kern/94733: lockmgr warning while using smbfs

[SANETO Takanori]

>Number:         94733
>Category:       kern
>Synopsis:       lockmgr warning while using smbfs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Mar 20 13:40:15 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     SANETO Takanori
>Release:        7.0-CURRENT
>Organization:
an individual
>Environment:
FreeBSD muse.sanewo.ddo.jp 7.0-CURRENT FreeBSD 7.0-CURRENT #873: Mon Mar 13 01:24:00 JST 2006    root at muse.sanewo.ddo.jp:/export/usr/obj/usr/src/sys/MUSE  i386

>Description:
during boot up, when mounting smbfs, following warning is displayed:

lockmgr: thread 0xc1e56bd0 unlocking unheld lock
KDB: stack backtrace:
lockmgr(c2028d88,6,c2028dac,c1e56bd0,cc81a9fc) at lockmgr+0x6d9
smb_co_unlock(c2028d80,0,c1e56bd0,cc81aa1c,c2014290) at smb_co_unlock+0x2c
smb_sm_init(cc81aa1c,c0493958,c1f1542c,c2026d62,c1f15400) at smb_sm_init+0x41
nsmb_dev_load(c1f15400,0,0,102,c05f7d1e) at nsmb_dev_load+0x25
module_register_init(c2028150,c05f7d1e,cc81aac0,cc81aac4,0) at module_register_init+0x73
linker_load_module(0,c1e54c00,0,0,cc81ac70) at linker_load_module+0x713
kldload(c1e56bd0,cc81ad04,4,1,cc81ad38) at kldload+0x195
syscall(3b,3b,3b,28050a1a,bfbfea20) at syscall+0x23b
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (304, FreeBSD ELF32, kldload), eip = 0x280d1843, esp = 0xbfbfe89c, ebp = 0xbfbfee68 ---

>How-To-Repeat:
While booting up, I got two warnings. While shutting down, I got one.
I have one smbfs entry in fstab.
>Fix:
I found that in smbfs_node.c, there is a path where smbfs_hash_unlock() is called twice.
Following patch may avoid such situation.

--- smbfs_node.c        17 Jan 2006 17:29:02 -0000      1.30
+++ smbfs_node.c        18 Mar 2006 23:38:47 -0000
@@ -222,12 +222,13 @@
                    (vp->v_type == VREG && (np->n_dosattr & SMB_FA_DIR) != 0)) {
                        vgone(vp);
                        vput(vp);
-                       break;
+                       goto unlocked;
                }
                *vpp = vp;
                return 0;
        }
        smbfs_hash_unlock(smp, td);
+unlocked:
        /*
         * If we don't have node attributes, then it is an explicit lookup
         * for an existing vnode.

>Release-Note:
>Audit-Trail:
>Unformatted: