KDL when ejecting not mounted CD

[anevilyak]

I seem to be able to quite reliably panic Haiku by ejecting an iso9660 CD. Panic message:

PANIC: vm_page_fault: unhandled page fault in kernel space at 0xdeadbf1f, ip 0x80078d2e

Backtrace:

stack trace for thread 29 "media checker"
    kernel stack: 0x806a3000 to 0x806a7000
frame               caller     <image>:function + offset
 0 806a68f4 (+  48) 80065bcd   <kernel_x86>:invoke_debugger_command + 0x00f5
 1 806a6924 (+  64) 800659bd   <kernel_x86> invoke_pipe_segment(debugger_command_pipe*: 0x80137b20, int32: 0, 0x0 "<NULL>") + 0x0079
 2 806a6964 (+  64) 80065d44   <kernel_x86>:invoke_debugger_command_pipe + 0x009c
 3 806a69a4 (+  48) 800672f4   <kernel_x86> ExpressionParser<0x806a6a58>::_ParseCommandPipe(0x806a6a54) + 0x0234
 4 806a69d4 (+  64) 8006672e   <kernel_x86> ExpressionParser<0x806a6a58>::EvaluateCommand(0x80128200 "bt", 0x806a6a54) + 0x02ba
 5 806a6a14 (+ 224) 8006871c   <kernel_x86>:evaluate_debug_command + 0x0088
 6 806a6af4 (+  64) 80063a82   <kernel_x86> kernel_debugger_loop() + 0x01ae
 7 806a6b34 (+  32) 8006494d   <kernel_x86>:kernel_debugger + 0x004d
 8 806a6b54 (+ 192) 800648f5   <kernel_x86>:panic + 0x0029
 9 806a6c14 (+  64) 800ca366   <kernel_x86>:vm_page_fault + 0x013a
10 806a6c54 (+  64) 800da571   <kernel_x86>:page_fault_exception + 0x00d9
11 806a6c94 (+  12) 800ddc86   <kernel_x86>:int_bottom + 0x0036
kernel iframe at 0x806a6ca0 (end = 0x806a6cf0)
 eax 0xdeadbeef     ebx 0x811b33f8      ecx 0x811a167c   edx 0x811a36d8
 esi 0xf            edi 0xf             ebp 0x806a6e28   esp 0x806a6cd4
 eip 0x80078d2e  eflags 0x210287
 vector: 0xe, error code: 0x0
12 806a6ca0 (+ 392) 80078d2e   <kernel_x86> devfs_ioctl(fs_volume*: 0x811ad730, fs_vnode*: 0x811ae550, 0x811a36d0, uint32: 0xf (15), 0x811b33f8, uint32: 0x811a167c) + 0x0212
13 806a6e28 (+  64) 800a7ae4   <kernel_x86> common_ioctl(file_descriptor*: 0x811adde8, uint32: 0xf (15), 0x811b33f8, uint32: 0x811a167c) + 0x0038
14 806a6e68 (+  48) 8009579f   <kernel_x86> fd_ioctl(true, int32: 5, uint32: 0xf (15), 0x811b33f8, uint32: 0x811a167c) + 0x005f
15 806a6e98 (+  80) 80096f12   <kernel_x86>:_kern_ioctl + 0x0046
16 806a6ee8 (+  48) 800e98bc   <kernel_x86>:ioctl + 0x001c
17 806a6f18 (+  64) 8008a5d7   <kernel_x86> BPrivate::DiskDevice::KDiskDevice<0x811b3300>::GetMediaStatus(0x811b33f8) + 0x0023
18 806a6f58 (+  32) 8008a2a9   <kernel_x86> BPrivate::DiskDevice::KDiskDevice<0x811b3300>::UpdateMediaStatusIfNeeded(0x806a0001, 0x0) + 0x0025
19 806a6f78 (+  64) 8008d731   <kernel_x86> BPrivate::DiskDevice::KDiskDeviceManager<0x8119faf0>::_CheckMediaStatus(0x81998800, 0x8005967d, 0x801276b4, 0x0, int8: 0, 0x806a6ff8, int8: -9, 0x8119faf0, 0x0, 0x0, 0x0, int8: 0, 0x0, 0x0, int32: -2147117420) + 0x008d
20 806a6fb8 (+  32) 8008d8c2   <kernel_x86> BPrivate::DiskDevice::KDiskDeviceManager<0x8119faf0>::_CheckMediaStatusDaem(NULL) + 0x0012
21 806a6fd8 (+  32) 800596f7   <kernel_x86> _create_kernel_thread_kentry() + 0x001b
22 806a6ff8 (+2140508168) 80059694   <kernel_x86> thread_kthread_exit() + 0x0000

I'd assume this is relatively recent since I don't recall anything like this happening back when I was testing iso9660 bugs for Axel, but that was several hundred revisions ago. In any case, environment is hrev30933, gcc2 + gcc4 hybrid using the ata bus manager. Let me know what other information I can pull out here.

[anevilyak]

On second thought, it KDLs if the disc is mounted also. Updated description accordingly.