>Number:         4243
>Category:       kern
>Synopsis:       panic: locking against myself
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct  8 12:20:01 1997
>Last-Modified:
>Originator:     
>Organization:
-----------------------------------------------------------------
Andrew Gillham                            | This space left blank
gillham@whirlpool.com                     | inadvertently.
I speak for myself, not for my employer.  | Contact the publisher.
>Release:        October 7, 1997
>Environment:

NetBSD 1.2G (SHADOW) #0: Fri Oct  3 11:39:56 EDT 1997
    root@shadow:/usr/src/sys/arch/i386/compile/SHADOW
cpu0: family 6 model 1 step 7
cpu0: Intel Pentium Pro (686-class)
real mem  = 66711552
avail mem = 52432896
using 1388 buffers containing 11370496 bytes of memory
mainbus0 (root)
pci0 at mainbus0 bus 0: configuration mode 1
pchb0 at pci0 dev 0 function 0
pchb0: Intel 82441FX PCI and Memory Controller (PMC) (rev. 0x02)
pcib0 at pci0 dev 7 function 0
pcib0: Intel 82371SB PCI-to-ISA Bridge (PIIX3) (rev. 0x01)
Intel 82371SB IDE Interface (PIIX3) (IDE mass storage, interface 0x80) at pci0 dev 7 function 1 not configured
bha0 at pci0 dev 11 function 0: BusLogic 9xxC SCSI
bha0: interrupting at irq 10
bha0: model BT-956C, firmware 4.28A
bha0: sync, parity
bha0 targ 0: sync, offset 14, period 100nsec
scsibus0 at bha0: 16 targets
sd0 at scsibus0 targ 0 lun 0: <MICROP, 3243-19MZ  Q4D, HT02> SCSI2 0/direct fixed
sd0: 4095MB, 3956 cyl, 19 head, 111 sec, 512 bytes/sect x 8388315 sectors
sd1 at scsibus0 targ 5 lun 0: <IOMEGA, ZIP 100, C.19> SCSI2 0/direct removable
sd1: drive offline
de0 at pci0 dev 15 function 0 at irq 9
de0: SMC 9332DST 21140 [10-100Mb/s] pass 1.1
de0: address 00:00:c0:00:53:bf
de0: enabling 100baseTX port
S3 86C968-0 ("Vision968") (VGA display) at pci0 dev 17 function 0 not configured
isa0 at pcib0
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com0: console
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
lpt0 at isa0 port 0x378-0x37b irq 7
wdc0 at isa0 port 0x1f0-0x1f7 irq 14
atapibus0 at wdc0
wd0 at wdc0 drive 0: <WDC AC32500H>
wd0: 2441MB, 4960 cyl, 16 head, 63 sec, 512 bytes/sec
wd0: using 16-sector 16-bit pio transfers, lba addressing
wdc1 at isa0 port 0x170-0x177 irq 15
atapibus1 at wdc1
cd0 at atapibus1 drive 0: <NEC                 CD-ROM DRIVE:282, , 3.04> type 5 cdrom removable
npx0 at isa0 port 0xf0-0xff: using exception 16
vt0 at isa0 port 0x60-0x6f irq 1
vt0: unknown s3, 80 col, color, 8 scr, mf2-kbd, [R3.32]
pms0 at vt0 irq 12
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
fd0 at fdc0 drive 0: 1.44MB, 80 cyl, 2 head, 18 sec
isapnp0 at isa0 port 0x279: read port 0x203
sb0 at isapnp0 port 0x220/16,0x330/2,0x388/4 irq 5 drq 1,5
sb0: Creative SB AWE32 PnP Audio: dsp v4.13
isapnp0: <Creative SB AWE32 PnP, PNPFFFF, , Reserved> port 0x100/1 not configured
isapnp0: <Creative SB AWE32 PnP, CTL0021, , WaveTable> port 0x620/4 not configured
joy0 at isapnp0 port 0x200/8
joy0: Creative SB AWE32 PnP Game
joy0: joystick not connected
isapnp0: <Creative SB AWE32 PnP, CTL0051, , StereoEnhance> port 0x100/1 not configured
biomask c440 netmask c640 ttymask d6c2
findroot: can't open dev sd1a (5)
wd0: no disk label
findroot: can't open dev wd0a (6)
boot device: sd0
root device (default sd0a): 
dump device (default sd0b): 
file system (default ffs): 
root on sd0a dumps on sd0b

>Description:
	My machine panics when I run iozone against a vnd based
	file-system.  It is a 64MB file in /usr, with the following
	label:

image|disk image: \
	:ty=winchester:dt=SCSI:se#512:nt#32:ns#64:nc#64:rm#3600:\
	:pc#131072:oc#0: \
	:pe#131072:oe#0:be#4096:fe#512:te=4.2BSD:

	The panic and output of the 'trace' ddb command are:

panic: locking against myself
Stopped at      _Debugger+0x4:  leave
db> trace
_Debugger(f8877100,ff203a58,f819f0da,f819f036,40) at _Debugger+0x4
_panic(f819f036,40,4,f819f078,ff203ae0) at _panic+0x46
_ufs_lock(ff203ad8) at _ufs_lock+0x62
_vndstrategy(f8df9bd8,ff203b24,f819f327,ff203b40,f886d800) at _vndstrategy+0x1a
7
_spec_strategy(ff203b40,f886d800,f8df9bd8,0,ff203b3c) at _spec_strategy+0x1d
_ufs_strategy(ff203b40) at _ufs_strategy+0xcb
_bwrite(f8df9bd8,ff203b68,f81369d4,ff203b60,f81fa368) at _bwrite+0xd6
_vn_bwrite(ff203b60,f81fa368,f8df9bd8,ff203b7c,f8137065) at _vn_bwrite+0xe
_bawrite(f8df9bd8) at _bawrite+0x30
_getnewbuf(0,0,f8ddce50,ffffeff4,1613) at _getnewbuf+0xf5
_getblk(f8876780,ffffeff4,2000,0,0) at _getblk+0x109
_ufs_bmaparray(f8876780,1613,ff203ca8,0,0) at _ufs_bmaparray+0x1c9
_ufs_bmap(ff203c8c,f886d800,f8df90e0,0,1000) at _ufs_bmap+0x34
_vndstrategy(f8df90e0,ff203ce8,f81368be,ff203ce0,f8df90e0) at _vndstrategy+0x1f
5
_spec_strategy(ff203ce0) at _spec_strategy+0x1d
_bwrite(f8df90e0,ff203d08,f81369d4,ff203d00,f81fa368) at _bwrite+0xd6
_vn_bwrite(ff203d00,f81fa368,f8df90e0,ff203d1c,f8137065) at _vn_bwrite+0xe
_bawrite(f8df90e0) at _bawrite+0x30
_getnewbuf(0,0,2c68,f8871000,f8871000) at _getnewbuf+0xf5
_getblk(f8889780,18e1,1000,0,0) at _getblk+0x109
_ffs_balloc(f8883000,18e1,200,f87c4280,ff203eb0) at _ffs_balloc+0x71b
_ffs_write(ff203ed8,200,ff203f88,f886d800,1) at _ffs_write+0x25f
_vn_write(f8882200,ff203f20,f87c4280) at _vn_write+0xcf
_sys_write(f886d800,ff203f88,ff203f80,0,19000) at _sys_write+0xa4
_syscall() at _syscall+0x238
--- syscall (number 4) ---
0x4006debb:
db>

>How-To-Repeat:
	On my system:
	dd if=/dev/zero of=/usr/testimage bs=16k count=4k
	vnconfig -c /dev/vnd0d /usr/testimage
	disklabel -w -r vnd0 image
	newfs /dev/vnd0e
	mount /dev/vnd0e /mnt
	cd /mnt
	iozone 50

	This sequence does not fail on a Pentium 133 with an Adaptec
	2940UW + Micropolis 3243W. 

	This sequence (with vnd0c not vnd0d) on a SS10 with a Sun1G
	stalls the machine.  By stalls, I mean it is still pingable,
	but new processes can't start.  It acts like it is out of swap.
	It also does this with 'iozone 20', and the machine has 32MB
	with 64MB of swap.

>Fix:
	Unfortunately I don't have one.
>Audit-Trail:
>Unformatted: