kern/48211: Unclean shutdown with active snapshot causes panic during reboot

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         48211
>Category:       kern
>Synopsis:       Unclean shutdown with active snapshot causes panic during 
>reboot
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 14 19:05:00 +0000 2013
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2013.09.07.09.22.37
>Organization:
>Environment:
System: NetBSD i386
Architecture: i386
Machine: i386
>Description:

If NetBSD suffers an unclean shutdown while an fss snapshot is active
on the root file system, the kernel will panic during the reboot
immediately after the root fsck, with a message like "panic:
ffs_snapshot_mount: 472 already on list".

Example console output:

  Starting root file system check:
  /dev/rwd0a: INCORRECT BLOCK COUNT I=472 (2032 should be 2112) (CORRECTED)
  /dev/rwd0a: FREE BLK COUNT(S) WRONG IN SUPERBLK (SALVAGED)
  /dev/rwd0a: SUMMARY INFORMATION BAD (SALVAGED)
  /dev/rwd0a: BLK(S) MISSING IN BIT MAPS (SALVAGED)
  /dev/rwd0a: 16782 files, 380966 used, 326321 free (1033 frags, 40661 blocks, 
0.1% fragmentation)
  /dev/rwd0a: MARKING FILE SYSTEM CLEAN
  panic: ffs_snapshot_mount: 472 already on list
  fatal breakpoint trap in supervisor mode
  trap type 1 code 0 eip c027fb24 cs 8 eflags 246 cr2 bbae8d13 ilevel 0 esp 
c442cb50
  curlwp 0xc1397020 pid 25 lid 1 lowest kstack 0xc442a000
  Stopped in pid 25.1 (mount_ffs) at      netbsd:breakpoint+0x4:  popl    %ebp
  db{0}> t
  
breakpoint(c0cb608c,c0ed9840,c0c29e1c,c442cb6c,0,c1373800,c1265e20,c442cb60,c0814ac1,c0c29e1c)
 at netbsd:breakpoint+0x4
  vpanic(c0c29e1c,c442cb6c,c442cbcc,c0329409,c0c29e1c,1d8,0,b0,2de58000,0) at 
netbsd:vpanic+0x11c
  printf_nolog(c0c29e1c,1d8,0,b0,2de58000,0,1,490,c122cf00,0) at 
netbsd:printf_nolog
  
ffs_snapshot_mount(c1372000,0,27,c1372000,c135ebb0,6,0,c1373800,c1397020,c12f6208)
 at netbsd:ffs_snapshot_mount+0x46c
  
ffs_mount(c1372000,bfbfea20,c12082e8,c442ccd0,c0e07140,c442ccac,c093a698,c1372000,bfbfea20,c12082e8)
 at netbsd:ffs_mount+0x6ef
  
VFS_MOUNT(c1372000,bfbfea20,c12082e8,c442ccd0,10000,c12082e8,c442cc54,0,c1372000,c442cd28)
 at netbsd:VFS_MOUNT+0x34
  
do_sys_mount(c1397020,0,8048ec8,bfbfea20,10000,bfbfee24,0,4,c442cd28,c442cd3c) 
at netbsd:do_sys_mount+0x343
  
sys___mount50(c1397020,c442cd00,c442cd28,c1355848,0,c442cd00,19a,c442cda0,8048ec8,bfbfea20)
 at netbsd:sys___mount50+0x4d
  syscall() at netbsd:syscall+0x89
  --- syscall (number 410) ---
  bbacf397:
  db{0}> 

>How-To-Repeat:

This is easy to reproduce.  For example:

  # fssconfig fss0 / /snapshot
  # dd if=/dev/urandom of=/scratch.tmp count=10000
  [enter ddb]
  db{0}> reboot

>Fix: