misc/141740: g_journal_destroy concurrent error

[Zhouyi Zhou]

>Number:         141740
>Category:       misc
>Synopsis:       g_journal_destroy concurrent error
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Dec 18 06:00:14 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Zhouyi Zhou
>Release:        I use gjournal patch on FB6, but it may apply to other FB versions
>Organization:
ICT China
>Environment:
FreeBSD 6.3 i386
>Description:
When the kernel is configured as preemptable, when after the PC excuted function g_journal_destroy line 2352:

2350         while (sc->sc_worker != NULL)
2351                 msleep(&sc->sc_worker, &sc->sc_mtx, PRIBIO, "gj:destroy", 0);
2352         mtx_destroy(&sc->sc_mtx);

now the g_topology_unlock has been called, then if g_journal_switcher got scheduled, the concurrence problem will occur.


#0  0x407a8de5 in turnstile_setowner (ts=0x63be6480, owner=0x4) at ../../../kern/subr_turnstile.c:457
#1  0x407a92bc in turnstile_wait (lock=0x836b8210, owner=0x4, queue=0) at ../../../kern/subr_turnstile.c:661
#2  0x40770fb3 in _mtx_lock_sleep (m=0x836b8210, tid=2145898496, opts=0, file=0x0, line=0) at ../../../kern/kern_mutex.c:580
#3  0x407359de in g_journal_do_switch (classp=0x40dbaee0, td=0x7fe7d000) at ../../../geom/journal/g_journal.c:2861
#4  0x40735c57 in g_journal_switcher (arg=0x40dbaee0) at ../../../geom/journal/g_journal.c:2909

 



>How-To-Repeat:
reboot/shutdown, if luck, the problem occurs
>Fix:
--- g_journal.c~        2009-12-07 10:37:58.000000000 +0000
+++ g_journal.c 2009-12-18 12:25:20.000000000 +0000
@@ -2349,7 +2349,7 @@
        wakeup(sc);
        while (sc->sc_worker != NULL)
                msleep(&sc->sc_worker, &sc->sc_mtx, PRIBIO, "gj:destroy", 0);
-       mtx_destroy(&sc->sc_mtx);
+
 
        if (pp != NULL) {
                GJ_DEBUG(1, "Marking %s as clean.", sc->sc_name);
@@ -2378,6 +2378,7 @@
                g_post_event(g_journal_destroy_consumer, cp, M_WAITOK, NULL);
        }
        gp->softc = NULL;
+       mtx_destroy(&sc->sc_mtx);
        g_wither_geom(gp, ENXIO);
        free(sc, M_JOURNAL);
        return (0);

>Release-Note:
>Audit-Trail:
>Unformatted: