kern/40102: netbsd-5 wapbl panic

[stadtkind2%gmx.de@localhost]

>Number:         40102
>Category:       kern
>Synopsis:       netbsd-5 wapbl panic
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Dec 04 10:10:00 +0000 2008
>Originator:     Stefan Krueger
>Release:        NetBSD 5.0_BETA
>Organization:
>Environment:
NetBSD con189 5.0_BETA NetBSD 5.0_BETA (SONNE) #2: Fri Nov 28 14:43:25 CET 2008 
 krueger@con04:/sam/obj/sys/arch/i386/compile/SONNE i386
>Description:
kernel panics under heavy load when writing to a '-o log' mounted partition 
(/var in my case)

$ gdb /netbsd.gdb
(gdb) target kvm /var/crash/netbsd.1.core
#0  0xc0341992 in cpu_reboot (howto=260, bootstr=0x0)
    at /net/con189/usr/src/sys/arch/i386/i386/machdep.c:925
925                     dumpsys();
(gdb) where
#0  0xc0341992 in cpu_reboot (howto=260, bootstr=0x0)
    at /net/con189/usr/src/sys/arch/i386/i386/machdep.c:925
#1  0xc02a85ec in panic (fmt=0xc042827c "trap")
    at /net/con189/usr/src/sys/kern/subr_prf.c:255
#2  0xc0344738 in trap (frame=0xcd8a9884)
    at /net/con189/usr/src/sys/arch/i386/i386/trap.c:371
#3  0xc010cbf6 in calltrap ()
#4  0xc033cd51 in db_read_bytes (addr=1134520, size=4, data=0xcd8a98f0 "\004")
    at /net/con189/usr/src/sys/arch/i386/i386/db_memrw.c:91
#5  0xc0162b5a in db_get_value (addr=1134520, size=4, is_signed=false)
    at /net/con189/usr/src/sys/ddb/db_access.c:62
#6  0xc033d5c4 in db_stack_trace_print (addr=-846554652, have_addr=true,
    count=65535, modif=0xc0407b8e "", pr=0xc02a83c0 <printf>)
    at /net/con189/usr/src/sys/arch/i386/i386/db_trace.c:485
#7  0xc02a85c1 in panic (
    fmt=0xc043d820 "kernel %sassertion \"%s\" failed: file \"%s\", line %d")
    at /net/con189/usr/src/sys/kern/subr_prf.c:244
#8  0xc03d82d9 in __kernassert (t=0xc03fe758 "diagnostic ",
    f=0xc0421d14 "/net/con189/usr/src/sys/kern/vfs_wapbl.c", l=1697,
    e=0xc0421d60 "wl->wl_dealloccnt < wl->wl_dealloclim")
    at /net/con189/usr/src/sys/lib/libkern/__assert.c:50
#9  0xc02f4bc7 in wapbl_register_deallocation (wl=0xc1457000, blk=1134520,
    len=2048) at /net/con189/usr/src/sys/kern/vfs_wapbl.c:1697
#10 0xc020f488 in ffs_truncate (ovp=0xccefca1c, length=0, ioflag=576,
    cred=0xcc9d2000) at /net/con189/usr/src/sys/ufs/ffs/ffs_inode.c:487
#11 0xc0226f7e in ufs_rmdir (v=0xcd8a9c58)
    at /net/con189/usr/src/sys/ufs/ufs/ufs_vnops.c:1672
#12 0xc02fa97c in VOP_RMDIR (dvp=0xccee88a0, vp=0xccefca1c, cnp=0xcd8a9cb4)
    at /net/con189/usr/src/sys/kern/vnode_if.c:1095
#13 0xc02ecfbd in sys_rmdir (l=0xcd0a85a0, uap=0xcd8a9d00, retval=0xcd8a9d28)
    at /net/con189/usr/src/sys/kern/vfs_syscalls.c:3548
#14 0xc03440d4 in syscall (frame=0xcd8a9d48)
    at /net/con189/usr/src/sys/sys/syscallvar.h:49
#15 0xc010055d in syscall1 ()

