kern/45854: vnode clean list corruption?

[martin%NetBSD.org@localhost]

>Number:         45854
>Category:       kern
>Synopsis:       vnode clean list corruption?
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 18 08:35:00 +0000 2012
>Originator:     Martin Husemann
>Release:        NetBSD 5.99.60
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD after-hours.aprisoft.de 5.99.60 NetBSD 5.99.60 (MODULAR) #97: 
Tue Jan 17 10:51:06 CET 2012 
martin%after-hours.aprisoft.de@localhost:/usr/src/sys/arch/sparc64/compile/MODULAR
 sparc64
Architecture: sparc64
Machine: sparc64
>Description:

I get a (more or less reproducable, but variying in details) crash during
vnode cleaning, seems the vnode is not quite correct:

trap type 0x10: cpu 0, pc=122d4ae4 npc=ffffffffdbff1708 pstate=0x820006<PRIV,IE>
kernel trap 10: illegal instruction                                            
Stopped in pid 0.9 (system) at  122d4ae4:       illtrap         11adcb64
db{0}> bt                                                               
vinvalbuf(12192a10, 1, ffffffffffffffff, 39d4000, 0, 0) at netbsd:vinvalbuf+0x58
                                                                               
vclean(12192a10, 8, 0, 0, 17b63c8, 17b6150) at netbsd:vclean+0x1f8
cleanvnode(17b6510, 17b6180, 1739f08, 1739f40, 17b6150, 1885000) at netbsd:clean
vnode+0x13c                                                                    
vdrain_thread(39d4000, 39d4000, 0, 1884b08, 7d, e0018000) at netbsd:vdrain_threa
d+0x90                                                                         
lwp_trampoline(f0059840, 19afaa0, 1124c8, 114400, 114000, 111ba8) at netbsd:lwp_
trampoline+0x8                                                                 
db{0}> show vnode 0x12192a10
OBJECT 0x12192a10: locked=0, pgops=0x172d898, npages=0, refs=-2147483647
                                                                        
VNODE flags 0x1010<MPSAFE,XLOCK>
mp 0x0 numoutput 0 size 0xffffffffffffffff writesize 0xffffffffffffffff
data 0x3baa900 writecount 0 holdcnt 0                                  
tag VT_MFS(3) type VBLK(3) mount 0x0 typedata 0xd4791c0
v_lock 0x12192b20                                      


In a previous instance I saw a bogus puffs vnode instead. This time I
modunload'ed puffs after the test runs. Not sure how VT_MFS
comes into play here, I only have ffs, nfs, ptyfs, procfs and kernfs in
use (but see below, during a test run various other things could have been
used).

>How-To-Repeat:

Not sure, seems to reliable happen over night if I leave the machine running
after doing a full atf test run.

>Fix:
n/a