On Sat Aug 04 2007 at 20:06:09 -0700, Jeff Rizzo wrote:
> I've gotten this twice today while building the world, on a kernel I
> built from 2h old sources.  Should I file a PR, and/or is there any
> other info I can gather?
> 
> In case it matters, userland is circa 4.99.2, and this is an AMD64
> kernel with DIAGNOSTIC, DEBUG and LOCKDEBUG...
> 
> +j
> 
> panic: kernel diagnostic assertion
> "_simple_lock_held((&obj->vmobjlock))" failed: file
> "/usr/src/sys/uvm/uvm_page.c", line 1651
> Stopped in pid 17875.1 (sh) at netbsd:cpu_Debugger+0x5:   leave
> db{1}>bt
> cpu_Debugger() at netbsd:cpu_Debugger+0x5
> panic() at netbsd:panic+0x1fc
> __assert() at netbsd:__assert+0x2d
> uvm_pagelookup() at netbsd:uvm_pagelookup+0xef
> uao_dropswap_range1() at netbsd:uao_dropswap_range1+0x11c
> uao_detach_locked() at netbsd:uao_detach_locked+0x14b
> tmpfs_free_node() at netbsd:tmpfs_free_node+0xfb

(the trace is missing a few stackframes)

Hmm, looks like uao_free() drops the object lock before calling
dropswap().  But the comment on dropswap() says it should be called with
the object locked.  So I'm guessing this should do the trick.  yamt?

Index: uvm_aobj.c
===================================================================
RCS file: /cvsroot/src/sys/uvm/uvm_aobj.c,v
retrieving revision 1.92
diff -p -u -r1.92 uvm_aobj.c
--- uvm_aobj.c	24 Jul 2007 19:59:35 -0000	1.92
+++ uvm_aobj.c	5 Aug 2007 09:35:45 -0000
@@ -400,8 +400,6 @@ uao_free(struct uvm_aobj *aobj)
 {
 	int swpgonlydelta = 0;
 
-	simple_unlock(&aobj->u_obj.vmobjlock);
-
 #if defined(VMSWAP)
 	uao_dropswap_range1(aobj, 0, 0);
 
@@ -422,6 +420,8 @@ uao_free(struct uvm_aobj *aobj)
 	}
 #endif /* defined(VMSWAP) */
 
+	simple_unlock(&aobj->u_obj.vmobjlock);
+
 	/*
 	 * finally free the aobj itself
 	 */

-- 
Antti Kantee <pooka@iki.fi>                     Of course he runs NetBSD
http://www.iki.fi/pooka/                          http://www.NetBSD.org/
    "la qualité la plus indispensable du cuisinier est l'exactitude"