From root@gw1.svzserv.kuzbass.ru  Wed May 16 11:19:21 2007
Return-Path: <root@gw1.svzserv.kuzbass.ru>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id C104F16A401
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 16 May 2007 11:19:21 +0000 (UTC)
	(envelope-from root@gw1.svzserv.kuzbass.ru)
Received: from hq.svzserv.kemerovo.su (hq.svzserv.kemerovo.su [213.184.65.65])
	by mx1.freebsd.org (Postfix) with ESMTP id 3AFDF13C455
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 16 May 2007 11:19:20 +0000 (UTC)
	(envelope-from root@gw1.svzserv.kuzbass.ru)
Received: from gw1.svzserv.kuzbass.ru (gw1.svzserv.kuzbass.ru [213.184.65.94])
	by hq.svzserv.kemerovo.su (8.13.8/8.13.8) with ESMTP id l4GAvKTk073899;
	Wed, 16 May 2007 18:57:20 +0800 (KRAST)
	(envelope-from root@gw1.svzserv.kuzbass.ru)
Received: from gw1.svzserv.kuzbass.ru (localhost [127.0.0.1])
	by gw1.svzserv.kuzbass.ru (8.13.8/8.14.1) with ESMTP id l4GJHDut013096;
	Wed, 16 May 2007 19:17:13 GMT
	(envelope-from root@gw1.svzserv.kuzbass.ru)
Received: (from root@localhost)
	by gw1.svzserv.kuzbass.ru (8.13.8/8.14.1/Submit) id l4GJHDpn013095;
	Wed, 16 May 2007 19:17:13 GMT
	(envelope-from root)
Message-Id: <200705161917.l4GJHDpn013095@gw1.svzserv.kuzbass.ru>
Date: Wed, 16 May 2007 19:17:13 GMT
From: Eugene Grosbein <eugen@kuzbass.ru>
To: FreeBSD-gnats-submit@freebsd.org
Subject: 6.2-STABLE panic: spoiling cp->ace = 3
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         112707
>Category:       kern
>Synopsis:       [panic] 6.2-STABLE panic: spoiling cp->ace = 3
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 16 11:20:02 GMT 2007
>Closed-Date:    Wed Oct 12 15:06:11 UTC 2011
>Last-Modified:  Wed Oct 12 15:06:11 UTC 2011
>Originator:     Eugene Grosbein
>Release:        FreeBSD 6.2-STABLE i386
>Organization:
Svyaz Service JSC
>Environment:
System: FreeBSD gw1.svzserv.kuzbass.ru 6.2-STABLE FreeBSD 6.2-STABLE #2: Thu Apr 26 17:48:06 UTC 2007 root@gw1.svzserv.kuzbass.ru:/home/obj/home/src/sys/GW1 i386

>Description:
	I use Transcend IDE Flash for diskless NanoBSD installation.
	It works pretty nice: BIOS detects it as 128M hard drive,
	NanoBSD boots and works flawlessly, I can even do remote upgrade:
	/dev/ad0 is divided to two slices and I may download
	new slice image into second slice (sysctl kern.geom.debugflags=16).
	After that, I need to change default slice for boot0:

boot0cfg -s 2 ad0

	This command works also, but after that all access
	to (mounted r/o) root partition fails with kernel message
	g_vfs_done about READ error. I need to power cycle machine
	to reboot it, it reboots and I see that boot0cfg did the job.
	However, this it not suitable for remote server.

	The kernel compiled with options INVARIANTS did not complete
	updating boot0 with mentioned command but panices immediately:

panic: spoiling cp->ace = 3

	This NanoBSD installation does not have dump device for crashdump
	by default and I have not one handy. But I hope it's possible
	to add IDE drive to the system and make dump device on it, if needed.

>How-To-Repeat:
	
	Kernel config file follows.

options		INCLUDE_CONFIG_FILE

machine		i386
cpu		I686_CPU
ident		GW
maxusers	0

options 	SCHED_4BSD		# 4BSD scheduler
options 	PREEMPTION		# Enable kernel thread preemption

options		CLK_USE_I8254_CALIBRATION

options 	INET			#InterNETworking
options 	FFS			#Berkeley Fast Filesystem
#options 	SOFTUPDATES		#Enable FFS soft updates support
options 	COMPAT_43		#Compatible with BSD 4.3 [KEEP THIS!]
options 	_KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options 	KTRACE			#ktrace(1) support

device		acpi

device		isa
device		pci

# Floppy drives
device		fdc

# atkbdc0 controls both the keyboard and the PS/2 mouse
device		atkbdc
device		atkbd

options 	ATKBD_DFLT_KEYMAP	# specify the built-in keymap
makeoptions	ATKBD_DFLT_KEYMAP=ru.koi8-r

device		vga

# syscons is the default console driver, resembling an SCO console
device		sc
options		SC_HISTORY_SIZE=1000
options 	SC_DFLT_FONT		# compile font in
makeoptions	SC_DFLT_FONT=cp866

# Floating point support - do not disable.
device		npx

# Serial (COM) ports
device		sio
device		em

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device		miibus		# MII bus support
#device		rl		# RealTek 8129/8139
device		fxp		# Intel EtherExpress PRO/100B (82557, 82558)
device		sk

# Pseudo devices
device		loop			# Network loopback
device		mem
device		io
device		random
device		ether		# Ethernet support
device		ppp		# Kernel PPP
device		tun		# Packet tunnel.
device		pty		# Pseudo-ttys (telnet etc)
device		snp
device		md
device		gif		# IPv6 and IPv4 tunneling
device		vlan

# The `bpf' pseudo-device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
device		bpf		#Berkeley packet filter

device		ata
device		atadisk		# ATA disk drives

# USB support
#device		uhci		# UHCI PCI->USB interface
#device		usb		# USB Bus (required)
#device		umass		# Disks/Mass storage - Requires scbus and da

#device		scbus		# SCSI bus (required for SCSI)
#device		da		# Direct Access (disks)
#device		pass		# Passthrough device (direct SCSI access)

options		NO_SWAPPING

options 	IPFIREWALL
options 	IPFIREWALL_VERBOSE
options 	IPDIVERT
options 	IPFIREWALL_FORWARD
options		DUMMYNET
options		IPSEC
options		IPSEC_ESP
options		IPSEC_FILTERGIF

options 	HZ=1000
options		DEVICE_POLLING

options		ALT_BREAK_TO_DEBUGGER
options		KDB                     # Enable kernel debugger support.
options		KDB_TRACE
options		KDB_UNATTENDED

options		INVARIANTS
options		INVARIANT_SUPPORT

>Fix:

	Unknown for me

>Release-Note:
>Audit-Trail:

From: Eugene Grosbein <eugen@kuzbass.ru>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/112707: 6.2-STABLE panic: spoiling cp->ace = 3
Date: Fri, 18 May 2007 17:48:58 +0800

 Hi!
 
 I managed to obtain crashdump and got backtrace that follows.
 I also put online kernel.debug and crashdump, both compressed (5Mb and 8.5Mb)
 here: http://www.grosbein.pp.ru/panic-spoiling/
 
 cript started on Fri May 18 17:34:50 2007
 kgdb: kvm_nlist(_stopped_cpus): 
 kgdb: kvm_nlist(_stoppcbs): 
 [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so:
 Undefined
 symbol "ps_pglobal_lookup"]
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-marcel-freebsd".
 
 Unread portion of the kernel message buffer:
 panic: spoiling cp->ace = 3
 KDB: stack backtrace:
 kdb_backtrace(c068b1c3,c06e20c0,c0685e63,c5c69934,100,...) at 0xc0527773 =
 kdb_backtrace+0x2f
 panic(c0685e63,3,c06858b9,370,c1239b00,...) at 0xc050b74d = panic+0xb8
 g_spoil(c1239b00,c122eb00,1,3,0,...) at 0xc04d1e4f = g_spoil+0x57
 g_access(c122eb00,0,1,0,2000,...) at 0xc04d1abc = g_access+0x27e
 g_dev_open(c1268c00,2,2000,c1296300,c1268c00,...) at 0xc04cbe2e =
 g_dev_open+0x106
 devfs_open(c5c69a54,c5c69d04,c5c69bc4,0,c5c69b10,...) at 0xc04c90cc =
 devfs_open+0x197
 VOP_OPEN_APV(c06b6300,c5c69a54,0,c5c69a54,0,...) at 0xc066212a =
 VOP_OPEN_APV+0x9d
 vn_open_cred(c5c69bc4,c5c69cc4,1a4,c1818a80,4,...) at 0xc05760b0 =
 vn_open_cred+0x457
 vn_open(c5c69bc4,c5c69cc4,1a4,4,c5c69b68,...) at 0xc0575c57 = vn_open+0x33
 kern_open(c1296300,804c030,0,2,1b6,...) at 0xc056e029 = kern_open+0xca
 open(c1296300,c5c69d04,c,804d000,3,...) at 0xc056df27 = open+0x36
 syscall(3b,3b,3b,804c030,0,...) at 0xc06586d2 = syscall+0x295
 Xint0x80_syscall() at 0xc0648d0f = Xint0x80_syscall+0x1f
 --- syscall (5, FreeBSD ELF32, open), eip = 0x28137437, esp = 0xbfbfe83c, ebp
 =
 0xbfbfe868 ---
 KDB: enter: panic
 Uptime: 1m7s
 Dumping 47 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 47MB (12032 pages) 32 16
 
 #0  doadump () at pcpu.h:165
 165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
 (kgdb) bt full
 #0  doadump () at pcpu.h:165
 No locals.
 #1  0xc050b4ad in boot (howto=260) at /home/src/sys/kern/kern_shutdown.c:409
         first_buf_printf = 1
 #2  0xc050b7cb in panic (fmt=0xc0685e63 "spoiling cp->ace = %d")
     at /home/src/sys/kern/kern_shutdown.c:565
         td = (struct thread *) 0xc1296300
         bootopt = 256
         newpanic = 1
         ap = 0xc5c69934 "\003"
         buf = "spoiling cp->ace = 3", '\0' <repeats 235 times>
 #3  0xc04d1e4f in g_spoil (pp=0xc1239b00, cp=0xc122eb00)
     at /home/src/sys/geom/geom_subr.c:891
         cp2 = (struct g_consumer *) 0x0
 #4  0xc04d1abc in g_access (cp=0xc122eb00, dcr=0, dcw=1, dce=0)
     at /home/src/sys/geom/geom_subr.c:741
         pp = (struct g_provider *) 0xc1239b00
         pw = 0
         pe = 3
         error = 0
 #5  0xc04cbe2e in g_dev_open (dev=0xc1268c00, flags=6, fmt=0, td=0xc1296300)
     at /home/src/sys/geom/geom_dev.c:196
         gp = (struct g_geom *) 0x0
         cp = (struct g_consumer *) 0xc122eb00
 ---Type <return> to continue, or q <return> to quit---
         error = 6
         r = 0
         w = 1
 #6  0xc04c90cc in devfs_open (ap=0xc5c69a54)
     at /home/src/sys/fs/devfs/devfs_vnops.c:766
         _giantcnt = 0
         td = (struct thread *) 0xc1296300
         vp = (struct vnode *) 0xc184a660
         dev = (struct cdev *) 0xc1268c00
         fp = (struct file *) 0x0
         error = -1066703424
         dsw = (struct cdevsw *) 0xc06b65c0
 #7  0xc066212a in VOP_OPEN_APV (vop=0x0, a=0xc5c69a54) at vnode_if.c:372
         rc = 0
 #8  0xc05760b0 in vn_open_cred (ndp=0xc5c69bc4, flagp=0xc5c69cc4, cmode=420, 
     cred=0xc1818a80, fdidx=4) at vnode_if.h:198
         vp = (struct vnode *) 0xc184a660
         mp = (struct mount *) 0x139
         td = (struct thread *) 0xc1296300
         vat = {va_type = 3226510025, va_mode = 14000, va_nlink = -16087, 
   va_uid = 1, va_gid = 3228085506, va_fsid = 3318127288, 
   va_fileid = -1068627818, va_size = 4294967264, va_blocksize = 4, 
   va_atime = {tv_sec = -976839976, tv_nsec = -1068627430}, va_mtime = {
     tv_sec = -1049548544, tv_nsec = 4}, va_ctime = {tv_sec = 20, 
 ---Type <return> to continue, or q <return> to quit---
     tv_nsec = 4}, va_birthtime = {tv_sec = -1049548500, tv_nsec = 1380}, 
   va_gen = 3228071115, va_flags = 3318127360, va_rdev = 3226471867, 
   va_bytes = 7540386092, va_filerev = 1369027681980, va_vaflags = 0, 
   va_spare = -1054263736}
         mode = 128
         fmode = 2
         error = 0
         vfslocked = 0
 #9  0xc0575c57 in vn_open (ndp=0x0, flagp=0x0, cmode=0, fdidx=0)
     at /home/src/sys/kern/vfs_vnops.c:91
         td = (struct thread *) 0x0
 #10 0xc056e029 in kern_open (td=0xc1296300, path=0x0, pathseg=UIO_USERSPACE, 
     flags=2, mode=438) at /home/src/sys/kern/vfs_syscalls.c:1007
         p = (struct proc *) 0x0
         fdp = (struct filedesc *) 0xc1712900
         fp = (struct file *) 0xc1814000
         vp = (struct vnode *) 0x1
         vat = {va_type = 3228436892, va_mode = 1, va_nlink = 0, 
   va_uid = 3228081852, va_gid = 318, va_fsid = 118134284, va_fileid = 0, 
   va_size = 13944276585772947192, va_blocksize = 3, va_atime = {tv_sec = 0, 
     tv_nsec = 0}, va_mtime = {tv_sec = -1048312404, tv_nsec = 3}, va_ctime = {
     tv_sec = 0, tv_nsec = -1056270904}, va_birthtime = {tv_sec = -1048393940, 
     tv_nsec = 0}, va_gen = 0, va_flags = 149, va_rdev = 0, 
   va_bytes = 13862612747705294036, va_filerev = 13864923702024115656, 
 ---Type <return> to continue, or q <return> to quit---
   va_vaflags = 149, va_spare = -1054263632}
         mp = (struct mount *) 0x13e
         cmode = 0
         nfp = (struct file *) 0xc1814000
         type = 0
         indx = 4
         error = -976839420
         lf = {l_start = 1369027681980, l_len = 279172874240, l_pid = 1, 
   l_type = -18920, l_whence = -16280}
         nd = {ni_dirp = 0x804c030 <Address 0x804c030 out of bounds>, 
   ni_segflg = UIO_USERSPACE, ni_startdir = 0x0, ni_rootdir = 0xc1230aa0, 
   ni_topdir = 0x0, ni_vp = 0xc184a660, ni_dvp = 0xc1230dd0, ni_pathlen = 1, 
   ni_next = 0xc127a008 "", ni_loopcnt = 0, ni_cnd = {cn_nameiop = 0, 
     cn_flags = 69255236, cn_thread = 0xc1296300, cn_cred = 0xc1818a80, 
     cn_lkflags = 2, cn_pnbuf = 0xc127a000 "/dev/ad0", 
     cn_nameptr = 0xc127a005 "ad0", cn_namelen = 3, cn_consume = 0}}
         vfslocked = -1066530404
 #11 0xc056df27 in open (td=0x0, uap=0xc5c69d04)
     at /home/src/sys/kern/vfs_syscalls.c:971
         error = -1054252288
 #12 0xc06586d2 in syscall (frame=
       {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = 134529072, tf_esi = 0,
 tf_ebp =
 -1077942168, tf_isp = -976839324, tf_ebx = 512, tf_edx = 0, tf_ecx =
 134533120, tf_eax =
 5, tf_trapno = 12, tf_err = 2, tf_eip = 672363575, tf_cs = 51, t---Type
 <return> to
 continue, or q <return> to quit---
 f_eflags = 642, tf_esp = -1077942212, tf_ss = 59})
     at /home/src/sys/i386/i386/trap.c:983
         params = 0xbfbfe840 <Address 0xbfbfe840 out of bounds>
         callp = (struct sysent *) 0xc06b7b1c
         td = (struct thread *) 0xc1296300
         p = (struct proc *) 0xc1293648
         orig_tf_eflags = 642
         sticks = 0
         error = 0
         narg = 3
         args = {134529072, 1, 438, 134533120, 12, 0, 0, -1054263736}
         code = 5
 #13 0xc0648d0f in Xint0x80_syscall ()
     at /home/src/sys/i386/i386/exception.s:200
 No locals.
 #14 0x00000033 in ?? ()
 No symbol table info available.
 Previous frame inner to this frame (corrupt stack?)
 (kgdb) quit

From: Eugene Grosbein <eugen@kuzbass.ru>
To: bug-followup@freebsd.org
Cc:  
Subject: Re: kern/112707: 6.2-STABLE panic: spoiling cp->ace = 3
Date: Tue, 22 May 2007 19:00:37 +0800

 Hi!
 
 The effect occures with GENERIC kernel.
 And the same for 'true > /dev/ad0' instead of 'boot0cfg -s 2 ad0'.
 NB: root partition is mounted from /dev/ad0s1a.
 
 Eugene Grosbein

From: Eugene Grosbein <eugen@kuzbass.ru>
To: bug-followup@freebsd.org
Cc:  
Subject: Re: kern/112707: 6.2-STABLE panic: spoiling cp->ace = 3
Date: Wed, 23 May 2007 13:31:54 +0800

 Hi!
 
 Having "kern.geom.debugflags=255" I did ": > /dev/ad0" and obtained
 this log for GENERIC:
 
 g_dev_open(ad0, 1026, 8192, 0xc23aec00)
 g_access(0xc22f4680(ad0), 0, 1, 0)
 open delta:[r0w1e0] old:[r0w0e0] provider:[r1w0e3] 0xc2170d80(ad0)
 g_disk_access(ad0, 0, 1, 0)
 g_post_event_x(0xc06a3adf, 0xc2170d80, 2, 0)
 ref 0xc2170d80
 g_slice_spoiled(0xc22f4640/ad0)
 g_wither_geom(0xc218e000(ad0))
 g_orphan_provider(0xc237ce00(ad0s4), 6)
 g_orphan_provider(0xc237d000(ad0s3), 6)
 g_orphan_provider(0xc233a600(ad0s2), 6)
 g_orphan_provider(0xc218e100(ad0s1), 6)
 g_orphan_register(ad0s4)
 g_dev_orphan(0xc237ebc0(ad0s4))
 g_detach(0xc237ebc0)
 g_destroy_consumer(0xc237ebc0)
 g_destroy_geom(0xc237c080(ad0s4))
 g_orphan_register(ad0s3)
 g_dev_orphan(0xc237ecc0(ad0s3))
 g_detach(0xc237ecc0)
 g_destroy_consumer(0xc237ecc0)
 g_destroy_geom(0xc237c300(ad0s3))
 g_orphan_register(ad0s2)
 g_slice_orphan(0xc22d8bc0/ad0s2)
 g_wither_geom(0xc237c600(ad0s2))
 g_orphan_provider(0xc237c480(ad0s2c), 6)
 g_orphan_provider(0xc237c580(ad0s2a), 6)
 g_dev_orphan(0xc22d8b40(ad0s2))
 g_detach(0xc22d8b40)
 g_destroy_consumer(0xc22d8b40)
 g_destroy_geom(0xc237c780(ad0s2))
 g_orphan_register(ad0s1)
 g_slice_orphan(0xc22f4b40/ad0s1)
 g_wither_geom(0xc237ca80(ad0s1))
 g_orphan_provider(0xc237c900(ad0s1c), 6)
 g_orphan_provider(0xc237ca00(ad0s1a), 6)
 g_dev_orphan(0xc22f4780(ad0s1))
 g_detach(0xc22f4780)
 g_destroy_consumer(0xc22f4780)
 g_destroy_geom(0xc237cc00(ad0s1))
 g_orphan_register(ad0s2c)
 g_dev_orphan(0xc237e7c0(ad0s2c))
 g_detach(0xc237e7c0)
 g_destroy_consumer(0xc237e7c0)
 g_destroy_geom(0xc2170780(ad0s2c))
 g_orphan_register(ad0s2a)
 g_dev_orphan(0xc237e8c0(ad0s2a))
 g_detach(0xc237e8c0)
 g_destroy_consumer(0xc237e8c0)
 g_destroy_geom(0xc233de80(ad0s2a))
 g_orphan_register(ad0s1c)
 g_dev_orphan(0xc237e9c0(ad0s1c))
 g_detach(0xc237e9c0)
 g_destroy_consumer(0xc237e9c0)
 g_destroy_geom(0xc233da80(ad0s1c))
 g_orphan_register(ad0s1a)
 g_dev_orphan(0xc237eac0(ad0s1a))
 g_detach(0xc237eac0)
 g_destroy_consumer(0xc237eac0)
 g_destroy_geom(0xc233dd00(ad0s1a))
 g_detach(0xc22f4b40)
 g_destroy_consumer(0xc22f4b40)
 g_destroy_geom(0xc237ca80(ad0s1))
 g_dev_close(ad0, 2, 8192, 0xc23aec00)
 g_access(0xc22f4680(ad0), 0, -1, 0)
 open delta:[r0w-1e0] old:[r0w1e0] provider:[r1w1e3] 0xc2170d80(ad0)
 g_disk_access(ad0, 0, -1, 0)
 g_post_event_x(0xc06a32ef, 0xc2170d80, 2, 0)
 ref 0xc2170d80
 g_mbrext_taste(MBREXT,ad0)
 bsd_taste(BSD,ad0)
 g_access(0xc2688380(ad0), 1, 0, 0)
 open delta:[r1w0e0] old:[r0w0e0] provider:[r1w0e3] 0xc2170d80(ad0)
 g_disk_access(ad0, 1, 0, 0)
 bio_getattr(MBR::type)
 bio_request(0xc252ec60) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 8
 g_io_deliver(0xc252ec60) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 8 error
 -3 off 0 len
 4
 bio_getattr(PC98::type)
 bio_request(0xc25317bc) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 8
 g_io_deliver(0xc25317bc) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 8 error
 -3 off 0 len
 4
 bio_request(0xc2531d68) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 1
 g_io_deliver(0xc2531d68) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 1 error 0
 off 512
 len 512
 bio_request(0xc2532108) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 1
 g_io_deliver(0xc2532108) from 0xc2688380(ad0) to 0xc2170d80(ad0) cmd 1 error 0
 off 0 len
 512
 g_access(0xc2688380(ad0), -1, 0, 0)
 open delta:[r-1w0e0] old:[r1w0e0] provider:[r2w0e3] 0xc2170d80(ad0)
 g_disk_access(ad0, -1, 0, 0)
 g_slice_spoiled(0xc2688380/ad0)
 g_wither_geom(0xc27ef600(ad0))
 g_gpt_taste(GPT,ad0)
 g_access(0xc22f4b40(ad0), 1, 0, 0)
 open delta:[r1w0e0] old:[r0w0e0] provider:[r1w0e3] 0xc2170d80(ad0)
 g_disk_access(ad0, 1, 0, 0)
 bio_request(0xc252ec60) from 0xc22f4b40(ad0) to 0xc2170d80(ad0) cmd 1
 g_io_deliver(0xc252ec60) from 0xc22f4b40(ad0) to 0xc2170d80(ad0) cmd 1 error 0
 off 0 len
 1024
 g_access(0xc22f4b40(ad0), -1, 0, 0)
 open delta:[r-1w0e0] old:[r1w0e0] provider:[r2w0e3] 0xc2170d80(ad0)
 g_disk_access(ad0, -1, 0, 0)
 g_slice_spoiled(0xc22f4b40/ad0)
 g_wither_geom(0xc28cab80(ad0))
 g_detach(0xc2688380)
 g_destroy_consumer(0xc2688380)
 g_destroy_geom(0xc27ef600(ad0))
 
 After that all access to flash drive fails.
 Hope this'll help someone who'd be interesting in fixig the bug.
 
 Eugene Grosbein
State-Changed-From-To: open->feedback 
State-Changed-By: jh 
State-Changed-When: Sun Dec 12 09:49:27 UTC 2010 
State-Changed-Why:  
Can you still reproduce this on a supported release? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=112707 
State-Changed-From-To: feedback->patched 
State-Changed-By: jh 
State-Changed-When: Sun Dec 12 13:37:18 UTC 2010 
State-Changed-Why:  
Fixed in head and stable/8 according to submitter. 

http://docs.freebsd.org/cgi/mid.cgi?4D04B7A7.3010401 


http://www.freebsd.org/cgi/query-pr.cgi?pr=112707 
State-Changed-From-To: patched->closed 
State-Changed-By: remko 
State-Changed-When: Wed Oct 12 15:06:10 UTC 2011 
State-Changed-Why:  
Seems that since this is not yet closed it's not interesting enough to 
MFC, or had been MFC'ed in between and not noted.. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=112707 
>Unformatted:
