Date: Wed, 5 Mar 2014 13:07:23 +0200 From: Konstantin Belousov <kostikbel@gmail.com> To: Andriy Gapon <avg@FreeBSD.org> Cc: Alan Cox <alc@FreeBSD.org>, freebsd-current@FreeBSD.org, Bryan Drewery <bdrewery@FreeBSD.org> Subject: Re: panic: lockmgr still held [tmpfs] [vm_map_remove()->vdropl()] (r262186: Thu Feb 20) Message-ID: <20140305110723.GB24664@kib.kiev.ua> In-Reply-To: <5316F144.1000105@FreeBSD.org> References: <53109ACB.20102@FreeBSD.org> <201403031306.59405.jhb@freebsd.org> <53153F43.6010506@FreeBSD.org> <201403041145.48425.jhb@freebsd.org> <5316F144.1000105@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--f8UppZzm5eRNGSBg Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 05, 2014 at 11:41:24AM +0200, Andriy Gapon wrote: > on 04/03/2014 18:45 John Baldwin said the following: > > So I'm not sure how to fix this. The crash is in this code in=20 > > vm_object_deallocate(): > >=20 > > if (object->type =3D=3D OBJT_SWAP && > > (object->flags & OBJ_TMPFS) !=3D 0) { > > vp =3D object->un_pager.swp.swp_tmpfs; > > vhold(vp); > > VM_OBJECT_WUNLOCK(object); > > vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); > > vdrop(vp); > > VM_OBJECT_WLOCK(object); > > if (object->type =3D=3D OBJT_DEAD || > > object->ref_count !=3D 1) { > > VM_OBJECT_WUNLOCK(object); > > VOP_UNLOCK(vp, 0); > > return; > > } > > if ((object->flags & OBJ_TMPFS) !=3D 0) > > VOP_UNSET_TEXT(vp); > > VOP_UNLOCK(vp, 0); > > } > >=20 > > The vdrop() is dropping the count to zero and trying to free the vnode.= The=20 > > real problem I think is that swp_tmpfs doesn't have an implicit vhold()= on the=20 > > vnode, so in this case, the code is doing a vhold/vn_lock/vdrop of an a= lready- > > free vnode. For OBJT_VNODE objects, the reference from the object back= to the=20 > > vnode holds a vref() that gets released by a vput() in=20 > > vm_object_vndeallocate(). > >=20 > > One fix might be to chagne smp_tmpfs to hold a vhold reference. This i= s=20 > > untested but might work (but I'm also not sure that this is the right t= hing in=20 > > that I don't know what other effects it might have). >=20 > I agree with your analysis, but I don't think that a filesystem holding i= ts own > vnode is a good idea. If I am not mistaken, that would prevent tmpfs vno= des > from going to free list. > I'd rather try to modify vm_object_deallocate() code. E.g. vdrop() could= be > called after VOP_UNLOCK(). Alternatively, the code could handle a doomed= vnode > in a different way. I agree with Andrey, it is just a bug to vdrop() before unlock. Please try this. diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c index 8683e2f..787b18b 100644 --- a/sys/vm/vm_object.c +++ b/sys/vm/vm_object.c @@ -536,17 +536,18 @@ vm_object_deallocate(vm_object_t object) vhold(vp); VM_OBJECT_WUNLOCK(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); - vdrop(vp); VM_OBJECT_WLOCK(object); if (object->type =3D=3D OBJT_DEAD || object->ref_count !=3D 1) { VM_OBJECT_WUNLOCK(object); VOP_UNLOCK(vp, 0); + vdrop(vp); return; } if ((object->flags & OBJ_TMPFS) !=3D 0) VOP_UNSET_TEXT(vp); VOP_UNLOCK(vp, 0); + vdrop(vp); } if (object->shadow_count =3D=3D 0 && object->handle =3D=3D NULL && --f8UppZzm5eRNGSBg Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (FreeBSD) iQIcBAEBAgAGBQJTFwVqAAoJEJDCuSvBvK1BmuUP/00o0a74Ow1j3CcfDqC3a8r+ wHLlU9CIGSj4Mw/oadAyPVMUuvkFbuNtFk7oAta02FMLTvj/cgrlYCSFDaDPAF/n LEQKI/mYcNDwMr2L9Ynos+v/cb4hvy7eA8jlk3yLrjK6VRytebOF+Ymq3iBPI20n Qu2qkaB1o/W0AGOCU+ZvAc9zg49QpQuXg8wAoFfID0g4EYZqXE5VfkRvC4ZFQyT2 NbcQKqOR8GFhOuMJHUtc5ZaiWA4w9Mq3XArMVMSvWFtj2eWWC7A4FKUKJ9OWtx5y A/4nvp5bGRa3/5vkRYSnX3jJeEd27bN8wzXJL/qfnSrKBBQzcZdOMD3MEF/ooPpT kuxDEN0xunilxE3G2fhw8hWBdFtZHXLSLeSbg3D42xjTu+8hg1C75DrhI3CSOhoA 5D3EdKq7r4gfGY1u5rOMem8p+IMAcID9svoj9rmMWQz9bwy4Zix/KKosUu3Lph/i px2fSeiSLB5FNmS1QQ2qHhW46/vcfwZBzvu4PtEFD6mtqoQov92WdI4QFEpc0K/1 bO/qq29owEcVFJC8Eyr2moQSi1pCXozutiTLxouuMzYDsVWzG2nHC5x+ChUBeDzm 1tW8x5KMxsLzKOp5AgyJPvm61A/LyLRxL+yteU6c50nXJXRx0FRQ8HzRb9KfjZcU 0WiKBVOXfIqUi9t+Si3W =Tpuu -----END PGP SIGNATURE----- --f8UppZzm5eRNGSBg--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140305110723.GB24664>