Date: Wed, 5 Mar 2014 13:07:23 +0200 From: Konstantin Belousov <kostikbel@gmail.com> To: Andriy Gapon <avg@FreeBSD.org> Cc: Alan Cox <alc@FreeBSD.org>, freebsd-current@FreeBSD.org, Bryan Drewery <bdrewery@FreeBSD.org> Subject: Re: panic: lockmgr still held [tmpfs] [vm_map_remove()->vdropl()] (r262186: Thu Feb 20) Message-ID: <20140305110723.GB24664@kib.kiev.ua> In-Reply-To: <5316F144.1000105@FreeBSD.org> References: <53109ACB.20102@FreeBSD.org> <201403031306.59405.jhb@freebsd.org> <53153F43.6010506@FreeBSD.org> <201403041145.48425.jhb@freebsd.org> <5316F144.1000105@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Wed, Mar 05, 2014 at 11:41:24AM +0200, Andriy Gapon wrote:
> on 04/03/2014 18:45 John Baldwin said the following:
> > So I'm not sure how to fix this. The crash is in this code in
> > vm_object_deallocate():
> >
> > if (object->type == OBJT_SWAP &&
> > (object->flags & OBJ_TMPFS) != 0) {
> > vp = object->un_pager.swp.swp_tmpfs;
> > vhold(vp);
> > VM_OBJECT_WUNLOCK(object);
> > vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
> > vdrop(vp);
> > VM_OBJECT_WLOCK(object);
> > if (object->type == OBJT_DEAD ||
> > object->ref_count != 1) {
> > VM_OBJECT_WUNLOCK(object);
> > VOP_UNLOCK(vp, 0);
> > return;
> > }
> > if ((object->flags & OBJ_TMPFS) != 0)
> > VOP_UNSET_TEXT(vp);
> > VOP_UNLOCK(vp, 0);
> > }
> >
> > The vdrop() is dropping the count to zero and trying to free the vnode. The
> > real problem I think is that swp_tmpfs doesn't have an implicit vhold() on the
> > vnode, so in this case, the code is doing a vhold/vn_lock/vdrop of an already-
> > free vnode. For OBJT_VNODE objects, the reference from the object back to the
> > vnode holds a vref() that gets released by a vput() in
> > vm_object_vndeallocate().
> >
> > One fix might be to chagne smp_tmpfs to hold a vhold reference. This is
> > untested but might work (but I'm also not sure that this is the right thing in
> > that I don't know what other effects it might have).
>
> I agree with your analysis, but I don't think that a filesystem holding its own
> vnode is a good idea. If I am not mistaken, that would prevent tmpfs vnodes
> from going to free list.
> I'd rather try to modify vm_object_deallocate() code. E.g. vdrop() could be
> called after VOP_UNLOCK(). Alternatively, the code could handle a doomed vnode
> in a different way.
I agree with Andrey, it is just a bug to vdrop() before unlock.
Please try this.
diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c
index 8683e2f..787b18b 100644
--- a/sys/vm/vm_object.c
+++ b/sys/vm/vm_object.c
@@ -536,17 +536,18 @@ vm_object_deallocate(vm_object_t object)
vhold(vp);
VM_OBJECT_WUNLOCK(object);
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
- vdrop(vp);
VM_OBJECT_WLOCK(object);
if (object->type == OBJT_DEAD ||
object->ref_count != 1) {
VM_OBJECT_WUNLOCK(object);
VOP_UNLOCK(vp, 0);
+ vdrop(vp);
return;
}
if ((object->flags & OBJ_TMPFS) != 0)
VOP_UNSET_TEXT(vp);
VOP_UNLOCK(vp, 0);
+ vdrop(vp);
}
if (object->shadow_count == 0 &&
object->handle == NULL &&
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (FreeBSD)
iQIcBAEBAgAGBQJTFwVqAAoJEJDCuSvBvK1BmuUP/00o0a74Ow1j3CcfDqC3a8r+
wHLlU9CIGSj4Mw/oadAyPVMUuvkFbuNtFk7oAta02FMLTvj/cgrlYCSFDaDPAF/n
LEQKI/mYcNDwMr2L9Ynos+v/cb4hvy7eA8jlk3yLrjK6VRytebOF+Ymq3iBPI20n
Qu2qkaB1o/W0AGOCU+ZvAc9zg49QpQuXg8wAoFfID0g4EYZqXE5VfkRvC4ZFQyT2
NbcQKqOR8GFhOuMJHUtc5ZaiWA4w9Mq3XArMVMSvWFtj2eWWC7A4FKUKJ9OWtx5y
A/4nvp5bGRa3/5vkRYSnX3jJeEd27bN8wzXJL/qfnSrKBBQzcZdOMD3MEF/ooPpT
kuxDEN0xunilxE3G2fhw8hWBdFtZHXLSLeSbg3D42xjTu+8hg1C75DrhI3CSOhoA
5D3EdKq7r4gfGY1u5rOMem8p+IMAcID9svoj9rmMWQz9bwy4Zix/KKosUu3Lph/i
px2fSeiSLB5FNmS1QQ2qHhW46/vcfwZBzvu4PtEFD6mtqoQov92WdI4QFEpc0K/1
bO/qq29owEcVFJC8Eyr2moQSi1pCXozutiTLxouuMzYDsVWzG2nHC5x+ChUBeDzm
1tW8x5KMxsLzKOp5AgyJPvm61A/LyLRxL+yteU6c50nXJXRx0FRQ8HzRb9KfjZcU
0WiKBVOXfIqUi9t+Si3W
=Tpuu
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140305110723.GB24664>