kern/46749: Accessing to ld0 at sdmmc0 causes kernel panic on NetBSD/i386 current

[ryoon%NetBSD.org@localhost]

>Number:         46749
>Category:       kern
>Synopsis:       Accessing to ld0 at sdmmc0 causes kernel panic on NetBSD/i386 
>current
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jul 28 17:25:00 +0000 2012
>Originator:     Ryo ONODERA
>Release:        NetBSD 6.99.10
>Organization:
        
>Environment:
        
        
System: NetBSD hydrogen.elements.tetera.org 6.99.10 NetBSD 6.99.10 (GENERIC) 
#0: Sun Jul 29 01:59:47 JST 2012 
root%hydrogen.elements.tetera.org@localhost:/usr/obj/sys/arch/i386/compile/GENERIC
 i386
Architecture: i386
Machine: i386
>Description:
When I access to /dev/ld0e on ld0 at sdmmc0, kernel panics.
SD card is formatted as ffs.

% crash -M netbsd.4.core -N netbsd.4
Crash version 6.99.10, image version 6.99.10.
System panicked: pool_get(ffsdino2): free list modified: magic=0; page 
0xc280f000; item addr 0xc280fe00

Backtrace from time of crash is available.
crash> tr
_KERNEL_OPT_NAPMBIOS(c0c40804,104,c05ea788,8,5,0,0,daf45558,c2106d20,0) at 0
_end(104,0,fff1,c0c58b6f,c07eb7c5,c0c595b9,daf4559c,80c7dc,b,0) at daf455b8
vpanic(c0c40804,daf455b8,daf455ac,c0953a7d,c25582c0,c2070000,daf455fc,c07e7973,c
0c40804,c0bd4dae) at vpanic+0x1cf
printf_nolog(c0c40804,c0bd4dae,0,c280f000,c280fe00,c2599b0c,c0c595b9,c280c87c,c2
80c7dc,c2070078) at printf_nolog
pool_cache_cpu_init1(c2070000,1,0,40bc9b,c28096e4,c0b9e320,c2103d40,c2102b80,0,c
2599b0c) at pool_cache_cpu_init1
pool_cache_get_slow(0,1,cb0000,daf45710,daf45710,0,daf4569c,c08fbf95,c280c7dc,0)
 at pool_cache_get_slow+0x19a
pool_cache_get_paddr(c2070000,1,0,4000,ffffffff,0,daf45710,21ff,c0ce0000,0) at p
ool_cache_get_paddr+0x1e5
ffs_vget(c2575000,7ac4b,0,daf457ec,daf457f0,0,6,c25db168,1,10) at ffs_vget+0x37a

ufs_lookup(daf45844,c25db008,daf4585c,c092f7c5,daf4584c,c25db168,daf4588c,c090f6
16,c25d5580,daf45873) at ufs_lookup+0x7b4
VOP_LOOKUP(c25db008,daf458b0,daf45a74,2,0,c24e5790,daf458cc,c25db168,1,daf45a50)
 at VOP_LOOKUP+0x33
lookup_once(daf4597c,daf45978,4,c07e8566,0,c2810000,1,daf459dc,1,10) at lookup_o
nce+0x19f
namei_tryemulroot(0,c2045c00,0,c07e9fca,0,c2050988,daf45a0c,c2573680,c1f72e70,c0
b99c20) at namei_tryemulroot+0x21e
namei(daf45a50,c2048200,0,c07e9fca,0,1,0,c0953a7d,c24babd0,ffffffff) at namei+0x
29
check_exec(c25582c0,daf45b4c,c238dee0,c25925b0,daf45c40,0,daf45b1c,c08de4b1,c24b
9920,bb952000) at check_exec+0x36
execve_loadvm(bb906f94,c05681c0,daf45b4c,0,40,55,bb906f54,c253b800,c253bc00,c280
4800) at execve_loadvm+0x1bc
execve1(c25582c0,bb906f54,bb906f84,bb906f94,c05681c0,c24bac44,daf45d1c,c25582c0,
daf45d48,c0cd6448) at execve1+0x32
sys_execve(c25582c0,daf45cf4,daf45d1c,c24b41b0,0,bb952c64,bb952000,c24b991c,0,3b
) at sys_execve+0x30
syscall() at syscall+0x89
--- syscall (number 59) ---
bba98617:
crash>

        
>How-To-Repeat:
Insert SDHC card to sdmmc slot and,
# mount /dev/ld0e /mnt
# ls /mnt

        
>Fix:
        
I have no idea.


>Unformatted: