NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/41937: ffs+log rmdir diagnostic kernel assertion

>Number:         41937
>Category:       kern
>Synopsis:       ffs+log rmdir diagnostic kernel assertion
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 25 16:35:01 +0000 2009
>Originator:     Nicolas Joly
>Release:        NetBSD 5.99.15
Institut Pasteur
System: NetBSD 5.99.15 NetBSD 5.99.15 (LANFEUST) #0: 
Tue Aug 25 13:16:28 CEST 2009
Architecture: x86_64
Machine: amd64
While running rmdir syscalls regression tests from Linux Testsuite Project
under compat linux emulation, i encountered a kernel diagnostic assertion
with rmdir(2) on ffs+log filesystem. And was then able to reproduce it natively
and later using rump :

panic: kernel diagnostic assertion "wl->wl_dealloccnt < wl->wl_dealloclim" 
failed: file "/local/src/NetBSD/src/sys/kern/vfs_wapbl.c", line 1672

njoly@lanfeust [rump/ffs]> cat ffs_rmdir.c

#include <rump/rump_syscalls.h>
#include <rump/rump.h>

#include <ufs/ufs/ufsmount.h>

#include <err.h>
#include <fcntl.h>
#include <pthread.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define IMAGE "image.ffs"
#define DEVICE "/dev/device.ffs"
#define MNTDIR "/mnt"
#define DIR1 MNTDIR "/rmdir.test"

static int quit = 0;

static void *func1(void *arg) {

  while (quit != 1)
    rump_sys_mkdir(DIR1, 0755);

  return NULL; }

static void *func2(void *arg) {

  while (quit != 1)

  return NULL; }

int main() {
  int res;
  pthread_t th1, th2;
  struct ufs_args args;

  res = system("newfs -F -s 10000 " IMAGE " >/dev/null");
  if (res == -1)
    err(1, "system failed");

  res = rump_init();
  if (res != 0)
    err(1, "rump_init failed");

  res = rump_etfs_register(DEVICE, IMAGE, RUMP_ETFS_BLK);
  if (res != 0)
    err(1, "rump_etfs_register failed");

  res = rump_sys_mkdir(MNTDIR, 0777);
  if (res != 0)
    err(1, "rump_sys_mkdir failed");

  memset(&args, 0x0, sizeof(args));
  args.fspec = DEVICE;

  res = rump_sys_mount(MOUNT_FFS, MNTDIR, MNT_LOG, &args, sizeof(args));
  if (res == -1)
    err(1, "rump_sys_mount failed");

  res = pthread_create(&th1, NULL, func1, NULL);
  if (res != 0)
    errx(1, "pthread_create failed");
  res = pthread_create(&th2, NULL, func2, NULL);
  if (res != 0)
    errx(1, "pthread_create failed");

  quit = 1;

  res = pthread_join(th2, NULL);
  if (res != 0)
    errx(1, "pthread_join failed");
  res = pthread_join(th1, NULL);
  if (res != 0)
    errx(1, "pthread_join failed");

  res = rump_sys_unmount(MNTDIR, 0);
  if (res == -1)
    err(1, "rump_sys_unmount failed");

  res = unlink(IMAGE);
  if (res == -1)
    err(1, "unlink failed");

  return 0; }

njoly@lanfeust [rump/ffs]> make ffs_rmdir
cc -g -O0 -Wall -Werror   -lrumpfs_ffs -lrumpvfs -o ffs_rmdir ffs_rmdir.c 
njoly@lanfeust [rump/ffs]> ./ffs_rmdir 
panic: kernel diagnostic assertion "wl->wl_dealloccnt < wl->wl_dealloclim" 
failed: file 
"/local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_wapbl.c", line 
zsh: abort (core dumped)  ./ffs_rmdir
njoly@lanfeust [rump/ffs]> gdb ffs_rmdir ffs_rmdir.core
GNU gdb 6.5
Core was generated by `ffs_rmdir'.
Program terminated with signal 6, Aborted.
#0  0x00007f7ffd7e0c0a in _lwp_kill () from /usr/lib/
(gdb) bt
#0  0x00007f7ffd7e0c0a in _lwp_kill () from /usr/lib/
#1  0x00007f7ffd7e057e in abort () at 
#2  0x00007f7ffd10404b in rumpuser_panic ()
#3  0x00007f7ffd53c833 in panic (
    fmt=0x7f7ffd55c1b8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d")
    at /local/src/NetBSD/src/lib/librump/../../sys/rump/../kern/subr_prf.c:296
#4  0x00007f7ffd5326bf in __kernassert (t=0x6 <Address 0x6 out of bounds>, 
    f=0x7f7ffd7e0c0a "r\001ÃH\213\r$x\022", l=1, e=0x0)
#5  0x00007f7ffda2128d in wapbl_register_deallocation (wl=0x7f7ffc6c0c80, 
blk=9440, len=512)
#6  0x00007f7ffdc1e20e in ffs_truncate (ovp=0x7f7ffaf0b070, length=0, 
ioflag=<value optimized out>, 
    cred=<value optimized out>)
#7  0x00007f7ffdc15a94 in ufs_rmdir (v=<value optimized out>)
#8  0x00007f7ffd5387be in VOP_RMDIR (dvp=0x7f7ffc6ad400, vp=0x6, cnp=<value 
optimized out>)
    at /local/src/NetBSD/src/lib/librump/../../sys/rump/../kern/vnode_if.c:1094
#9  0x00007f7ffda25923 in sys_rmdir (l=<value optimized out>, uap=<value 
optimized out>, 
    retval=<value optimized out>)
#10 0x00007f7ffd551ee8 in rump_sys_rmdir (path=<value optimized out>)
#11 0x0000000000400d27 in func2 (arg=0x0) at ffs_rmdir.c:33
#12 0x00007f7ffd30a812 in pthread__create_tramp (cookie=<value optimized out>)
    at /local/src/NetBSD/src/lib/libpthread/pthread.c:476
#13 0x00007f7ffd76e690 in ___lwp_park50 () from /usr/lib/
#14 0x00007f7ffb800000 in ?? ()
#15 0x0000000111110001 in ?? ()
#16 0x0000000033330003 in ?? ()
#17 0x0000000000000000 in ?? ()

Compile and run the provided testcase ...

Home | Main Index | Thread Index | Old Index