From owner-freebsd-current@FreeBSD.ORG  Fri Sep 11 21:00:59 2009
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 858E31065742;
	Fri, 11 Sep 2009 21:00:59 +0000 (UTC)
	(envelope-from pjd@garage.freebsd.pl)
Received: from mail.garage.freebsd.pl (chello087206049004.chello.pl
	[87.206.49.4]) by mx1.freebsd.org (Postfix) with ESMTP id 830668FC29;
	Fri, 11 Sep 2009 21:00:58 +0000 (UTC)
Received: by mail.garage.freebsd.pl (Postfix, from userid 65534)
	id C224A45DF4; Fri, 11 Sep 2009 23:00:56 +0200 (CEST)
Received: from localhost (abig24.neoplus.adsl.tpnet.pl [83.7.122.24])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mail.garage.freebsd.pl (Postfix) with ESMTP id 4EB9745C9C;
	Fri, 11 Sep 2009 23:00:51 +0200 (CEST)
Date: Fri, 11 Sep 2009 23:00:53 +0200
From: Pawel Jakub Dawidek <pjd@FreeBSD.org>
To: Kris Kennaway <kris@FreeBSD.org>
Message-ID: <20090911210053.GA2090@garage.freebsd.pl>
References: <4AA40E30.50109@FreeBSD.org> <4AAA9187.2020907@FreeBSD.org>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="45Z9DzgjV8m4Oswq"
Content-Disposition: inline
In-Reply-To: <4AAA9187.2020907@FreeBSD.org>
User-Agent: Mutt/1.4.2.3i
X-PGP-Key-URL: http://people.freebsd.org/~pjd/pjd.asc
X-OS: FreeBSD 8.0-CURRENT i386
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on 
	mail.garage.freebsd.pl
X-Spam-Level: 
X-Spam-Status: No, score=-0.6 required=4.5 tests=BAYES_00,RCVD_IN_SORBS_DUL 
	autolearn=no version=3.0.4
Cc: FreeBSD Current <freebsd-current@freebsd.org>, Kip Macy <kmacy@FreeBSD.org>
Subject: Re: panic: sx_xlock() of destroyed sx
	@	/zoo/kris/src8/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_rlock.c:535
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Sep 2009 21:00:59 -0000


--45Z9DzgjV8m4Oswq
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Sep 11, 2009 at 07:05:59PM +0100, Kris Kennaway wrote:
> Kris Kennaway wrote:
> >9.0 doing I/O to a zfs:
> >
> >panic: sx_xlock() of destroyed sx @=20
> >/zoo/kris/src8/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/common=
/fs/zfs/zfs_rlock.c:535=20
> >
> >db> wh
> >Tracing pid 14 tid 100047 td 0xffffff000357c720
> >kdb_enter() at kdb_enter+0x3d
> >panic() at panic+0x17b
> >_sx_xlock() at _sx_xlock+0xe9
> >zfs_range_unlock() at zfs_range_unlock+0x38
> >zfs_get_data() at zfs_get_data+0xd7
> >zil_commit() at zil_commit+0x532
> >zfs_sync() at zfs_sync+0xa6
> >sync_fsync() at sync_fsync+0x13a
> >VOP_FSYNC_APV() at VOP_FSYNC_APV+0xb7
> >sync_vnode() at sync_vnode+0x157
> >sched_sync() at sched_sync+0x1d1
> >fork_exit() at fork_exit+0x12a
> >fork_trampoline() at fork_trampoline+0xe
> >--- trap 0, rip =3D 0, rsp =3D 0xffffff8125da0d30, rbp =3D 0 ---
> >
> >This was essentially just doing make world + cvs update + tar creation=
=20
> >in a loop and failed after about a week.
>=20
> Any ideas?  Machine is still in DDB.

I was trying to reproduce it by doing much more frequent syncs and
lowering vnodes limit, so they are inactivated more often, but I wasn't
able to reproduce it.

The problem here is that we lock a range for the given znode, but before
we unlock the range, znode is destroyed.

If you compile ZFS with debug (you have to uncomment CFLAGS+=3D-DDEBUG=3D1
in sys/modules/zfs/Makefile and recompile), we should be able to catch
who is killing the znode, because then, avl_destroy(&zp->z_range_avl)
should trigger a panic that tree isn't empty.

--=20
Pawel Jakub Dawidek                       http://www.wheel.pl
pjd@FreeBSD.org                           http://www.FreeBSD.org
FreeBSD committer                         Am I Evil? Yes, I Am!

--45Z9DzgjV8m4Oswq
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (FreeBSD)

iD8DBQFKqrqFForvXbEpPzQRAo0AAJ9qiQytYhMXS2/Sy3whsqGYseIkrwCgvUTw
JOs40l7NHt5hF1F0znmR++M=
=n+gL
-----END PGP SIGNATURE-----

--45Z9DzgjV8m4Oswq--