6.2 amd64 panic: lockmgr: thread 0xffffff009f9fd000, not exclusive lock holder 0xffffff003961c000 unlocking

[Kostik Belousov]

On Thu, Feb 01, 2007 at 10:02:08AM -0600, Guy Helmer wrote:
> Guy Helmer wrote:
> >Does this make sense to anyone (it doesn't to me - procfs_doprofile 
> >simply locks, calls vn_fullpath, and unlocks)?  I was trying to track 
> >down a hang by running a system under stress, and instead got this 
> >panic as a result of a process running a perl script that looks 
> >through /proc/; it occurred on a very busy system with lots of process 
> >churn.
> Does this change to src/sys/fs/procfs.c make sense?  From my reading, it 
> is possible for vn_lock(9) to fail...
> 
> Index: procfs.c
> ===================================================================
> RCS file: /home/ncvs/src/sys/fs/procfs/procfs.c,v
> retrieving revision 1.12.2.1
> diff -u -r1.12.2.1 procfs.c
> --- procfs.c    14 Jun 2006 21:20:39 -0000      1.12.2.1
> +++ procfs.c    1 Feb 2007 15:19:30 -0000
> @@ -69,8 +69,11 @@
> {
> 	char *fullpath = "unknown";
> 	char *freepath = NULL;
> +	int err;
> 
> -	vn_lock(p->p_textvp, LK_EXCLUSIVE | LK_RETRY, td);
> +	if ((err = vn_lock(p->p_textvp, LK_EXCLUSIVE | LK_RETRY, td)) != 0) {
> +		return (err);
> +	}
> 	vn_fullpath(td, p->p_textvp, &fullpath, &freepath);
> 	VOP_UNLOCK(p->p_textvp, 0, td);
> 	sbuf_printf(sb, "%s", fullpath);

vn_lock with LK_EXCLUSIVE|LK_RETRY flags combination shall not fail. It should
return even dead vnodes locked.

I suspect that in fact this is race with exec(). Could you reproduce the
panic ? And then, with this patch ?

Index: fs/procfs/procfs.c
===================================================================
RCS file: /usr/local/arch/ncvs/src/sys/fs/procfs/procfs.c,v
retrieving revision 1.14
diff -u -r1.14 procfs.c
--- fs/procfs/procfs.c	5 Jun 2006 16:41:27 -0000	1.14
+++ fs/procfs/procfs.c	1 Feb 2007 16:37:43 -0000
@@ -69,10 +69,12 @@
 {
 	char *fullpath = "unknown";
 	char *freepath = NULL;
+	struct vnode *textvp;
 
-	vn_lock(p->p_textvp, LK_EXCLUSIVE | LK_RETRY, td);
-	vn_fullpath(td, p->p_textvp, &fullpath, &freepath);
-	VOP_UNLOCK(p->p_textvp, 0, td);
+	textvp = p->p_textvp;
+	vn_lock(textvp, LK_EXCLUSIVE | LK_RETRY, td);
+	vn_fullpath(td, textvp, &fullpath, &freepath);
+	VOP_UNLOCK(textvp, 0, td);
 	sbuf_printf(sb, "%s", fullpath);
 	if (freepath)
 		free(freepath, M_TEMP);
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20070201/f4e28d2a/attachment.pgp