Date: Fri, 22 May 2026 18:50:32 +0300 From: Aleksandr Rybalko <ray@freebsd.org> To: Ryan Libby <rlibby@freebsd.org> Cc: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>, current@freebsd.org, imp@freebsd.org Subject: Re: panic: mtx_lock_spin: recursed on non-recursive mutex vtbuf @ .. Message-ID: <CAJ1Oi8HkSMKZ1vRXgm27kgiV0RkLac%2BbB2abZVURBLwy_7kHQQ@mail.gmail.com> In-Reply-To: <CAHgpiFzcU12khmHFJTfLG4BVk%2BDCXvXpOJWZBZ_PfQAp_V_OfA@mail.gmail.com> References: <n75ors8s-1762-996-oqn1-pqs4os5sos0@mnoonqbm.arg> <CAHgpiFzcU12khmHFJTfLG4BVk%2BDCXvXpOJWZBZ_PfQAp_V_OfA@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --]
Hey guys!
Yeah, it seems my.
I will look into it today.
Thanks!
пт, 22 трав. 2026 р. о 18:35 Ryan Libby <rlibby@freebsd.org> пише:
> On Fri, May 22, 2026 at 1:46 AM Bjoern A. Zeeb
> <bzeeb-lists@lists.zabbadoz.net> wrote:
> >
> > Hi,
> >
> > I was using the mouse in tmux on v1 when everying stopped.
> > Sadly we didn't switch to v0 for console but it seems I managed to get a
> dump only checking now; the kernel from then is already gone.
> >
> > core.txt said.
> >
> > panic: mtx_lock_spin: recursed on non-recursive mutex vtbuf @
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:744
> >
> > cpuid = 1
> > time = 1779437567
> > KDB: stack backtrace:
> > db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
> 0xfffffe00d773e7a0
> > vpanic() at vpanic+0x149/frame 0xfffffe00d773e8d0
> > panic() at panic+0x43/frame 0xfffffe00d773e930
> > __mtx_lock_spin_flags() at __mtx_lock_spin_flags+0x11b/frame
> 0xfffffe00d773e970
> > vtbuf_flush_mark() at vtbuf_flush_mark+0x82/frame 0xfffffe00d773e9b0
> > vtbuf_unmark_on_cross() at vtbuf_unmark_on_cross+0xcc/frame
> 0xfffffe00d773e9d0
> > vtterm_fill() at vtterm_fill+0x27/frame 0xfffffe00d773ea00
> > teken_subr_erase_line() at teken_subr_erase_line+0x90/frame
> 0xfffffe00d773ea20
> > teken_state_2() at teken_state_2+0x497/frame 0xfffffe00d773ea40
> > teken_input_char() at teken_input_char+0x47/frame 0xfffffe00d773ea60
> > teken_input() at teken_input+0x9f/frame 0xfffffe00d773ea90
> > termtty_outwakeup() at termtty_outwakeup+0xcf/frame 0xfffffe00d773eb60
> > ttydisc_write() at ttydisc_write+0x337/frame 0xfffffe00d773ecd0
> > ttydev_write() at ttydev_write+0x13f/frame 0xfffffe00d773ed10
> > devfs_write_f() at devfs_write_f+0xf3/frame 0xfffffe00d773ed70
> > dofilewrite() at dofilewrite+0x81/frame 0xfffffe00d773edc0
> > sys_writev() at sys_writev+0x69/frame 0xfffffe00d773ee00
> > amd64_syscall() at amd64_syscall+0x168/frame 0xfffffe00d773ef30
> > fast_syscall_common() at fast_syscall_common+0xf8/frame
> 0xfffffe00d773ef30
> > --- syscall (121, FreeBSD ELF64, writev), rip = 0x82601d5aa, rsp =
> 0x8207a3408, rbp = 0x8207a3430 ---
> > KDB: enter: panic
> >
> >
> > In case it helps, I believe this is file:line as reported by gdb in
> core.txt:
> >
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/kern_mutex.c:353
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:744
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:864
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:210
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:232
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_core.c:1201
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:121
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken_subr.h:558
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:255
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:284
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:317
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/subr_terminal.c:422
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/sys/ttydevsw.h:114
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/tty_ttydisc.c:658
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/tty.c:550
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/fs/devfs/devfs_vnops.c:1980
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/sys/file.h:372
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/sys_generic.c:565
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/sys_generic.c:492
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/sys_generic.c:478
> > at
> /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/amd64/amd64/../../kern/subr_syscall.c:193
> >
> >
> > --
> > Bjoern A. Zeeb r15:7
> >
>
> I think it's probably related to or a regression from
> 8db0553ed6d8 ("vt: Clear cut-paste selection if the area intersects
> with the filled region")
>
> https://cgit.freebsd.org/src/commit/?id=8db0553ed6d8636d82a26896237099526b93be19
>
> which added vtbuf_unmark_on_cross() which is in your panic stack.
>
> I don't know this code but it looks like the mutex is first taken by
> teken_input / teken_funcs_pre_input / vtterm_pre_input and then again
> by teken_input with your panic stack.
>
> Ryan
>
[-- Attachment #2 --]
<div dir="ltr"><div>Hey guys!<br></div><div><br></div><div>Yeah, it seems my.<br></div><div>I will look into it today.<br><br></div><div>Thanks!</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">пт, 22 трав. 2026 р. о 18:35 Ryan Libby <<a href="mailto:rlibby@freebsd.org">rlibby@freebsd.org</a>> пише:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Fri, May 22, 2026 at 1:46 AM Bjoern A. Zeeb<br>
<<a href="mailto:bzeeb-lists@lists.zabbadoz.net" target="_blank">bzeeb-lists@lists.zabbadoz.net</a>> wrote:<br>
><br>
> Hi,<br>
><br>
> I was using the mouse in tmux on v1 when everying stopped.<br>
> Sadly we didn't switch to v0 for console but it seems I managed to get a dump only checking now; the kernel from then is already gone.<br>
><br>
> core.txt said.<br>
><br>
> panic: mtx_lock_spin: recursed on non-recursive mutex vtbuf @ /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:744<br>
><br>
> cpuid = 1<br>
> time = 1779437567<br>
> KDB: stack backtrace:<br>
> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00d773e7a0<br>
> vpanic() at vpanic+0x149/frame 0xfffffe00d773e8d0<br>
> panic() at panic+0x43/frame 0xfffffe00d773e930<br>
> __mtx_lock_spin_flags() at __mtx_lock_spin_flags+0x11b/frame 0xfffffe00d773e970<br>
> vtbuf_flush_mark() at vtbuf_flush_mark+0x82/frame 0xfffffe00d773e9b0<br>
> vtbuf_unmark_on_cross() at vtbuf_unmark_on_cross+0xcc/frame 0xfffffe00d773e9d0<br>
> vtterm_fill() at vtterm_fill+0x27/frame 0xfffffe00d773ea00<br>
> teken_subr_erase_line() at teken_subr_erase_line+0x90/frame 0xfffffe00d773ea20<br>
> teken_state_2() at teken_state_2+0x497/frame 0xfffffe00d773ea40<br>
> teken_input_char() at teken_input_char+0x47/frame 0xfffffe00d773ea60<br>
> teken_input() at teken_input+0x9f/frame 0xfffffe00d773ea90<br>
> termtty_outwakeup() at termtty_outwakeup+0xcf/frame 0xfffffe00d773eb60<br>
> ttydisc_write() at ttydisc_write+0x337/frame 0xfffffe00d773ecd0<br>
> ttydev_write() at ttydev_write+0x13f/frame 0xfffffe00d773ed10<br>
> devfs_write_f() at devfs_write_f+0xf3/frame 0xfffffe00d773ed70<br>
> dofilewrite() at dofilewrite+0x81/frame 0xfffffe00d773edc0<br>
> sys_writev() at sys_writev+0x69/frame 0xfffffe00d773ee00<br>
> amd64_syscall() at amd64_syscall+0x168/frame 0xfffffe00d773ef30<br>
> fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d773ef30<br>
> --- syscall (121, FreeBSD ELF64, writev), rip = 0x82601d5aa, rsp = 0x8207a3408, rbp = 0x8207a3430 ---<br>
> KDB: enter: panic<br>
><br>
><br>
> In case it helps, I believe this is file:line as reported by gdb in core.txt:<br>
><br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/kern_mutex.c:353<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:744<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:864<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:210<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_buf.c:232<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/dev/vt/vt_core.c:1201<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:121<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken_subr.h:558<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:255<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:284<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/teken/teken.c:317<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/subr_terminal.c:422<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/sys/ttydevsw.h:114<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/tty_ttydisc.c:658<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/tty.c:550<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/fs/devfs/devfs_vnops.c:1980<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/sys/file.h:372<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/sys_generic.c:565<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/sys_generic.c:492<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/kern/sys_generic.c:478<br>
> at /usr/home/test/Sources/git/FreeBSD/freebsd-src.git/sys/amd64/amd64/../../kern/subr_syscall.c:193<br>
><br>
><br>
> --<br>
> Bjoern A. Zeeb r15:7<br>
><br>
<br>
I think it's probably related to or a regression from<br>
8db0553ed6d8 ("vt: Clear cut-paste selection if the area intersects<br>
with the filled region")<br>
<a href="https://cgit.freebsd.org/src/commit/?id=8db0553ed6d8636d82a26896237099526b93be19" rel="noreferrer" target="_blank">https://cgit.freebsd.org/src/commit/?id=8db0553ed6d8636d82a26896237099526b93be19</a><br>;
<br>
which added vtbuf_unmark_on_cross() which is in your panic stack.<br>
<br>
I don't know this code but it looks like the mutex is first taken by<br>
teken_input / teken_funcs_pre_input / vtterm_pre_input and then again<br>
by teken_input with your panic stack.<br>
<br>
Ryan<br>
</blockquote></div>
home |
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJ1Oi8HkSMKZ1vRXgm27kgiV0RkLac%2BbB2abZVURBLwy_7kHQQ>