) at 0xc0647b08
sys___stat50(cc49d320,cb83ad00,cb83ad28,cb83ad00,cc1c8ef0,cc0b779c,1b7,bb90e2b4,
bfbfebb4,bfbfec48) at 0xc0647b9f
syscall(cb83ad48,b3,ab,1f,1f,3,1,bfbfec48,bb90e2b4,bb90e2b4) at 0xc0599999

Crash dump and kernel available for examination


This is on
cpu0 at mainbus0 apid 0: Intel 686-class, 2289MHz, id 0xf24
ioapic0 at mainbus0 apid 2: pa 0xfec00000, version 20, 24 pins
acpi0 at mainbus0: Intel ACPICA 20080321
acpi0: X/RSDT: OemId <ASUS  ,P4B533  ,42302e31>, AslId <MSFT,31313031>
with wm(4) and wd(4) for network and disk I/O.

I've seen *exactly* the same crash with the same kernel on a very old
compaq DL-360 (2 CPU, 800MHz) which also had high network and
disk activity at the same time. This machine used ld(4) and fxp(4) for
network and disk I/O


>How-To-Repeat:
Combination of high network I/O in combination with high disk activity
seems to do the trick.
>Fix:
No fix known. Maybe related to kern/33630 ? pool code corrupting other kernel 
structures ?