Re: Panic: vrelel: bad ref count (9.99.54)

[Yorick Hardy <yorickhardy%gmail.com@localhost>]

Dear Andrew and Leonardo,

On 2020-11-19, Yorick Hardy wrote:
> Dear Andrew,
> 
> On 2020-05-05, Andrew Doran wrote:
> > On Mon, May 04, 2020 at 03:54:57PM +0200, Leonardo Taccari wrote:
> > > Hello Yorick and Andrew,
> > > 
> > > Yorick Hardy writes:
> > > > > > > [...]
> > > > > > > 
> > > > > > >   Crash version 9.99.55, image version 9.99.55.
> > > > > > >   crash: _kvm_kvatop(0)
> > > > > > >   Kernel compiled without options LOCKDEBUG.
> > > > > > >   System panicked: vrelel: bad ref count
> > > > > > >   Backtrace from time of crash is available.
> > > > > > >   crash> bt
> > > > > > >   _KERNEL_OPT_NAGR() at 0
> > > > > > >   ?() at 7f7ff7ecf000
> > > > > > >   sys_reboot() at sys_reboot
> > > > > > >   vpanic() at vpanic+0x181
> > > > > > >   vtryrele() at vtryrele
> > > > > > >   vcache_dealloc() at vcache_dealloc
> > > > > > >   uvm_unmap_detach() at uvm_unmap_detach+0x76
> > > > > > >   uvm_unmap1() at uvm_unmap1+0x4e
> > > > > > >   uvm_mremap() at uvm_mremap+0x36b
> > > > > > >   sys_mremap() at sys_mremap+0x68
> > > > > > >   syscall() at syscall+0x227
> > > > > > >   --- syscall (number 411) ---
> > > > > > >   797459842e9a:
> > > > > > >   crash>

[ rest of thread omitted ]

I think that uvm_mremap did not keep pace with changes in uvm.
This patch seems to fix it for me, although I have only tested
for two days so far (I am usually able to trigger the panic by
now ... but lets see).

Leonardo, would you be willing to try the patch?

-- 
Kind regards,

Yorick Hardy

Index: sys/uvm/uvm_mremap.c
===================================================================
RCS file: /cvsroot/src/sys/uvm/uvm_mremap.c,v
retrieving revision 1.20
diff -u -r1.20 uvm_mremap.c
--- sys/uvm/uvm_mremap.c	23 Feb 2020 15:46:43 -0000	1.20
+++ sys/uvm/uvm_mremap.c	26 Nov 2020 19:14:06 -0000
@@ -80,10 +80,8 @@
 			error = E2BIG; /* XXX */
 			goto done;
 		}
-		rw_enter(uobj->vmobjlock, RW_WRITER);
-		KASSERT(uobj->uo_refs > 0);
-		atomic_inc_uint(&uobj->uo_refs);
-		rw_exit(uobj->vmobjlock);
+		if (uobj->pgops->pgo_reference)
+			uobj->pgops->pgo_reference(uobj);
 		reserved_entry->object.uvm_obj = uobj;
 		reserved_entry->offset = newoffset;
 	}