Issue #2756 has been updated by tkusumi.
Thanks for the latest iso. I guess 15bd3c7353c5ce02776849ca16be00d5088d8734 is it. I couldn't reproduce it with this binary. This is what I did. I brought some bsd and linux kernel repositories/archives which is good to fill btree with bunch of inodes, dirents, etc. Without doing this output of hammer show (size of btree) isn't large enough to reproduce it. # uname -r 4.1-DEVELOPMENT # git clone git://git.dragonflybsd.org/dragonfly.git # git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git # git clone https://github.com/freebsd/freebsd.git # wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.18.tar.gz # wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.17.tar.gz # wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.16.tar.gz # wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.15.tar.gz # tar xzf linux-3.18.tar.gz # tar xzf linux-3.17.tar.gz # tar xzf linux-3.16.tar.gz # tar xzf linux-3.15.tar.gz # df -Th | head -2 Filesystem Type Size Used Avail Capacity Mounted on ROOT hammer 74G 9.7G 65G 13% / After filling btree with above files, tried it again. It didn't reproduce while it reproduced 100% in my 4.0 environment. # hammer -f `hammer volume-list /` show > show.out # ls -lh show.out -rw-r--r-- 1 root wheel 389M Jan 5 10:54 show.out # grep ELM ./show.out | wc -l 1412014 ---------------------------------------- Bug #2756: Hit kernel panic while running hammer show cmd http://bugs.dragonflybsd.org/issues/2756#change-12386 * Author: tkusumi * Status: New * Priority: High * Assignee: tuxillo * Category: Kernel * Target version: 4.0.x ---------------------------------------- Hit kernel panic while running hammer show cmd. All I did was # uname -r 4.0-RELEASE # hammer -f /dev/serno/xxxxxxxx.s1d show > show.out where /dev/serno/xxxxxxxx.s1d is a volume for / hammerfs with enough space left. It's running as a virtualbox guest on x86_64. It happens whenever the size of show.out gets around 250MB. # df -h Filesystem Size Used Avail Capacity Mounted on ROOT 74G 8.2G 66G 11% / ... x/i says it died at movl at dscheck+0x8b (ffffffff80618025) ffffffff80618025: 44 8b 7b 0c mov 0xc(%rbx),%r15d ffffffff80618029: 44 3b 7d b8 cmp -0x48(%rbp),%r15d ffffffff8061802d: 77 28 ja ffffffff80618057 <dscheck+0xbd> dscheck() was called as a sequence of btree lookup by hammer show. hammer_vop_strategy_read() -> hammer_ip_first() -> hammer_btree_lookup() -> btree_search() -> hammer_cursor_down() -> hammer_get_node() -> hammer_load_node() -> hammer_get_buffer() -> hammer_load_buffer() -> hammer_io_read() -> hammer_cluster_read() -> ... (failed to catch any further) I saw disas of /boot/kernel/kernel and this movl seems to be null pointer dereference of *ssp at if (slice >= ssp->dss_nslices) of the following. > struct bio * > dscheck(cdev_t dev, struct bio *bio, struct diskslices *ssp) > { > struct buf *bp = bio->bio_buf; > struct bio *nbio; > disklabel_t lp; > disklabel_ops_t ops; > long nsec; > u_int64_t secno; > u_int64_t endsecno; > u_int64_t slicerel_secno; > struct diskslice *sp; > u_int32_t part; > u_int32_t slice; > int shift; > int mask; > > slice = dkslice(dev); > part = dkpart(dev); > > if (bio->bio_offset < 0) { > kprintf("dscheck(%s): negative bio_offset %lld\n", > devtoname(dev), (long long)bio->bio_offset); > goto bad; > } > if (slice >= ssp->dss_nslices) { > kprintf("dscheck(%s): slice too large %d/%d\n", > devtoname(dev), slice, ssp->dss_nslices); > goto bad; > } -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account
