kern/39400: tacking FFS snapshot triggers "lock error" panic

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

>Number:         39400
>Category:       kern
>Synopsis:       tacking FFS snapshot triggers "lock error" panic
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Aug 24 14:25:00 +0000 2008
>Originator:     Manuel Bouyer
>Release:        NetBSD 4.99.72
>Organization:
>Environment:
System: NetBSD  4.99.72 NetBSD 4.99.72 (XEN3_DOMU) #98: Sun Aug 24 15:29:54 
CEST 2008  
bouyer@rock:/dsk/l1/misc/bouyer/tmp/amd64/obj/dsk/l1/misc/bouyer/current/src/sys/arch/amd64/compile/XEN3_DOMU
 amd64
Architecture: amd64
Machine: amd64
>Description:
        taking an internal shapshot twice of the same filesystem
        triggers a lock error panic:
Reader / writer lock error: rw_vector_enter: locking against myself

lock address : 0xffffa000043f6718
current cpu  :                  0
current lwp  : 0xffffa00004644420
owner/count  : 0xffffa00004644420 flags    : 0x0000000000000004

panic: lock error
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8036f5e5 cs e030 rflags 246 cr2  7f7fffffbec0 
cpl 0 rsp ffffa000044022e0
Stopped in pid 489.1 (dump) at  netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x255
lockdebug_abort() at netbsd:lockdebug_abort+0x42
rw_vector_enter() at netbsd:rw_vector_enter+0x213
vlockmgr() at netbsd:vlockmgr+0xf6
VOP_LOCK() at netbsd:VOP_LOCK+0x28
vn_lock() at netbsd:vn_lock+0xd9
vget() at netbsd:vget+0x132
ufs_ihashget() at netbsd:ufs_ihashget+0x91
ffs_vget() at netbsd:ffs_vget+0xc1
ffs_snapshot() at netbsd:ffs_snapshot+0x470
fss_ioctl() at netbsd:fss_ioctl+0x5cf
VOP_IOCTL() at netbsd:VOP_IOCTL+0x31
vn_ioctl() at netbsd:vn_ioctl+0x6d
sys_ioctl() at netbsd:sys_ioctl+0x134
syscall() at netbsd:syscall+0x98

>How-To-Repeat:
        dump -a -f /dev/null -X /
        dump -a -f /dev/null -X /
        panic will occur on the second dump
>Fix:
        please ...