[issue1777] vn panic: Freeing already free credential! 0xdef403f8

[Samuel J. Greear (via DragonFly issue tracker)]

New submission from Samuel J. Greear <sjg at evilcode.net>:

#0  _get_mycpu (di=0xc06ee760) at ./machine/thread.h:83
#1  md_dumpsys (di=0xc06ee760) at /usr/src/sys/platform/pc32/i386/dump_machdep.c:263
#2  0xc0320609 in dumpsys () at /usr/src/sys/kern/kern_shutdown.c:838
#3  0xc0320bdb in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:387
#4  0xc032113e in panic (fmt=0xc062402c "Freeing already free credential! %p")
at /usr/src/sys/kern/kern_shutdown.c:744
#5  0xc0319313 in crfree (cr=0xdef403f8) at /usr/src/sys/kern/kern_prot.c:1066
#6  0xdf244e94 in vnsetcred (vn=0xdef400d0, cred=0xdf030e48) at
/usr/src-misc/sys/dev/disk/vn/vn.c:701
#7  0xdf245703 in vniocattach_file (ap=0xdf24ab2c) at
/usr/src-misc/sys/dev/disk/vn/vn.c:567
#8  vnioctl (ap=0xdf24ab2c) at /usr/src-misc/sys/dev/disk/vn/vn.c:455
#9  0xc03051ce in dev_dioctl (dev=0xdaa45c08, cmd=3222029824, data=0xdf24ac10
"\207\370\277\277", fflag=1,
    cred=0xdf030e48, msg=0x0) at /usr/src/sys/kern/kern_device.c:175
#10 0xc033d198 in diskioctl (ap=0xdf24ab84) at /usr/src/sys/kern/subr_disk.c:875
#11 0xc03051ce in dev_dioctl (dev=0xdaa45cd8, cmd=3222029824, data=0xdf24ac10
"\207\370\277\277", fflag=1,
    cred=0xdf030e48, msg=0xdf24acf0) at /usr/src/sys/kern/kern_device.c:175
#12 0xc04b6544 in devfs_specf_ioctl (fp=0xda5161b8, com=3222029824,
data=0xdf24ac10 "\207\370\277\277",
    ucred=0xdf030e48, msg=0xdf24acf0) at /usr/src/sys/vfs/devfs/devfs_vnops.c:1488
#13 0xc0346afe in fo_ioctl (fd=3, com=3222029824, uspc_data=0xbfbff69c <Address
0xbfbff69c out of bounds>, map=0x0,
    msg=0xdf24acf0) at /usr/src/sys/sys/file2.h:88
#14 mapped_ioctl (fd=3, com=3222029824, uspc_data=0xbfbff69c <Address 0xbfbff69c
out of bounds>, map=0x0,
    msg=0xdf24acf0) at /usr/src/sys/kern/sys_generic.c:705
#15 0xc0347051 in sys_ioctl (uap=0xdf24acf0) at /usr/src/sys/kern/sys_generic.c:527
#16 0xc0582322 in syscall2 (frame=0xdf24ad40) at
/usr/src/sys/platform/pc32/i386/trap.c:1319
#17 0xc056b176 in Xint0x80_syscall () at
/usr/src/sys/platform/pc32/i386/exception.s:876
#18 0x0000001f in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

This happens upon executing

vnconfig -c -s labels -S 2g -T vn0 /var/vkernel/rootimg.01

as per the vkernel manpage, /var/vkernel is a symlink to /home/var.vkernel and
the box is running HAMMER

ROOT on / (hammer, local)
devfs on /dev (devfs, local)
/dev/serno/9TE03QNJ.s3a on /boot (ufs, local)
/pfs/@@-1:00001 on /var (null, local)
/pfs/@@-1:00002 on /tmp (null, local)
/pfs/@@-1:00003 on /usr (null, local)
/pfs/@@-1:00004 on /home (null, local)
/pfs/@@-1:00005 on /usr/obj (null, local)
/pfs/@@-1:00006 on /var/crash (null, local)
/pfs/@@-1:00007 on /var/tmp (null, local)
procfs on /proc (procfs, local)

kern/vmcore are inbound to leaf

----------
messages: 8635
nosy: sjg
priority: urgent
status: unread
title: vn panic: Freeing already free credential! 0xdef403f8

_____________________________________________________
DragonFly issue tracker <bugs at lists.dragonflybsd.org>
<http://bugs.dragonflybsd.org/issue1777>
_____________________________________________________