panic: vn_finished_write: neg cnt

[Andriy Gapon]

This happened with i386 RELENG_7 of a few days ago.
Panic/reboot was unattended (happened at night), it occurred after a
(live) dump of one filesystem onto another (gjournal-ed). It actually
occurred while running md5 on the dump file.
According to external measurements the system was quite loaded CPU- and
memory-wise at the of the panic.

Basic info from kgdb (I will keep the core and the symbol files for a
while):
Unread portion of the kernel message buffer:
lockmgr: thread 0xc3205cc0 unlocking unheld lock
KDB: stack backtrace:
db_trace_self_wrapper(c0709990,d91b9bac,c0508e14,c07062e3,c3205cc0,...)
at 0xc04519c6 = db_trace_self_wrapper+0x26
kdb_backtrace(c07062e3,c3205cc0,c2fcab80,0,c3fb37c0,...) at 0xc05444e9 =
kdb_backtrace+0x29
_lockmgr(c3f74498,6,c3f744c8,c3205cc0,c070d668,...) at 0xc0508e14 =
_lockmgr+0x614
vop_stdunlock(d91b9c00,c32407d4,c3f74440,c3205cc0,d91b9c24,...) at
0xc05890d5 = vop_stdunlock+0x45
VOP_UNLOCK_APV(c074d660,d91b9c00,c05a48b2,c074d660,d91b9c0c,...) at
0xc06e447c = VOP_UNLOCK_APV+0x5c
vput(c3f74440,d91b9ce0,2,0,1388,...) at 0xc0598086 = vput+0xa6
vm_pageout(0,d91b9d38,0,0,0,...) at 0xc06965bd = vm_pageout+0xfdd
fork_exit(c06955e0,0,d91b9d38) at 0xc04fc2a1 = fork_exit+0xa1
fork_trampoline() at 0xc06bbbe0 = fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xd91b9d70, ebp = 0 ---
lockmgr: thread 0xc3205cc0 unlocking unheld lock
KDB: stack backtrace:
db_trace_self_wrapper(c0709990,d91b9bac,c0508e14,c07062e3,c3205cc0,...)
at 0xc04519c6 = db_trace_self_wrapper+0x26
kdb_backtrace(c07062e3,c3205cc0,c3207000,c32071ec,0,...) at 0xc05444e9 =
kdb_backtrace+0x29
_lockmgr(c3f74498,6,c3f744c8,c3205cc0,c070d668,...) at 0xc0508e14 =
_lockmgr+0x614
vop_stdunlock(d91b9c00,c32407d4,c3f74440,c3205cc0,d91b9c24,...) at
0xc05890d5 = vop_stdunlock+0x45
VOP_UNLOCK_APV(c074d660,d91b9c00,c05a48b2,c074d660,d91b9c0c,...) at
0xc06e447c = VOP_UNLOCK_APV+0x5c
vput(c3f74440,d91b9ce0,2,0,1388,...) at 0xc0598086 = vput+0xa6
vm_pageout(0,d91b9d38,0,0,0,...) at 0xc06965bd = vm_pageout+0xfdd
fork_exit(c06955e0,0,d91b9d38) at 0xc04fc2a1 = fork_exit+0xa1
fork_trampoline() at 0xc06bbbe0 = fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xd91b9d70, ebp = 0 ---
panic: vn_finished_write: neg cnt
KDB: stack backtrace:
db_trace_self_wrapper(c0709990,d91b9c04,c051bb2a,c0707c08,c07733e0,...)
at 0xc04519c6 = db_trace_self_wrapper+0x26
kdb_backtrace(c0707c08,c07733e0,c070e5f4,d91b9c10,d91b9c10,...) at
0xc05444e9 = kdb_backtrace+0x29
panic(c070e5f4,c3f74440,d91b9ce0,c1868000,937,...) at 0xc051bb2a =
panic+0xaa
vn_finished_write(c32407d4,d91b9ce0,2,0,1388,...) at 0xc05a4827 =
vn_finished_write+0x67
vm_pageout(0,d91b9d38,0,0,0,...) at 0xc0696616 = vm_pageout+0x1036
fork_exit(c06955e0,0,d91b9d38) at 0xc04fc2a1 = fork_exit+0xa1
fork_trampoline() at 0xc06bbbe0 = fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xd91b9d70, ebp = 0 ---
Uptime: 5h33m33s
Physical memory: 631 MB
Dumping 240 MB: 225 209 193 177 161 145 129 113 97 81 65 49 33 17 1
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc051b933 in boot (howto=260) at
/system/src/sys/kern/kern_shutdown.c:418
#2  0xc051bb6a in panic (fmt=Variable "fmt" is not available.
) at /system/src/sys/kern/kern_shutdown.c:572
#3  0xc05a4827 in vn_finished_write (mp=0xc32407d4) at
/system/src/sys/kern/vfs_vnops.c:1049
#4  0xc0696616 in vm_pageout () at /system/src/sys/vm/vm_pageout.c:1028
#5  0xc04fc2a1 in fork_exit (callout=0xc06955e0 <vm_pageout>, arg=0x0,
frame=0xd91b9d38) at /system/src/sys/kern/kern_fork.c:783
#6  0xc06bbbe0 in fork_trampoline () at
/system/src/sys/i386/i386/exception.s:205
(kgdb) fr 3
#3  0xc05a4827 in vn_finished_write (mp=0xc32407d4) at
/system/src/sys/kern/vfs_vnops.c:1049
1049                    panic("vn_finished_write: neg cnt");
(kgdb) list
1044            if (mp == NULL)
1045                    return;
1046            MNT_ILOCK(mp);
1047            mp->mnt_writeopcount--;
1048            if (mp->mnt_writeopcount < 0)
1049                    panic("vn_finished_write: neg cnt");
1050            if ((mp->mnt_kern_flag & MNTK_SUSPEND) != 0 &&
1051                mp->mnt_writeopcount <= 0)
1052                    wakeup(&mp->mnt_writeopcount);
1053            MNT_IUNLOCK(mp);
(kgdb) p mp->mnt_writeopcount
$1 = -1

-- 
Andriy Gapon