From owner-svn-src-stable-7@FreeBSD.ORG Mon Jul 20 16:19:42 2009 Return-Path: Delivered-To: svn-src-stable-7@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EA2211065673; Mon, 20 Jul 2009 16:19:42 +0000 (UTC) (envelope-from snb@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id D679D8FC22; Mon, 20 Jul 2009 16:19:42 +0000 (UTC) (envelope-from snb@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n6KGJgQd082555; Mon, 20 Jul 2009 16:19:42 GMT (envelope-from snb@svn.freebsd.org) Received: (from snb@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n6KGJgQ0082553; Mon, 20 Jul 2009 16:19:42 GMT (envelope-from snb@svn.freebsd.org) Message-Id: <200907201619.n6KGJgQ0082553@svn.freebsd.org> From: Sean Nicholas Barkas Date: Mon, 20 Jul 2009 16:19:42 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org X-SVN-Group: stable-7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r195783 - stable/7/sys/ufs/ufs X-BeenThere: svn-src-stable-7@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 7-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 16:19:43 -0000 Author: snb Date: Mon Jul 20 16:19:42 2009 New Revision: 195783 URL: http://svn.freebsd.org/changeset/base/195783 Log: MFC r195003: Fix a bug reported by pho@ where one can induce a panic by decreasing vfs.ufs.dirhash_maxmem below the current amount of memory used by dirhash. When ufsdirhash_build() is called with the memory in use greater than dirhash_maxmem, it attempts to free up memory by calling ufsdirhash_recycle(). If successful in freeing enough memory, ufsdirhash_recycle() leaves the dirhash list locked. But at this point in ufsdirhash_build(), the list is not explicitly unlocked after the call(s) to ufsdirhash_recycle(). When we next attempt to lock the dirhash list, we will get a "panic: _mtx_lock_sleep: recursed on non-recursive mutex dirhash list". Approved by: dwmalone (mentor) Modified: stable/7/sys/ufs/ufs/ufs_dirhash.c Modified: stable/7/sys/ufs/ufs/ufs_dirhash.c ============================================================================== --- stable/7/sys/ufs/ufs/ufs_dirhash.c Mon Jul 20 13:55:33 2009 (r195782) +++ stable/7/sys/ufs/ufs/ufs_dirhash.c Mon Jul 20 16:19:42 2009 (r195783) @@ -329,9 +329,12 @@ ufsdirhash_build(struct inode *ip) int dirblocks, i, j, memreqd, nblocks, narrays, nslots, slot; /* Take care of a decreased sysctl value. */ - while (ufs_dirhashmem > ufs_dirhashmaxmem) + while (ufs_dirhashmem > ufs_dirhashmaxmem) { if (ufsdirhash_recycle(0) != 0) return (-1); + /* Recycled enough memory, so unlock the list. */ + DIRHASHLIST_UNLOCK(); + } /* Check if we can/should use dirhash. */ if (ip->i_size < ufs_mindirhashsize || OFSFMT(ip->i_vnode) ||