From owner-freebsd-current@FreeBSD.ORG Wed Mar 5 12:44:30 2014 Return-Path: Delivered-To: freebsd-current@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id C4368AA4 for ; Wed, 5 Mar 2014 12:44:30 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id A1EAA36B for ; Wed, 5 Mar 2014 12:44:30 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s25CiUM0092282 for ; Wed, 5 Mar 2014 12:44:30 GMT (envelope-from bdrewery@freefall.freebsd.org) Received: (from bdrewery@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s25CiU6f092277 for freebsd-current@FreeBSD.org; Wed, 5 Mar 2014 12:44:30 GMT (envelope-from bdrewery) Received: (qmail 21879 invoked from network); 5 Mar 2014 06:44:26 -0600 Received: from unknown (HELO ?10.10.0.24?) (freebsd@shatow.net@10.10.0.24) by sweb.xzibition.com with ESMTPA; 5 Mar 2014 06:44:26 -0600 Message-ID: <53171C23.8090901@FreeBSD.org> Date: Wed, 05 Mar 2014 06:44:19 -0600 From: Bryan Drewery Organization: FreeBSD User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Konstantin Belousov , Andriy Gapon Subject: Re: panic: lockmgr still held [tmpfs] [vm_map_remove()->vdropl()] (r262186: Thu Feb 20) References: <53109ACB.20102@FreeBSD.org> <201403031306.59405.jhb@freebsd.org> <53153F43.6010506@FreeBSD.org> <201403041145.48425.jhb@freebsd.org> <5316F144.1000105@FreeBSD.org> <20140305110723.GB24664@kib.kiev.ua> In-Reply-To: <20140305110723.GB24664@kib.kiev.ua> X-Enigmail-Version: 1.6 OpenPGP: id=6E4697CF; url=http://www.shatow.net/bryan/bryan2.asc Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="cNGx0R6DtBHthOCsGOHD2UpIvBW2PtIsn" Cc: Alan Cox , freebsd-current@FreeBSD.org X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Mar 2014 12:44:30 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --cNGx0R6DtBHthOCsGOHD2UpIvBW2PtIsn Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 3/5/2014 5:07 AM, Konstantin Belousov wrote: > On Wed, Mar 05, 2014 at 11:41:24AM +0200, Andriy Gapon wrote: >> on 04/03/2014 18:45 John Baldwin said the following: >>> So I'm not sure how to fix this. The crash is in this code in=20 >>> vm_object_deallocate(): >>> >>> if (object->type =3D=3D OBJT_SWAP && >>> (object->flags & OBJ_TMPFS) !=3D 0) { >>> vp =3D object->un_pager.swp.swp_tmpfs; >>> vhold(vp); >>> VM_OBJECT_WUNLOCK(object); >>> vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); >>> vdrop(vp); >>> VM_OBJECT_WLOCK(object); >>> if (object->type =3D=3D OBJT_DEAD || >>> object->ref_count !=3D 1) { >>> VM_OBJECT_WUNLOCK(object); >>> VOP_UNLOCK(vp, 0); >>> return; >>> } >>> if ((object->flags & OBJ_TMPFS) !=3D 0) >>> VOP_UNSET_TEXT(vp); >>> VOP_UNLOCK(vp, 0); >>> } >>> >>> The vdrop() is dropping the count to zero and trying to free the vnod= e. The=20 >>> real problem I think is that swp_tmpfs doesn't have an implicit vhold= () on the=20 >>> vnode, so in this case, the code is doing a vhold/vn_lock/vdrop of an= already- >>> free vnode. For OBJT_VNODE objects, the reference from the object ba= ck to the=20 >>> vnode holds a vref() that gets released by a vput() in=20 >>> vm_object_vndeallocate(). >>> >>> One fix might be to chagne smp_tmpfs to hold a vhold reference. This= is=20 >>> untested but might work (but I'm also not sure that this is the right= thing in=20 >>> that I don't know what other effects it might have). >> >> I agree with your analysis, but I don't think that a filesystem holdin= g its own >> vnode is a good idea. If I am not mistaken, that would prevent tmpfs = vnodes >> from going to free list. >> I'd rather try to modify vm_object_deallocate() code. E.g. vdrop() co= uld be >> called after VOP_UNLOCK(). Alternatively, the code could handle a doo= med vnode >> in a different way. >=20 > I agree with Andrey, it is just a bug to vdrop() before unlock. > Please try this. >=20 > diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c > index 8683e2f..787b18b 100644 > --- a/sys/vm/vm_object.c > +++ b/sys/vm/vm_object.c > @@ -536,17 +536,18 @@ vm_object_deallocate(vm_object_t object) > vhold(vp); > VM_OBJECT_WUNLOCK(object); > vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); > - vdrop(vp); > VM_OBJECT_WLOCK(object); > if (object->type =3D=3D OBJT_DEAD || > object->ref_count !=3D 1) { > VM_OBJECT_WUNLOCK(object); > VOP_UNLOCK(vp, 0); > + vdrop(vp); > return; > } > if ((object->flags & OBJ_TMPFS) !=3D 0) > VOP_UNSET_TEXT(vp); > VOP_UNLOCK(vp, 0); > + vdrop(vp); > } > if (object->shadow_count =3D=3D 0 && > object->handle =3D=3D NULL && >=20 Ok I will try this. Note that I cannot easily reproduce the issue. So if this seems to be right logically I suggest just committing after stress testing. I'll report back after a few builds to let you know if it makes it any worse. Thanks all. --=20 Regards, Bryan Drewery --cNGx0R6DtBHthOCsGOHD2UpIvBW2PtIsn Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTFxwjAAoJEDXXcbtuRpfPC9UIAIATxPO9Qaeruqq/XJ5SMgNW vFQYyDsAd0LNyvkF/anJLLL+eNTKK1cM5ZXNIEphYaTXy1O1yKtyCx6+uuedqMyU Tz4pZPLuqHJZaph8fBgjqXvdILkvC26amrK2B6Iu/NR+QIhK/Msz6acyuVrnXiks cXwjS0aJQU+TX3v/UiP8sebqq56VDxYZ/pW9TRf4KIR+WVGbT7hlkwyW3QK+GL44 fGyDLdmoSuxB0n6Z78Jb7MrnMu0uyLLzmZ2dsT6OUj3xNVG2EOaLm/+0BnN3FNm1 lvSJlnzB+Z+AYUJw+LAZ6O8PYluDS0OQP9wSXdwxsxBdePVsen91n7tdbeIGn3I= =jQcD -----END PGP SIGNATURE----- --cNGx0R6DtBHthOCsGOHD2UpIvBW2PtIsn--