>Number:         8823
>Category:       kern
>Synopsis:       panic: pool_get(lfsinopl): free list modified
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Nov 18 13:27:00 1999
>Last-Modified:
>Originator:     Manuel Bouyer
>Organization:

	none
>Release:        -current cvs updated about 4 hours ago (from cvs.netbsd.org)
>Environment:

System: NetBSD rochebonne.antioche.eu.org 1.4O NetBSD 1.4O (ROCHEBONNE) #0: Thu Nov 18 21:12:16 MET 1999 root@rochebonne.antioche.eu.org:/usr/src/1.4M/src/sys/arch/i386/compile/ROCHEBONNE i386

>Description:
	I have a 3G LFS on my home machine (a 8GB IDE disk) which worked 
	smoothly for some time. Now I can very reliablty get a panic
	"panic: pool_get(lfsinopl): free list modified: magic=0; page 0xfe0bf000; item addr 0xfe0bf350"
	(adrresses may change, I've also seen magic=0xdead0000) by unlinking
	a file on the FS (like rm -rf, or tar xvf over an existing tree).
	gdb says:
#9  0xf0100cc5 in calltrap ()
#10 0xf013c6e1 in panic (
    fmt=0xf023c5e0 "pool_get(%s): free list modified: magic=%x; page %p; item addr %p\n") at ../../../../kern/subr_prf.c:215
#11 0xf013b708 in _pool_get (pp=0xf02973e0, flags=2, 
---Type <return> to continue, or q <return> to quit---
    file=0xf0243d80 "../../../../ufs/lfs/lfs_alloc.c", line=264)
    at ../../../../kern/subr_pool.c:745
#12 0xf01d36a5 in lfs_vcreate (mp=0xf04a9400, ino=42032, vpp=0xfe0add34)
    at ../../../../ufs/lfs/lfs_alloc.c:264
#13 0xf01da6f5 in lfs_vget (mp=0xf04a9400, ino=42032, vpp=0xfe0addcc)
    at ../../../../ufs/lfs/lfs_vfsops.c:681
#14 0xf01dd8fa in ufs_lookup (v=0xfe0ade3c)
    at ../../../../ufs/ufs/ufs_lookup.c:494
#15 0xf01535bf in lookup (ndp=0xfe0adef0) at ../../../../sys/vnode_if.h:71
#16 0xf01532b3 in namei (ndp=0xfe0adef0) at ../../../../kern/vfs_lookup.c:153
#17 0xf01587e1 in sys_unlink (p=0xfe096788, v=0xfe0adf88, retval=0xfe0adf80)
    at ../../../../kern/vfs_syscalls.c:1560
#18 0xf01fa866 in syscall (frame={tf_es = -65505, tf_ds = -272695265, 
      tf_edi = 0, tf_esi = 134713344, tf_ebp = -272639672, tf_ebx = 134738944, 
      tf_edx = 134736128, tf_ecx = 0, tf_eax = 10, tf_trapno = 3, tf_err = 2, 
      tf_eip = 134606939, tf_cs = 23, tf_eflags = 582, tf_esp = -272639692, 
      tf_ss = 31, tf_vm86_es = 0, tf_vm86_ds = 0, tf_vm86_fs = 0, 
      tf_vm86_gs = 0}) at ../../../../arch/i386/i386/trap.c:760
#19 0xf0100d7d in syscall1 ()
can not access 0xefbfd948, invalid translation (invalid PDE)
can not access 0xefbfd948, invalid translation (invalid PDE)
Cannot access memory at address 0xefbfd948.

	(this was a rm -rf process).
	This LFS also exibit strange behavior, such as:
rochebonne# mount -t lfs /dev/wd0f /mnt
rochebonne# cd /mnt/
rochebonne# ls
1.4M       ifile      lost+found pkgsrc     tmp
rochebonne# cd tmp/distfiles/
rochebonne# ls
bison-1.28.tar.gz                       ssh-1.2.27.tar.gz
cku192src.tar.gz                        teTeX
cvs-1.10.tar.gz                         w3c-libwww-5.2.8.tar.gz
dialog-0.6z.tar.gz                      xa1.0_cyuv_linuxELF.o.Z
gettext-0.10.35.tar.gz                  xa2.0_cvid_linuxELF.o.Z
lynx2-8-2.tar.gz                        xa2.0_iv32_linuxELF.o.Z
mpeg_play-2.4-patched-src.tar.gz        xanim2801.tar.gz
slang-1.3.9.tar.gz                      xisp-2.5p4.tar.gz
ssh-1.2.27-IPv6-1.5-patch.gz            xisp-2.6p1.tar.gz
ssh-1.2.27-afs-kerberos.patch-1         xli.1.16.tar.gz
rochebonne# touch toto
touch: toto: No such file or directory

	Here is the output of 'fsck_lfs -n /dev/rwd0f':
** /dev/rwd0f (NO WRITE)
** Last Mounted on /usr/src
** Phase 0 - Check Segment Summaries
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
UNREF FILE I=37397  OWNER=root MODE=100644
SIZE=0 MTIME=Nov 14 20:14 1999 
CLEAR? no

UNREF FILE I=50838  OWNER=root MODE=100755
SIZE=11375 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=50839  OWNER=root MODE=100755
SIZE=248668 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=50840  OWNER=root MODE=100755
SIZE=35862 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=50842  OWNER=root MODE=100755
SIZE=15242 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=50843  OWNER=root MODE=100755
SIZE=597434 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=50924  OWNER=root MODE=100755
SIZE=562435 MTIME=Nov 14 16:21 1999 
CLEAR? no

UNREF FILE I=50960  OWNER=root MODE=100755
SIZE=597434 MTIME=Nov 14 13:49 1999 
CLEAR? no

UNREF FILE I=50961  OWNER=root MODE=100755
SIZE=15299 MTIME=Nov 14 13:49 1999 
CLEAR? no

UNREF FILE I=50963  OWNER=root MODE=100755
SIZE=35862 MTIME=Nov 14 13:49 1999 
CLEAR? no

UNREF FILE I=50964  OWNER=root MODE=100755
SIZE=248668 MTIME=Nov 14 13:49 1999 
CLEAR? no

UNREF FILE I=50965  OWNER=root MODE=100755
SIZE=11375 MTIME=Nov 14 13:49 1999 
CLEAR? no

UNREF FILE I=50966  OWNER=root MODE=100755
SIZE=13705 MTIME=Nov 14 16:21 1999 
CLEAR? no

UNREF FILE I=50967  OWNER=root MODE=100644
SIZE=18498 MTIME=Nov 14 13:50 1999 
CLEAR? no

UNREF FILE I=50968  OWNER=root MODE=100644
SIZE=3294 MTIME=Nov 14 13:50 1999 
CLEAR? no

UNREF FILE I=50969  OWNER=root MODE=100644
SIZE=3416 MTIME=Nov 14 13:50 1999 
CLEAR? no

UNREF FILE I=50970  OWNER=root MODE=100644
SIZE=952 MTIME=Nov 14 13:50 1999 
CLEAR? no

UNREF FILE I=50971  OWNER=root MODE=100644
SIZE=341 MTIME=Nov 14 13:50 1999 
CLEAR? no

UNREF FILE I=50973  OWNER=root MODE=100755
SIZE=32224 MTIME=Nov 14 16:21 1999 
CLEAR? no

UNREF FILE I=50974  OWNER=root MODE=100755
SIZE=248668 MTIME=Nov 14 16:21 1999 
CLEAR? no

UNREF FILE I=53311  OWNER=root MODE=100600
SIZE=4096 MTIME=Nov 14 14:11 1999 
CLEAR? no

UNREF FILE I=53326  OWNER=root MODE=100644
SIZE=8076 MTIME=Nov 14 14:12 1999 
CLEAR? no

UNREF FILE I=58216  OWNER=root MODE=100644
SIZE=18498 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=58217  OWNER=root MODE=100644
SIZE=3294 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=58218  OWNER=root MODE=100644
SIZE=3416 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=58219  OWNER=root MODE=100644
SIZE=952 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=58220  OWNER=root MODE=100644
SIZE=341 MTIME=Nov 14 15:57 1999 
CLEAR? no

UNREF FILE I=58226  OWNER=root MODE=100755
SIZE=11375 MTIME=Nov 14 16:21 1999 
CLEAR? no

UNREF FILE I=58228  OWNER=root MODE=100644
SIZE=16175 MTIME=Nov 14 16:22 1999 
CLEAR? no

UNREF FILE I=58229  OWNER=root MODE=100644
SIZE=3289 MTIME=Nov 14 16:22 1999 
CLEAR? no

UNREF FILE I=58230  OWNER=root MODE=100644
SIZE=3411 MTIME=Nov 14 16:22 1999 
CLEAR? no

UNREF FILE I=58231  OWNER=root MODE=100644
SIZE=950 MTIME=Nov 14 16:22 1999 
CLEAR? no

UNREF FILE I=58232  OWNER=root MODE=100644
SIZE=341 MTIME=Nov 14 16:22 1999 
CLEAR? no

UNREF FILE I=61298  OWNER=root MODE=100600
SIZE=4096 MTIME=Nov 14 18:43 1999 
CLEAR? no

UNREF FILE I=61676  OWNER=root MODE=100600
SIZE=4096 MTIME=Nov 14 20:01 1999 
CLEAR? no

UNREF FILE I=61883  OWNER=root MODE=100600
SIZE=4096 MTIME=Nov 14 20:03 1999 
CLEAR? no

100798 files, 914009 used, 0 free 

	dumplfs /dev/rwd0e says:
Master Superblock at 0x1:
magic    0x0	version  0x0	size     16	ssize    24
dsize    32		bsize    176	fsize    32	frag     -16
minfree  10		inopb    1	ifpb     2048	nindir   9
nseg     2048		nspf     64	cleansz  2	segtabsz 1
segmask  0x3F	segshift 1	bmask    0x800000000B0	bshift   0
ffmask   0x1000000800		ffshift  0	fbmask   0x3F00000003F	fbshift  0
sushift  16	fsbtodb  1587	cksum    0x0	maxfilesize  0x80000000008
Superblock disk addresses:	 0x1F80 0x143C 0x7CE2 0xEC2E 0x4E4 0x2000200
				 0x7273752F 0x0 0x0 0x0
Checkpoint Info
free     942960182	idaddr   0x400	ifile    8
bfree    799848	avail    100	uinodes  8192
nfiles   783830	lastseg  0x2	nextseg  0x0
curseg   0x3C	offset   0xFFFFE000	tstamp   Thu Jan  1 01:00:13 1970
dumplfs: /dev/rwd0e: Invalid argument

>How-To-Repeat:
	see above.
>Fix:
	please :)
>Audit-Trail:
>Unformatted: