Panic in ffs_blkfree()

[Ian Dowse]

In message <3EB2FB35.8060104 at btc.adaptec.com>, Scott Long writes:
>Kirk and all,
>
>Recently a panic started appearing on mine and other's systems while
>under  load.  I have an SMP system with all UFS1+softupdates

Try reverting revisions sys/vm/vm_object.c 1.274 and kern/vfs_subr.c
revision 1.444, i.e. apply the patch below. I think there may be
cases where the `all' flag was necessary; instrumentation of
vm_object_page_remove() in a kernel from Apr 5th shows cases where
pages with both wrapped negative (indirection blocks I presume) and
larger than object->size page indices get selected, so this would
have been broken by limiting the range to < object->size.

Ian

Index: vm/vm_object.c
===================================================================
RCS file: /home/iedowse/CVS/src/sys/vm/vm_object.c,v
retrieving revision 1.281
diff -u -r1.281 vm_object.c
--- vm/vm_object.c	2 May 2003 04:55:21 -0000	1.281
+++ vm/vm_object.c	3 May 2003 04:28:52 -0000
@@ -1684,22 +1684,22 @@
  *	The object must be locked.
  */
 void
-vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
-    boolean_t clean_only)
+vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end, boolean_t clean_only)
 {
 	vm_page_t p, next;
+	int all;
 
-	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
-	if (object->resident_page_count == 0)
+	if (object == NULL ||
+	    object->resident_page_count == 0)
 		return;
+	all = ((end == 0) && (start == 0));
 
 	/*
 	 * Since physically-backed objects do not use managed pages, we can't
 	 * remove pages from the object (we must instead remove the page
 	 * references, and then destroy the object).
 	 */
-	KASSERT(object->type != OBJT_PHYS,
-	    ("attempt to remove pages from a physical object"));
+	KASSERT(object->type != OBJT_PHYS, ("attempt to remove pages from a physical object"));
 
 	vm_object_pip_add(object, 1);
 again:
@@ -1717,7 +1717,7 @@
 	 * or (2) NULL.
 	 */
 	for (;
-	     p != NULL && p->pindex < end;
+	     p != NULL && (all || p->pindex < end);
 	     p = next) {
 		next = TAILQ_NEXT(p, listq);