clean/dirty queue mixup

[Vinod R. Kashyap]

I am running some file I/O (multiple 'cp -R x/* y') on a kernel built out of
FreeBSD 4.8 RELEASE sources (with SMP and APIC_IO turned on),
when I see the following panic, anywhere between 0.5 - 15 hours after start:
panic:  softdep_deallocate_dependencies: dangling deps
mp_lock = 01000001; cpuid = 1; lapic_id = 06000000
(the I/O is running on a system with a dual Xeon motherboard)

I recompiled the kernel with INVARIANTS & INVARIANT_SUPPORT on,
and now see the following panic:
panic:  getnewbuf:  inconsistant queue 2 bp 0xcc94b564
mp_lock = 01000001; cpuid = 1;  lapic_id = 06000000

In getnewbuf (in kern/vfs_bio.c), bufqueues[QUEUE_EMPTYKVA] seems to have
run out of buffers, and so, a buffer is gotten out of 
bufqueues[QUEUE_CLEAN].
The problem is that this buffer has its b_qindex set to 3 (QUEUE_DIRTY), 
instead
of 2 (QUEUE_CLEAN).  It also has b_flags set to B_DELWRI, and b_xflags set 
to
BX_VNDIRTY. bp->b_dep is non-NULL, and points to a work item with
wk_type=0x5 (D_INDIRDEP) and wk_state=0x8001 (VONWORKLIST | ATTACHED).
I noticed that at least the first 5 buffers in the CLEAN queue had their 
b_qindex set
to 3 (DIRTY).

I noticed something that could potentially be causing this (I might be way 
off here...):
When a low level device driver calls biodone(), if bp->b_dep is non-NULL,
(*bioops.io_complete)/softdep_disk_write_complete gets called, which, in 
case
the work item is of type D_INDIRDEP, unconditionally puts it back into the 
b_dep
queue, and marks it dirty.  On return from this call, it looks like biodone 
goes ahead
and frees the buffer with the dirty flags still set, and b_dep non-NULL.  Is 
this the
cause by any chance?  Can anyone please help?

I have attached some more information from gdb.  I can send the core-dump to
anyone who might be interested.


Thanks,

Vinod.

_________________________________________________________________
Contact brides & grooms FREE! http://www.shaadi.com/ptnr.php?ptnr=hmltag 
Only on www.shaadi.com. Register now!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: q_mixup.log
Type: application/octet-stream
Size: 13222 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-fs/attachments/20031001/8227dea8/q_mixup-0001.obj