-------------------------------------------------------

similar panic:
(gdb) target kvm /var/crash/netbsd.0.core
#0  db_fncall (addr=-1069083827, have_addr=false, count=-1069083840,
modif=0xccbe2740 "p'K\023GL\023Gs")
    at /net/con189/usr/src/sys/ddb/db_command.c:1298
1298            db_printf("%s\n", db_num_to_str(retval));
(gdb) where
#0  db_fncall (addr=-1069083827, have_addr=false, count=-1069083840,
    modif=0xccbe2740 "p'K\023GL\023Gs")
    at /net/con189/usr/src/sys/ddb/db_command.c:1298
#1  0xc0163eb8 in db_command (last_cmdp=0xc044287c)
    at /net/con189/usr/src/sys/ddb/db_command.c:935
#2  0xc0164212 in db_command_loop ()
    at /net/con189/usr/src/sys/ddb/db_command.c:580
#3  0xc0167130 in db_trap (type=1, code=0)
    at /net/con189/usr/src/sys/ddb/db_trap.c:101
#4  0xc033cabb in kdb_trap (type=1, code=0, regs=0xccbe296c)
    at /net/con189/usr/src/sys/arch/i386/i386/db_interface.c:229
#5  0xc0344724 in trap (frame=0xccbe296c)
    at /net/con189/usr/src/sys/arch/i386/i386/trap.c:354
#6  0xc010cbf6 in calltrap ()
#7  0xc033b1bc in breakpoint ()
#8  0xc02a85fc in panic (
    fmt=0xc043d820 "kernel %sassertion \"%s\" failed: file \"%s\", line %d")
    at /net/con189/usr/src/sys/kern/subr_prf.c:252
#9  0xc03d82d9 in __kernassert (t=0xc03fe758 "diagnostic ",
    f=0xc0421d14 "/net/con189/usr/src/sys/kern/vfs_wapbl.c", l=1697,
    e=0xc0421d60 "wl->wl_dealloccnt < wl->wl_dealloclim")
    at /net/con189/usr/src/sys/lib/libkern/__assert.c:50
#10 0xc02f4bc7 in wapbl_register_deallocation (wl=0xc1457300, blk=6727488,
    len=2048) at /net/con189/usr/src/sys/kern/vfs_wapbl.c:1697
#11 0xc020f488 in ffs_truncate (ovp=0xcdae45c0, length=0, ioflag=576,
    cred=0xccae0f00) at /net/con189/usr/src/sys/ufs/ffs/ffs_inode.c:487
#12 0xc0226f7e in ufs_rmdir (v=0xccbe2c58)
    at /net/con189/usr/src/sys/ufs/ufs/ufs_vnops.c:1672
#13 0xc02fa97c in VOP_RMDIR (dvp=0xcd890960, vp=0xcdae45c0, cnp=0xccbe2cb4)
    at /net/con189/usr/src/sys/kern/vnode_if.c:1095
#14 0xc02ecfbd in sys_rmdir (l=0xccb9ad60, uap=0xccbe2d00, retval=0xccbe2d28)
    at /net/con189/usr/src/sys/kern/vfs_syscalls.c:3548
#15 0xc03440d4 in syscall (frame=0xccbe2d48)
    at /net/con189/usr/src/sys/sys/syscallvar.h:49
#16 0xc010055d in syscall1 ()

>How-To-Repeat:
Download http://www.holm.cc/stress/src/stress2.tgz
Apply the patch from 
http://www.file-upload.net/download-1294854/stress2.patch.gz.html

compile it with MKLINT=no ; run it like

(Adjust some parameters in default.cfg, like BLASTHOST and RUNDIR)

csh % env INCARNATIONS=10 ./run.sh ./noswap.cfg

It should panic after a few minutes

more info or netbsd.gdb+crashdumps available on request
>Fix: