DragonFlyBSD Kernel Audit
DF-0910 / panic.txt
← back to finding ↓ download raw
DF-0910 PANIC SIGNATURE (from dfbsd-qemu/boot.log, unpatched #0 kernel)
======================================================================

Trigger: HAMMER_IOC_PRUNE ioctl with elms[0].mod_tid=0 on a HAMMER v1 mount
         (/df910, vn0-backed 12GB sparse image) after seeding a deleted
         record (creat+write+unlink+sync).

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer	= 0x8:0xffffffff8094bcfb
stack pointer	        = 0x10:0xfffff80117f97318
frame pointer	        = 0x10:0xfffff80117f97478
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1071
current thread          = pri 6 
kernel: type 18 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      hammer_ioc_prune+0x31b: divq    %r9,%eax
db> 

----------------------------------------------------------------------
Trap 18 = x86 #DE (Divide Error). The faulting instruction is `divq`
(unsigned 64-bit divide) inside hammer_ioc_prune at offset +0x31b — this is
the inlined body of the static helper prune_should_delete() at
sys/vfs/hammer/hammer_prune.c:305-306:

    (elm->base.create_tid - scan->beg_tid) / scan->mod_tid
    ==
    (elm->base.delete_tid - scan->beg_tid) / scan->mod_tid

with scan->mod_tid == 0 (user-supplied via copyin at hammer_prune.c:104,
no zero-check in the validation block at hammer_prune.c:67-81).