DragonFlyBSD Kernel Audit
DF-2644 / fix_run_partial_3112.txt
← back to finding ↓ download raw
Fix-validation partial run — DragonFly 6.5-DEVELOPMENT #1 (kernel B = stock +
inject.diff + fix.diff), captured from the QEMU serial console (vm.sh log)
during the run of run_df2644_inj.sh (arm=100000 variant).  The DF-2644
crash site is passed without a fault; the guest later panics at the
UNRELATED pre-existing hammer2_chain_create KKASSERT(parent->error == 0)
(chain.c:3112) via hammer2_xop_inode_create_ins — the same defect that
kernel A's first run hit via hammer2_assign_physical/strategy_write
before the injector was volume-gated.  Verbatim serial tail:

---8<---
hammer2_chain_load_data: I/O error 000000000240080a: 5
hammer2: unable to fsync inode 0xfffff80118c205c0
hammer2_chain_load_data: I/O error 000000000240080a: 5
hammer2_chain_load_data: I/O error 000000000240080a: 5
hammer2: chain error during flush
hammer2_chain_load_data: I/O error 000000000240080a: 5
PARENT ERROR DURING FLUSH LOCK 0xfffff80118b41080->0xfffff80118b41680
hammer2_chain_load_data: I/O error 000000000240080a: 5
hammer2: chain error during flush
hammer2_chain_load_data: I/O error 000000000240080a: 5
PARENT ERROR DURING FLUSH LOCK 0xfffff80118b41080->0xfffff80118b42280
hammer2_chain_load_data: I/O error 000000000240080a: 5
hammer2_chain_load_data: I/O error 000000000240080a: 5
hammer2: chain error during flush
hammer2_chain_load_data: I/O error 000000000240080a: 5
hammer2_chain_load_data: I/O error 000000000280000a: 5
panic: assertion "parent->error == 0" failed in hammer2_chain_create at /usr/src/sys/vfs/hammer2/hammer2_chain.c:3112
cpuid = 0
Trace beginning at frame 0xfffff80118ccd730
hammer2_chain_create() at hammer2_chain_create+0x1209 0xffffffff80973e79
hammer2_chain_create() at hammer2_chain_create+0x1209 0xffffffff80973e79
hammer2_xop_inode_create_ins() at hammer2_xop_inode_create_ins+0x11b 0xffffffff8098012b
hammer2_primary_xops_thread() at hammer2_primary_xops_thread+0x280 0xffffffff8095da60
Debugger("panic")

CPU0 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdae59(%rip)
db>
---8<---

Key contrast with kernel A's panic.txt: on kernel A the sequence
"hammer2: chain error during flush" (stage-2 iroot flush) is IMMEDIATELY
followed by "Fatal trap 12 ... fault virtual address = 0x200 ... Stopped
at hammer2_xop_inode_flush+0x39c: repe movsq (%rsi),%es:(%rdi)".  On
kernel B the same flush-error sequence continues with further handled
loads/PARENT ERROR messages and the stage-2 iroot flush completes; no
fault at hammer2_xop_inode_flush occurs at any point.