Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL

To: perseant%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost, Shinichi Doyashiki <clare%csel.org@localhost>
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL
From: "Shinichi Doyashiki via gnats" <gnats-admin%NetBSD.org@localhost>
Date: Tue, 8 Sep 2026 21:20:01 +0000 (UTC)
The following reply was made to PR kern/60504; it has been noted by GNATS.

From: Shinichi Doyashiki <clare%csel.org@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
 lfs_sp == NULL
Date: Wed, 09 Sep 2026 06:18:59 +0900

 >  > I bet this is just a matter of doing too much work in lfs with the
 >  > kernel lock held.  I think this is going to require ripping the
 >  > band-aid that is the kernel lock off lfs, which we need to do anyway
 >  > sooner or later.  Most of it is serialized by lfs_lock anyway.  Try
 >  > the attached patch?
 >  
 >  Using relatively recent kernel code and the your patch,
 >  I was able to successfully complete `cvs update` and `build.sh`
 >  within a working directory on LFS.
 >  
 >  At the moment, I am testing using the userland cleaner daemon.
 
 When I tried build.sh again, a deadlock was observed.
 
 db{0}> show proc /a ffff9022a8487800
 lwp_t ffff9022a8487800
 find: pid 17999 proc ffff902040e570c0 vmspace/map ffff9025b8930200 flags 4000
   lwp 17999 ffff9022a8487800 pcb ffffb989853db000
     stat 3 flags 0 cpu 2 pri 37 ref 0
     wmesg prelockcv wchan ffff902307c66228
 db{0}> bt /a ffff9022a8487800
 trace: pid 17999 lid 17999 at 0xffffb989853dfd30
 sleepq_block() at netbsd:sleepq_block+0xea
 cv_wait() at netbsd:cv_wait+0xca
 lfs_prelock() at netbsd:lfs_prelock+0x51
 lfs_itimes() at netbsd:lfs_itimes+0x3c9
 lfs_close() at netbsd:lfs_close+0x81
 VOP_CLOSE() at netbsd:VOP_CLOSE+0x40
 vn_close() at netbsd:vn_close+0x34
 closef() at netbsd:closef+0xa1
 fd_close() at netbsd:fd_close+0xf3
 sys_close() at netbsd:sys_close+0x22
 syscall() at netbsd:syscall+0x9d
 --- syscall (number 6) ---
 netbsd:syscall+0x9d:
 
 db{0}> show proc /a ffff902178766000
 lwp_t ffff902178766000
 system: pid 0 proc ffffffff81465040 vmspace/map ffffffff8155a2e0 flags 20002
   lwp 169 [ioflush] ffff902178766000 pcb ffffb98946d5f000
     stat 3 flags 240 cpu 1 pri 124 ref 0
     wmesg prelockcv wchan ffff902307c66228
   lwp 168 [pgdaemon] ffff9021783c0000 pcb ffffb98946b39000
     stat 3 flags 200 cpu 0 pri 126 ref 0
     wmesg pgdaemon wchan ffffffff814f5b68
   lwp 165 [swwreboot] ffff902178439c00 pcb ffffb98946b87000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg swwreboot wchan ffff902178347988
   lwp 162 [npfgc0] ffff9021783c0800 pcb ffffb98946b40000
     stat 3 flags 200 cpu 1 pri 96 ref 0
     wmesg npfgcw wchan ffff902178286b88
   lwp 161 [rt_free] ffff902178561800 pcb ffffb98946c28000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg rt_free wchan ffff9021784abdc8
   lwp 160 [unpgc] ffff902178561400 pcb ffffb98946c21000
     stat 3 flags 200 cpu 0 pri 96 ref 0
     wmesg unpgc wchan ffffffff81566450
   lwp 95 [key_timehandler] ffff902178561000 pcb ffffb98946c1a000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg key_timehandler wchan ffff9021784abc88
   lwp 222 [icmp6_wqinput/3] ffff9021783c5c00 pcb ffffb98946c13000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg icmp6_wqinput wchan ffff90217761b708
   lwp 221 [icmp6_wqinput/2] ffff9021783c5800 pcb ffffb98946c0c000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg icmp6_wqinput wchan ffff90217761b6c8
   lwp 220 [icmp6_wqinput/1] ffff9021783c5400 pcb ffffb98946c05000
     stat 3 flags 200 cpu 1 pri 222 ref 0
     wmesg icmp6_wqinput wchan ffff90217761b688
   lwp 219 [icmp6_wqinput/0] ffff9021783c5000 pcb ffffb98946bfe000
     stat 3 flags 200 cpu 0 pri 222 ref 0
     wmesg icmp6_wqinput wchan ffff90217761b648
   lwp 218 [nd6_timer] ffff902178629c00 pcb ffffb98946bf7000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg nd6_timer wchan ffff9021784abb48
   lwp 217 [carp6_wqinput/3] ffff902178629800 pcb ffffb98946bf0000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg carp6_wqinput wchan ffff90217761b308
   lwp 216 [carp6_wqinput/2] ffff902178629400 pcb ffffb98946be9000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg carp6_wqinput wchan ffff90217761b2c8
   lwp 215 [carp6_wqinput/1] ffff902178629000 pcb ffffb98946be2000
     stat 3 flags 200 cpu 1 pri 222 ref 0
     wmesg carp6_wqinput wchan ffff90217761b288
   lwp 214 [carp6_wqinput/0] ffff9021784cdc00 pcb ffffb98946bdb000
     stat 3 flags 200 cpu 0 pri 222 ref 0
     wmesg carp6_wqinput wchan ffff90217761b248
   lwp 213 [carp_wqinput/3] ffff9021784cd800 pcb ffffb98946bd4000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg carp_wqinput wchan ffff902178482f08
   lwp 212 [carp_wqinput/2] ffff9021784cd400 pcb ffffb98946bcd000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg carp_wqinput wchan ffff902178482ec8
   lwp 211 [carp_wqinput/1] ffff9021784cd000 pcb ffffb98946bc6000
     stat 3 flags 200 cpu 1 pri 222 ref 0
     wmesg carp_wqinput wchan ffff902178482e88
   lwp 210 [carp_wqinput/0] ffff902178531c00 pcb ffffb98946bbf000
     stat 3 flags 200 cpu 0 pri 222 ref 0
     wmesg carp_wqinput wchan ffff902178482e48
   lwp 209 [icmp_wqinput/3] ffff902178531800 pcb ffffb98946bb8000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg icmp_wqinput wchan ffff902178482b08
   lwp 208 [icmp_wqinput/2] ffff902178531400 pcb ffffb98946bb1000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg icmp_wqinput wchan ffff902178482ac8
   lwp 207 [icmp_wqinput/1] ffff902178531000 pcb ffffb98946baa000
     stat 3 flags 200 cpu 1 pri 222 ref 0
     wmesg icmp_wqinput wchan ffff902178482a88
   lwp 206 [icmp_wqinput/0] ffff9021784d5c00 pcb ffffb98946ba3000
     stat 3 flags 200 cpu 0 pri 222 ref 0
     wmesg icmp_wqinput wchan ffff902178482a48
   lwp 205 [rt_timer] ffff9021784d5800 pcb ffffb98946b95000
     stat 3 flags 200 cpu 2 pri 43 ref 0
     wmesg rt_timer wchan ffff9021784aba08
   lwp 204 [vmem_rehash] ffff9021784d5400 pcb ffffb98946b9c000
     stat 3 flags 200 cpu 0 pri 125 ref 0
     wmesg vmem_rehash wchan ffff9021784ab8c8
   lwp 198 [usb0] ffff902178439800 pcb ffffb98946b80000
     stat 3 flags 200 cpu 1 pri 96 ref 0
     wmesg usbevt wchan ffff90217831d4c0
   lwp 197 [usb1] ffff902178439400 pcb ffffb98946b79000
     stat 3 flags 200 cpu 1 pri 96 ref 0
     wmesg usbevt wchan ffff90217831d978
   lwp 196 [coretemp3] ffff902178439000 pcb ffffb98946b72000
     stat 3 flags 200 cpu 2 pri 43 ref 0
     wmesg coretemp3 wchan ffff9021784ab508
   lwp 195 [coretemp2] ffff90217849dc00 pcb ffffb98946b6b000
     stat 3 flags 200 cpu 3 pri 43 ref 0
     wmesg coretemp2 wchan ffff9021784ab148
   lwp 194 [coretemp1] ffff90217849d800 pcb ffffb98946b64000
     stat 3 flags 200 cpu 2 pri 43 ref 0
     wmesg coretemp1 wchan ffff90217836fec8
   lwp 193 [coretemp0] ffff90217849d400 pcb ffffb98946b5d000
     stat 3 flags 200 cpu 3 pri 43 ref 0
     wmesg coretemp0 wchan ffff90217836fd88
   lwp 192 [acpitz0] ffff90217849d000 pcb ffffb98946b56000
     stat 3 flags 200 cpu 2 pri 43 ref 0
     wmesg acpitz0 wchan ffff90217836fc48
   lwp 122 [entbutler] ffff902177cb2c00 pcb ffffb98936b30000
     stat 3 flags 200 cpu 1 pri 43 ref 0
     wmesg entropy wchan ffffffff8148d630
   lwp 121 [usbtask-dr] ffff902177cb2800 pcb ffffb98936b29000
     stat 3 flags 200 cpu 0 pri 96 ref 0
     wmesg usbtsk wchan ffffffff814b2e58
   lwp 120 [usbtask-hc] ffff902177cb2400 pcb ffffb98936b22000
     stat 3 flags 200 cpu 2 pri 96 ref 0
     wmesg usbtsk wchan ffffffff814b2e18
   lwp 119 [wm0Reset] ffff902177cb2000 pcb ffffb98936aeb000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg wm0Reset wchan ffff9021773d0ac8
   lwp 118 [wm0TxRx/3] ffff902177cd6c00 pcb ffffb98936ae4000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg wm0TxRx wchan ffff9028afa90908
   lwp 117 [wm0TxRx/2] ffff902177cd6800 pcb ffffb98936add000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg wm0TxRx wchan ffff9028afa908c8
   lwp 116 [wm0TxRx/1] ffff902177cd6400 pcb ffffb98936ad6000
     stat 3 flags 200 cpu 1 pri 222 ref 0
     wmesg wm0TxRx wchan ffff9028afa90888
   lwp 115 [wm0TxRx/0] ffff902177cd6000 pcb ffffb98936acf000
     stat 3 flags 200 cpu 0 pri 222 ref 0
     wmesg wm0TxRx wchan ffff9028afa90848
   lwp 114 [igc0_tx_rx/3] ffff902177b76c00 pcb ffffb98936a84000
     stat 3 flags 200 cpu 3 pri 222 ref 0
     wmesg igc0_tx_rx wchan ffff9028afa90708
   lwp 113 [igc0_tx_rx/2] ffff902177b76800 pcb ffffb98936a7d000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg igc0_tx_rx wchan ffff9028afa906c8
   lwp 112 [igc0_tx_rx/1] ffff902177b76400 pcb ffffb98936a76000
     stat 3 flags 200 cpu 1 pri 222 ref 0
     wmesg igc0_tx_rx wchan ffff9028afa90688
   lwp 111 [igc0_tx_rx/0] ffff902177b76000 pcb ffffb98936a6f000
     stat 3 flags 200 cpu 0 pri 222 ref 0
     wmesg igc0_tx_rx wchan ffff9028afa90648
   lwp 110 [atabus1] ffff9021772b7c00 pcb ffffb98936946000
     stat 3 flags 200 cpu 3 pri 96 ref 0
     wmesg atath wchan ffffb98042f3cbe0
   lwp 109 [atabus0] ffff9021772b7800 pcb ffffb9893693b000
     stat 3 flags 240 cpu 2 pri 96 ref 0
     wmesg atath wchan ffffb98042f3c3f0
   lwp 107 [xcall/3] ffff9021772b7000 pcb ffffb989364f0000
     stat 3 flags 200 cpu 3 pri 127 ref 0
     wmesg xcall wchan ffffb989364bc010
   lwp 106 [softser/3] ffff9021772dbc00 pcb ffffb989364e9000
     stat 1 flags 200 cpu 3 pri 223 ref 0
   lwp 105 [softclk/3] ffff9021772db800 pcb ffffb989364e2000
     stat 1 flags 200 cpu 3 pri 220 ref 0
   lwp 104 [softbio/3] ffff9021772db400 pcb ffffb989364db000
     stat 1 flags 200 cpu 3 pri 221 ref 0
   lwp 103 [softnet/3] ffff9021772db000 pcb ffffb989364d4000
     stat 1 flags 200 cpu 3 pri 222 ref 0
 > lwp 102 [idle/3] ffff90217722cc00 pcb ffffb989364c5000
     stat 1 flags 201 cpu 3 pri 0 ref 0
   lwp 101 [xcall/2] ffff90217722c800 pcb ffffb989364b3000
     stat 3 flags 200 cpu 2 pri 127 ref 0
     wmesg xcall wchan ffffb9893647f010
   lwp 100 [softser/2] ffff90217722c400 pcb ffffb989364ac000
     stat 1 flags 200 cpu 2 pri 223 ref 0
   lwp 99 [softclk/2] ffff90217722c000 pcb ffffb989364a5000
     stat 1 flags 200 cpu 2 pri 220 ref 0
   lwp 98 [softbio/2] ffff90217717bc00 pcb ffffb9893649e000
     stat 1 flags 200 cpu 2 pri 221 ref 0
   lwp 97 [softnet/2] ffff90217717b800 pcb ffffb98936497000
     stat 1 flags 200 cpu 2 pri 222 ref 0
 > lwp 96 [idle/2] ffff90217717b400 pcb ffffb98936488000
     stat 1 flags 201 cpu 2 pri 0 ref 0
   lwp 30 [xcall/1] ffff90217717b000 pcb ffffb98936474000
     stat 3 flags 200 cpu 1 pri 127 ref 0
     wmesg xcall wchan ffffb98935da0010
   lwp 29 [softser/1] ffff90217715fc00 pcb ffffb9893646d000
     stat 1 flags 200 cpu 1 pri 223 ref 0
   lwp 28 [softclk/1] ffff90217715f800 pcb ffffb98936466000
     stat 1 flags 200 cpu 1 pri 220 ref 0
   lwp 27 [softbio/1] ffff90217715f400 pcb ffffb9893645f000
     stat 1 flags 200 cpu 1 pri 221 ref 0
   lwp 26 [softnet/1] ffff90217715f000 pcb ffffb98936458000
     stat 1 flags 200 cpu 1 pri 222 ref 0
 > lwp 25 [idle/1] ffff9028afa4ec00 pcb ffffb98935da9000
     stat 1 flags 201 cpu 1 pri 0 ref 0
   lwp 24 [lnxsyswq] ffff9028afa4e800 pcb ffffb989363d2000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg lnxsyswq wchan ffff9028b4b81e08
   lwp 23 [lnxubdwq] ffff9028afa4e400 pcb ffffb989363cb000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg lnxubdwq wchan ffff9028b4b81d08
   lwp 22 [lnxpwrwq] ffff9028afa4e000 pcb ffffb989363c4000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg lnxpwrwq wchan ffff9028b4b81c08
   lwp 21 [lnxlngwq] ffff9028afa77c00 pcb ffffb989363bd000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg lnxlngwq wchan ffff9028b4b81b08
   lwp 20 [lnxhipwq] ffff9028afa77800 pcb ffffb989363b6000
     stat 3 flags 200 cpu 2 pri 43 ref 0
     wmesg lnxhipwq wchan ffff9028b4b81a08
   lwp 19 [lnxrcugc] ffff9028afa77400 pcb ffffb989363af000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg lnxrcugc wchan ffffffff8148bb08
   lwp 18 [sysmon] ffff9028afa77000 pcb ffffb989363a8000
     stat 3 flags 200 cpu 1 pri 96 ref 0
     wmesg smtaskq wchan ffffffff814d3ff0
   lwp 17 [pmfsuspend] ffff9028afa91c00 pcb ffffb989363a1000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg pmfsuspend wchan ffff9028b3b34948
   lwp 16 [pmfevent] ffff9028afa91800 pcb ffffb9893639a000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg pmfevent wchan ffff9028b3b34808
   lwp 15 [sopendfree] ffff9028afa91400 pcb ffffb98936393000
     stat 3 flags 200 cpu 0 pri 96 ref 0
     wmesg sopendfr wchan ffffffff815663d0
   lwp 14 [ifwdog] ffff9028afa91000 pcb ffffb9893638c000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg ifwdog wchan ffff9028b3b346c8
   lwp 13 [iflnkst] ffff9028b0ab7c00 pcb ffffb98936385000
     stat 3 flags 200 cpu 2 pri 222 ref 0
     wmesg iflnkst wchan ffff9028b3b34588
   lwp 12 [lfsswq] ffff9028b0ab7800 pcb ffffb9893637e000
     stat 3 flags 200 cpu 1 pri 123 ref 0
     wmesg lfsswq wchan ffff9028b3b34448
   lwp 11 [lfscwq] ffff9028b0ab7400 pcb ffffb98936377000
     stat 3 flags 200 cpu 0 pri 123 ref 0
     wmesg lfscwq wchan ffff9028b3b34308
   lwp 10 [nfssilly] ffff9028b0ab7000 pcb ffffb98936370000
     stat 3 flags 200 cpu 0 pri 43 ref 0
     wmesg nfssilly wchan ffff9028b3b341c8
   lwp 9 [pooldisp] ffff9028b3ae9c00 pcb ffffb98936369000
     stat 3 flags 200 cpu 2 pri 43 ref 0
     wmesg pooldisp wchan ffff9028b4b81728
   lwp 8 [modunload] ffff9028b3ae9800 pcb ffffb98936362000
     stat 3 flags 200 cpu 0 pri 125 ref 0
     wmesg mod_unld wchan ffffffff815593b0
   lwp 7 [xcall/0] ffff9028b3ae9400 pcb ffffb9893635b000
     stat 3 flags 200 cpu 0 pri 127 ref 0
     wmesg xcall wchan ffffffff8143cf10
   lwp 6 [softser/0] ffff9028b3ae9000 pcb ffffb98936354000
     stat 1 flags 200 cpu 0 pri 223 ref 0
   lwp 5 [softclk/0] ffff9028b3b21c00 pcb ffffb9893634d000
     stat 1 flags 200 cpu 0 pri 220 ref 0
   lwp 4 [softbio/0] ffff9028b3b21800 pcb ffffb98936346000
     stat 1 flags 200 cpu 0 pri 221 ref 0
   lwp 3 [softnet/0] ffff9028b3b21400 pcb ffffb9893633f000
     stat 1 flags 200 cpu 0 pri 222 ref 0
 > lwp 2 [idle/0] ffff9028b3b21000 pcb ffffb98936330000
     stat 1 flags 201 cpu 0 pri 0 ref 0
   lwp 0 [swapper] ffffffff814648c0 pcb ffffffff818a3000
     stat 3 flags 200 cpu 3 pri 125 ref 0
     wmesg uvm wchan ffffffff814648c0
 db{0}> bt /a ffff902178766000
 trace: pid 0 lid 169 at 0xffffb98946d63e30
 sleepq_block() at netbsd:sleepq_block+0xea
 cv_wait() at netbsd:cv_wait+0xca
 lfs_prelock() at netbsd:lfs_prelock+0x51
 lfs_seglock() at netbsd:lfs_seglock+0x16
 lfs_segwrite() at netbsd:lfs_segwrite+0x71
 lfs_sync() at netbsd:lfs_sync+0xc6
 VFS_SYNC() at netbsd:VFS_SYNC+0x22
 sched_sync() at netbsd:sched_sync+0xd6
 
 db{0}> show proc /a ffff90217fe78800
 lwp_t ffff90217fe78800
 lfs_cleanerd: pid 6449 proc ffff90218cd25840 vmspace/map ffff90217b132740 flags 
 0
   lwp 6449 ffff90217fe78800 pcb ffffb98946df7000
     stat 3 flags 180 cpu 2 pri 43 ref 0
     wmesg segment wchan ffffffff814f3840
 db{0}> bt /a ffff90217fe78800
 trace: pid 6449 lid 6449 at 0xffffb98946dfbd00
 sleepq_block() at netbsd:sleepq_block+0x233
 cv_timedwait_sig() at netbsd:cv_timedwait_sig+0xda
 lfs_segwait() at netbsd:lfs_segwait+0x5c
 lfs_fcntl() at netbsd:lfs_fcntl+0x76c
 VOP_FCNTL() at netbsd:VOP_FCNTL+0x46
 sys_fcntl() at netbsd:sys_fcntl+0x461
 syscall() at netbsd:syscall+0x9d
 --- syscall (number 92) ---
 netbsd:syscall+0x9d:
 
 db{0}> show proc /a ffff90204263b400
 lwp_t ffff90204263b400
 nbinstallboot: pid 9544 proc ffff90263e24f500 vmspace/map ffff90249bdce580 flags
  4000
   lwp 9544 ffff90204263b400 pcb ffffb989470f4000
     stat 3 flags 0 cpu 2 pri 31 ref 0
     wmesg seg_iocount wchan ffff9024d483c0dc
 db{0}> bt /a ffff90204263b400
 trace: pid 9544 lid 9544 at 0xffffb989470f8c40
 sleepq_block() at netbsd:sleepq_block+0xea
 mtsleep() at netbsd:mtsleep+0x11f
 lfs_segunlock() at netbsd:lfs_segunlock+0x1d9
 lfs_segwrite() at netbsd:lfs_segwrite+0x531
 lfs_flush_fs() at netbsd:lfs_flush_fs+0x7c
 lfs_putpages() at netbsd:lfs_putpages+0x36d
 VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x43
 lfs_fsync() at netbsd:lfs_fsync+0xf4
 VOP_FSYNC() at netbsd:VOP_FSYNC+0x47
 sys_fsync() at netbsd:sys_fsync+0x5f
 syscall() at netbsd:syscall+0x9d
 --- syscall (number 95) ---
 netbsd:syscall+0x9d:
Prev by Date: NetBSD Nightly Trouble Ticket Report
Next by Date: port-mvme68k/60699: MVME177 tape boot fails with direct MVMEPROM_DSKRD, succeeds with hackprom_diskrd
Previous by Thread: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL
Next by Thread: PR/57638 CVS commit: src/external/gpl3/gcc/dist/gcc/config/arm
Indexes:
Home | Main Index | Thread Index | Old Index