ZFS triggered 9-STABLE r246646 panic "vdrop: holdcnt 0"

[Lawrence Stewart]

[ccing Will as he showed an interest in this on IRC when I first
reported the panic]

On 06/14/13 10:52, The BSD Dreamer wrote:
> On 03/11/2013 21:10, Lawrence Stewart wrote:
>> Hi all,
>>
>> I got this panic yesterday. I haven't seen it before (or since), but I
>> have the crashdump and kernel here if there's additional information I
>> can provide that would be useful in finding the cause.
>>
>> The machine runs ZFS exclusively and was under quite heavy CPU and IO
>> load at the time of the crash as I was compiling in a VirtualBox VM and
>> on the host itself, as well as running a full KDE desktop environment.
>> I'm fairly certain the machine was not swapping at the time of the crash.
>>
>> lstewart at lstewart> uname -a
>> FreeBSD lstewart 9.1-STABLE FreeBSD 9.1-STABLE #8 r246646M: Mon Feb 11
>> 14:57:13 EST 2013
>> root at lstewart:/usr/obj/usr/src/sys/LSTEWART-DESKTOP  amd64
>>
>> lstewart at lstewart> sudo kgdb /boot/kernel/kernel /var/crash/vmcore.0
>>
>> [...]
>>
>> (kgdb) bt
>> #0  doadump (textdump=<value optimized out>) at pcpu.h:229
>> #1  0xffffffff808e5824 in kern_reboot (howto=260) at
>> /usr/src/sys/kern/kern_shutdown.c:448
>> #2  0xffffffff808e5d27 in panic (fmt=0x1 <Address 0x1 out of bounds>) at
>> /usr/src/sys/kern/kern_shutdown.c:636
>> #3  0xffffffff8097a71e in vdropl (vp=<value optimized out>) at
>> /usr/src/sys/kern/vfs_subr.c:2465
>> #4  0xffffffff80b4da2b in vm_page_alloc (object=0xffffffff8132c000,
>> pindex=143696, req=32) at /usr/src/sys/vm/vm_page.c:1569
>> #5  0xffffffff80b3f312 in kmem_back (map=0xfffffe00020000e8,
>> addr=18446743524542296064, size=131072, flags=705200752)
>>     at /usr/src/sys/vm/vm_kern.c:361
> 
> I just came home to find that my system had panic'd (around
> 11:30am)....and this was the only FreeBSD 9 'panic: vdrop: holdcnt: 0'
> that I found.

I still have my kernel and crash dump lying around if there's any
additional useful information which could be extracted to help find the
cause of this panic. Doesn't appear to be very common though so the code
path which is failing to grab/hold a reference must only be used
infrequently.

Cheers,
Lawrence