[jmg@FreeBSD.org: kern/66781: softupdate code causes panic]

--/04w6evG8XlLl3ft
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

FYI, I noticed that DragonFly has same code so maybe the same problem
applies. I have confirmed this on my FreeBSD 4.10-RC box, but not sure
about DF because I have to go home before I can get access to a DF box :-)

Cheers,

----- Forwarded message from John-Mark Gurney <jmg@FreeBSD.org> -----

>Number:         66781
>Category:       kern
>Synopsis:       softupdate code causes panic
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:       =20
>Keywords:      =20
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon May 17 16:00:30 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     John-Mark Gurney
>Release:        FreeBSD RELENG_4
>Organization:
Cu Networking
>Environment:
System: FreeBSD freefall.freebsd.org 4.10-RC FreeBSD 4.10-RC #12: Sun Apr 2=
5 14:35:16 PDT 2004 kensmith@freefall.freebsd.org:/c/src/sys/compile/FREEFA=
LL i386

	any -stable box with softupdates enabled on a file system.

>Description:

softupdate code will cause a panic trying to lock a buffer when the buffer
already has been locked...
BUF_LOCK(0xc6450440) (pid 1378) in getdirtybuf: 0                          =
    =20
called getdirtybuf(0xc6450440, MNT_WAIT) in softdep_sync_metadata: 1       =
    =20
D_BMSAFEMAP: getdirtybuf(0xc6450440)                                       =
    =20
BUF_LOCK(0xc6450440) (pid 1378) in getdirtbuf: 16                          =
    =20
panic: lockmgr: locking against myself                                     =
    =20

sorry I don't have a more extensive panic, but re@ has confirmed this on
latest RELENG_4.

>How-To-Repeat:
When running the following script:
#!/bin/sh -
#
# Script to do some torture tests on the FS and expose a Softdep bug.
#
# device should be the device node of where dir is mounted.
#
device=3D/dev/da1s1e
dir=3D/sql

cd "$dir"

while true; do
	mkdir testcrap
	cd testcrap
	mkdir -p a/b/c/d/e/f/g
	touch a/aa
	rm a/aa
	mkdir a/bb a/cc a/dd a/ee a/ff
	touch a/b/bb
	mkdir a/b/aa a/b/bc a/b/cc a/b/dd
	touch a/b/c/cc
	touch a/b/c/d/dd
	touch a/b/c/d/df
	truncate -s 1000G a/b/c/d/e/ee
	echo blah >> a/b/c/d/e/ee
	echo foobar > a/aa
	echo quuz > a/b/bb
	echo baz >> a/aa
	cd ..
	fsync "$device" &
	rm -r testcrap
done

where device and dir are set to the device that has softupdates on it
and dir where the fs is mounted.  In a minute or so, the machine will
panic..
>Fix:

turning off softupdates on the fs should prevent the panic since the code
path will no longer run... Though since it can happen on any softdep
enabled fs, you should turn off softdep on all fs's on the box...

the following patch is known to remove the panic, but is unknown if it
correct..  It could introduce a race where on disk meta data is not correct
breaking softdep's assumptions upon crash:
Index: ffs_softdep.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /home/ncvs/src/sys/ufs/ffs/ffs_softdep.c,v
retrieving revision 1.57.2.12
diff -u -r1.57.2.12 ffs_softdep.c

--- ffs_softdep.c	2004/03/15 18:04:41	1.57.2.12
+++ ffs_softdep.c	2004/05/17 22:53:54
@@ -4250,7 +4250,7 @@
 			 * rather than panic, just flush it.
 			 */
 			nbp =3D WK_BMSAFEMAP(wk)->sm_buf;
-			if (getdirtybuf(&nbp, waitfor) =3D=3D 0)
+			if (getdirtybuf(&nbp, MNT_NOWAIT) =3D=3D 0)
 				break;
 			FREE_LOCK(&lk);
 			if (waitfor =3D=3D MNT_NOWAIT) {
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscribe@freebsd.org"


----- End forwarded message -----

--=20
Xin LI <delphij frontfree net>	http://www.delphij.net/
See complete headers for GPG key and other information.


--/04w6evG8XlLl3ft
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFAqYRLOfuToMruuMARAr6gAJ9ss3OO+KYp1SYyvmqTWN+kJ7YqJQCePZQI
ZVCA+UXIlrtc70KJqqBOEBQ=
=XZh8
-----END PGP SIGNATURE-----

--/04w6evG8XlLl3ft--
