From owner-freebsd-current@FreeBSD.ORG Tue Jun 25 13:12:53 2013 Return-Path: Delivered-To: freebsd-current@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id CC6376C8; Tue, 25 Jun 2013 13:12:53 +0000 (UTC) (envelope-from gavin@FreeBSD.org) Received: from mail-gw13.york.ac.uk (mail-gw13.york.ac.uk [144.32.129.163]) by mx1.freebsd.org (Postfix) with ESMTP id 983EB1A36; Tue, 25 Jun 2013 13:12:53 +0000 (UTC) Received: from buffy-128.york.ac.uk ([144.32.128.160]:52976 helo=buffy.york.ac.uk) by mail-gw13.york.ac.uk with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1UrT3E-00056s-HZ; Tue, 25 Jun 2013 14:12:52 +0100 Received: from [127.0.0.1] (localhost [127.0.0.1]) by buffy.york.ac.uk (8.14.6/8.14.6) with ESMTP id r5PDCqRD001067; Tue, 25 Jun 2013 14:12:52 +0100 (BST) (envelope-from gavin@FreeBSD.org) Subject: panic: vm_page_alloc: pindex already allocated From: Gavin Atkinson To: freebsd-current@FreeBSD.org Content-Type: text/plain; charset="ASCII" Date: Tue, 25 Jun 2013 14:12:51 +0100 Message-ID: <1372165971.96049.42.camel@buffy.york.ac.uk> Mime-Version: 1.0 X-Mailer: Evolution 2.32.1 FreeBSD GNOME Team Port Content-Transfer-Encoding: 7bit Cc: alc@FreeBSD.org X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2013 13:12:53 -0000 Hi, I've just managed to panic an amd64 host, running HEAD r252161 from June 24th. Filesystem is fully ZFS, no UFS or NFS is involved. The panic is fully reproducible, and is also reproduceable with r251861, so has not been introduced in the last week. The host machine runs several jails. Inside one of them Apache is used to serve a SVN repository though mod_svn. At the time of the panic, two machines were checking out the same (FreeBSD ports) tree over IPv4 https. Apache will have been writing significant amounts of data to to /var/log/httpd-access.log at the time. Within the jail, I ran "tail -f /var/log/httpd-access.log". The machine immediately paniced: panic: vm_page_alloc: pindex already allocated cpuid = 3 KDB: enter: panic [ thread pid 29345 tid 100408 ] Stopped at kdb_enter+0x3b: movq $0,0xabcab2(%rip) db> bt Tracing pid 29345 tid 100408 td 0xfffffe00cd564000 kdb_enter() at kdb_enter+0x3b/frame 0xffffff895d48e340 vpanic() at vpanic+0xe1/frame 0xffffff895d48e380 kassert_panic() at kassert_panic+0xd3/frame 0xffffff895d48e470 vm_page_alloc() at vm_page_alloc+0x4ce/frame 0xffffff895d48e4b0 zfs_freebsd_write() at zfs_freebsd_write+0x89c/frame 0xffffff895d48e6c0 VOP_WRITE_APV() at VOP_WRITE_APV+0x113/frame 0xffffff895d48e7d0 vn_write() at vn_write+0x281/frame 0xffffff895d48e860 vn_io_fault() at vn_io_fault+0x94/frame 0xffffff895d48e9f0 dofilewrite() at dofilewrite+0x85/frame 0xffffff895d48ea40 kern_writev() at kern_writev+0x6c/frame 0xffffff895d48ea80 sys_write() at sys_write+0x64/frame 0xffffff895d48ead0 amd64_syscall() at amd64_syscall+0x389/frame 0xffffff895d48ebf0 Xfast_syscall() at Xfast_syscall+0xf7/frame 0xffffff895d48ebf0 --- syscall (4, FreeBSD ELF64, sys_write), rip = 0x8020cd7aa, rsp = 0x7fffffffd798, rbp = 0x13 --- Reproducing the panic is easy. While the machine is being accessed (and so Apache is busy writing lots to /var/log/httpd-access.log), running the following as root will panic the machine, usually within 10 seconds: #!/bin/sh while [ 1 ] do tail /var/log/httpd-access.log > /dev/null done I have core files available. I've also put a dump of the implicated mpred and object structures at https://svnmir.bme.freebsd.org/core.1.gdb.txt (gdb output) https://svnmir.bme.freebsd.org/core.txt.1 (dumpinfo) Thanks, Gavin