From owner-freebsd-current@FreeBSD.ORG Wed May 14 16:24:34 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3063237B401 for ; Wed, 14 May 2003 16:24:34 -0700 (PDT) Received: from thalia.otenet.gr (thalia.otenet.gr [195.170.0.8]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2E5C643F3F for ; Wed, 14 May 2003 16:24:33 -0700 (PDT) (envelope-from keramida@ceid.upatras.gr) Received: from gothmog.gr (patr530-a184.otenet.gr [212.205.215.184]) by thalia.otenet.gr (8.12.9/8.12.9) with ESMTP id h4ENOTg4009628 for ; Thu, 15 May 2003 02:24:30 +0300 (EEST) Received: from gothmog.gr (gothmog [127.0.0.1]) by gothmog.gr (8.12.9/8.12.9) with ESMTP id h4ENOS2s001074 for ; Thu, 15 May 2003 02:24:28 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from giorgos@localhost) by gothmog.gr (8.12.9/8.12.9/Submit) id h4ENOSZl001073 for current@freebsd.org; Thu, 15 May 2003 02:24:28 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Date: Thu, 15 May 2003 02:24:28 +0300 From: Giorgos Keramidas To: current@freebsd.org Message-ID: <20030514232428.GA731@gothmog.gr> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: Panic with swap-backed md devices X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 May 2003 23:24:34 -0000 Trying to create and destroy a swap-backed md device results in panics with today's CURRENT. I was trying to make a new -t swap md disk to test the problem described in a PR. Using the following small shell script I noticed that it always causes a panic when mdconfig -d is run: mdconfig -a -t swap -s 100m -u 10 disklabel -r -w md10 auto newfs -O 1 -b 8192 -s 1024 md10 mount /dev/md10 /mnt mount umount /mnt mount mdconfig -d -u 10 The backtrace, in case anyone can understand from it why the kernel panics is: # gdb -k /usr/obj/usr/src/sys/CELERON/kernel.debug vmcore.10 GNU gdb 5.2.1 (FreeBSD) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-undermydesk-freebsd"... panic: from debugger panic messages: --- panic: mutex vm object not owned at /usr/src/sys/vm/vm_pager.c:267 Stack backtrace: panic: from debugger Uptime: 58m16s Dumping 511 MB ata0: resetting devices .. done 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 304 320 336 352 368 384 400 416 432 448 464 480 496 --- Reading symbols from /usr/obj/usr/src/sys/CELERON/modules/usr/src/sys/modules/acpi/acpi.ko.debug...done. Loaded symbols for /usr/obj/usr/src/sys/CELERON/modules/usr/src/sys/modules/acpi/acpi.ko.debug Reading symbols from /boot/kernel/star_saver.ko...done. Loaded symbols for /boot/kernel/star_saver.ko #0 doadump () at /usr/src/sys/kern/kern_shutdown.c:238 238 dumping++; (kgdb) bt/x A syntax error in expression, near `x'. (kgdb) bt #0 doadump () at /usr/src/sys/kern/kern_shutdown.c:238 #1 0xc01da79d in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:370 #2 0xc01daa2f in panic () at /usr/src/sys/kern/kern_shutdown.c:543 #3 0xc0138669 in db_panic () at /usr/src/sys/ddb/db_command.c:448 #4 0xc013860c in db_command (last_cmdp=0xc03263c0, cmd_table=0x0, aux_cmd_tablep=0xc0322028, aux_cmd_tablep_end=0xc032202c) at /usr/src/sys/ddb/db_command.c:346 #5 0xc01386d7 in db_command_loop () at /usr/src/sys/ddb/db_command.c:470 #6 0xc013ac3a in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_trap.c:72 #7 0xc02c8224 in kdb_trap (type=3, code=0, regs=0xdce06a5c) at /usr/src/sys/i386/i386/db_interface.c:170 #8 0xc02d721c in trap (frame= {tf_fs = -1070858216, tf_es = 16, tf_ds = 16, tf_edi = 256, tf_esi = -1003533952, tf_ebp = -589272416, tf_isp = -589272440, tf_ebx = 0, tf_edx = 0, tf_ecx = -1070041760, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1070824307, tf_cs = 8, tf_eflags = 646, tf_esp = -1070554621, tf_ss = -589272388}) at /usr/src/sys/i386/i386/trap.c:593 #9 0xc02c9748 in calltrap () at {standard input}:96 #10 0xc01da9e7 in panic (fmt=0x0) at /usr/src/sys/kern/kern_shutdown.c:527 #11 0xc01d3aac in _mtx_assert (m=0xc43bc000, what=0, file=0xc03195a2 "/usr/src/sys/vm/vm_pager.c", line=267) at /usr/src/sys/kern/kern_mutex.c:840 #12 0xc02a8b8d in vm_pager_deallocate (object=0xc43bc000) at /usr/src/sys/vm/vm_pager.c:267 #13 0xc015440b in mddestroy (sc=0xc4448700, td=0xc42f4980) at /usr/src/sys/dev/md/md.c:935 #14 0xc01545d7 in mddetach (unit=10, td=0xc42f4980) at /usr/src/sys/dev/md/md.c:1025 #15 0xc01546cc in mdctlioctl (dev=0xc037c420, cmd=3249564929, addr=0xc5e5ca00 "", flags=3, td=0xc42f4980) at /usr/src/sys/dev/md/md.c:1072 #16 0xc01ae3d2 in spec_ioctl (ap=0xdce06b88) at /usr/src/sys/fs/specfs/spec_vnops.c:347 #17 0xc01add67 in spec_vnoperate (ap=0x0) at /usr/src/sys/fs/specfs/spec_vnops.c:123 #18 0xc0228047 in vn_ioctl (fp=0xc41e1dd4, com=3249564929, data=0xc5e5ca00, active_cred=0xc1511280, td=0xc42f4980) at vnode_if.h:488 #19 0xc01f68ac in ioctl (td=0xc42f4980, uap=0xdce06d14) at file.h:251 #20 0xc02d797d in syscall (frame= {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 134561322, tf_esi = -1077936632, tf_ebp = -1077936888, tf_isp = -589271692, tf_ebx = 3, tf_edx = 0, tf_ecx = 0, tf_eax = 54, tf_trapno = 12, tf_err = 2, tf_eip = 134516183, tf_cs = 31, tf_eflags = 658, tf_esp = -1077936932, tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1021 #21 0xc02c979d in Xint0x80_syscall () at {standard input}:138 ---Can't read userspace from dump, or kernel process--- (kgdb) up 12 #12 0xc02a8b8d in vm_pager_deallocate (object=0xc43bc000) at /usr/src/sys/vm/vm_pager.c:267 267 VM_OBJECT_LOCK_ASSERT(object, MA_OWNED); (kgdb) list 262 void 263 vm_pager_deallocate(object) 264 vm_object_t object; 265 { 266 267 VM_OBJECT_LOCK_ASSERT(object, MA_OWNED); 268 (*pagertab[object->type]->pgo_dealloc) (object); 269 } 270 271 /* (kgdb) up #13 0xc015440b in mddestroy (sc=0xc4448700, td=0xc42f4980) at /usr/src/sys/dev/md/md.c:935 935 vm_pager_deallocate(sc->object); (kgdb) list 930 (void)vn_close(sc->vnode, sc->flags & MD_READONLY ? 931 FREAD : (FREAD|FWRITE), sc->cred, td); 932 if (sc->cred != NULL) 933 crfree(sc->cred); 934 if (sc->object != NULL) { 935 vm_pager_deallocate(sc->object); 936 } 937 if (sc->indir) 938 destroy_indir(sc, sc->indir); 939 if (sc->uma) (kgdb) quit