kern/37926: lockpanic working with union fs

[dlagno%rambler.ru@localhost]

>Number:         37926
>Category:       kern
>Synopsis:       lockpanic working with union fs
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 30 21:00:00 +0000 2008
>Originator:     Denis Lagno
>Release:        4.99.50
>Organization:
>Environment:
NetBSD flam.gado 4.99.50 NetBSD 4.99.50 (FLAM) #1: Sun Jan 27 22:30:25 MSK 2008 
 
dina%flam.gado@localhost:/volatile/worksrc/netbsd-current/obj/sys/arch/i386/compile/FLAM
 i386

2 processors
>Description:
During operations on fs mounted with mount_union kernel sometimes panics.

like this:

panic: lockmgr: pid 5285.1, not exclusive lock holder 1075.1 unlocking (type 
*0* flags 400, sharecount 0, exclusivecount 1, recurselevel 0, waitcount 0, 
wmesg vnlock, lock_addr 0x0, unlock_addr 0x0)

Stopped in pid 5285.1 (sh) at   netbsd:breakpoint+0x4:  popl    %ebp
db{1}> bt
breakpoint(c09fa12c,cdbb5958,cdbb594c,30303402,c09ac400) at 
netbsd:breakpoint+0x4
panic(c09ac328,cdbb5a26,c09ac531,cdbb5990,0) at netbsd:panic+0x155
lockpanic(ce59c0bc,c09ac4ac,14a5,1,433) at netbsd:lockpanic+0xcd
lockmgr(ce59c0bc,6,ce59c030,ce59c030,cdbb5bac) at netbsd:lockmgr+0x27e
ffs_unlock(cdbb5b5c,cdbb5c70,cdbb5bdc,c04f8baa,d3dbea2c) at 
netbsd:ffs_unlock+0x40
VOP_UNLOCK(ce59c030,0,2ce5f7,d3dbea2c,d3dbea2c) at netbsd:VOP_UNLOCK+0x7f
union_unlock(cdbb5bac,cdd01040,2d5d0e08,476eec6f,2d5d0e08) at 
netbsd:union_unlock+0x66
VOP_UNLOCK(d3dbea2c,0,eeebc7c6,cdbb5d00,0) at netbsd:VOP_UNLOCK+0x45
vput(d3dbea2c,cdbb5c70,cdd01040,cddb2c1c,cd6ce274) at netbsd:vput+0x18
do_sys_stat(cdd01040,806146d,40,cdbb5c70,8067000) at netbsd:do_sys_stat+0x63
sys___stat30(cdd01040,cdbb5d00,cdbb5d28,bbb65210,bbb65000) at 
netbsd:sys___stat30+0x33
syscall(cdbb5d48,b3,ab,1f,1f) at netbsd:syscall+0xe8


or this:

panic: lockmgr: pid 13714.1, not exclusive lock holder 14298.1 unlocking (type 
*0* flags 10400, sharecount 0, exclusivecount 1, recurselevel 0, waitcount 0, 
wmesg vnlock, lock_addr 0xc04151a5, unlock_addr 0xc0415120)

Stopped in pid 13714.1 (sh) at  netbsd:breakpoint+0x4:  popl    %ebp
db{0}> bt
breakpoint(c0a130e0,d6f12658,d6f1264c,343031c2,c0003030) at 
netbsd:breakpoint+0x4
panic(c09c2fc4,d6f12726,c09c2f26,d6f12690,0) at netbsd:panic+0x155
lockpanic(cec666cc,c09c3148,3592,1,37da) at netbsd:lockpanic+0xcd
lockmgr(cec666cc,6,cec66640,cec66640,d096f00c) at netbsd:lockmgr+0x28e
ffs_unlock(d6f1285c,d096f00c,d6f1286c,c049e6b1,7) at netbsd:ffs_unlock+0x40
VOP_UNLOCK(cec66640,0,c0af1740,c04c11c4,0) at netbsd:VOP_UNLOCK+0x7f
cache_lookup(cec66640,d6f129cc,d6f12c28,0,0) at netbsd:cache_lookup+0x199
ufs_lookup(d6f12988,0,80000000,d69e5d20,c0af1780) at netbsd:ufs_lookup+0xc5
VOP_LOOKUP(cec66640,d6f129cc,d6f12c28,c050a2c3,1) at netbsd:VOP_LOOKUP+0x7c
union_lookup1(d6f12c28,0,80000000,6,c0af1780) at netbsd:union_lookup1+0x46
union_lookup(d6f12ac8,d69e5d20,0,c049ac1e,0) at netbsd:union_lookup+0xb5
VOP_LOOKUP(cecb4ed8,d6f12c14,d6f12c28,c050a350,1) at netbsd:VOP_LOOKUP+0x48
lookup(d6f12c00,20002,400,d6f12c1c,cd25631c) at netbsd:lookup+0x1fc
namei(d6f12c00,0,d69e5d20,0,0) at netbsd:namei+0x135
do_sys_stat(d69e5d20,bb90fe94,40,d6f12c70,cd396950) at netbsd:do_sys_stat+0x37
sys___stat30(d69e5d20,d6f12d00,d6f12d28,bbbc84c4,bbbc8000) at 
netbsd:sys___stat30+0x33
syscall(d6f12d48,bb9000b3,ab,bfbf001f,bbbb001f) at netbsd:syscall+0xe8

>How-To-Repeat:

>Fix: