Panic in ffs_blkfree()

[Alan L. Cox]

Ian Dowse wrote:
> 
> In message <3EB2FB35.8060104 at btc.adaptec.com>, Scott Long writes:
> >Kirk and all,
> >
> >Recently a panic started appearing on mine and other's systems while
> >under  load.  I have an SMP system with all UFS1+softupdates
> 
> Try reverting revisions sys/vm/vm_object.c 1.274 and kern/vfs_subr.c
> revision 1.444, i.e. apply the patch below. I think there may be
> cases where the `all' flag was necessary; instrumentation of
> vm_object_page_remove() in a kernel from Apr 5th shows cases where
> pages with both wrapped negative (indirection blocks I presume) and
> larger than object->size page indices get selected, so this would
> have been broken by limiting the range to < object->size.
> 

Please take a look at vm_object_page_clean().  If end == 0, it relies on
object->size to determine the extent of the pages for cleaning.  In
light of the above, particularly, the positive indices, we should be
worried that msync is skipping pages.

Alan