kern/41158: nfs_rename() locking against myself

[Manuel Bouyer <Manuel.Bouyer%lip6.fr@localhost>]

>Number:         41158
>Category:       kern
>Synopsis:       nfs_rename() locking against myself
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr 06 10:20:00 +0000 2009
>Originator:     Manuel Bouyer
>Release:        NetBSD 5.0_RC3
>Organization:
>Environment:
System: NetBSD horn 5.0_RC3 NetBSD 5.0_RC3 (DISCODEBUG) #34: Sun Apr 5 21:37:10 
MEST 2009 bouyer@disco:/home/bouyer/src-5/src/sys/arch/i386/compile/DISCODEBUG 
i386
Architecture: i386
Machine: i386
>Description:
        A netbsd 5.0_RC3 NFS server with a DIAGNOSTIC+LOCKDEBUG kernel
        will occasionally panic with
Mutex error: lockdebug_wantlock: locking against myself

lock address : 0x00000000ce95a02c type     :     sleep/adaptive
initialized  : 0x00000000c03af442
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  7
current cpu  :                  1 last held:                  0
current lwp  : 0x00000000cea49060 last held: 0x00000000cea49060
last locked  : 0x00000000c03b94b4 unlocked : 0x00000000c025f3c0
owner field  : 0x00000000cea49060 wait/spin:                1/0

Turnstile chain at 0xc071df60.
=> Turnstile at 0xcbf88068 (wrq=0xcbf88078, rdq=0xcbf88080).
=> 0 waiting readers:
=> 6 waiting writers: 0xcea59800 0xce4867a0 0xcea49ce0 0xcea17040 0xcea172c0 0
xcea17a40

panic: LOCKDEBUG
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c03fb65c cs 8 eflags 246 cr2 cdc88000 ilevel 0
Stopped in pid 208.1 (nfsd) at  netbsd:breakpoint+0x4:  popl    %ebp
db{1}> tr
breakpoint(c0652a42,ce95d728,c2d08800,c03640cf,0,1,0,0,ce95d728,8) at 
netbsd:breakpoint+0x4
panic(c0652a44,c064e7f4,c0523e0f,c064e7c3,5748,1a49060,0,cf69cc44,0,ce95a02c) 
at netbsd:panic+0x1b0
lockdebug_abort1(c064e7c3,1,0,0,cbf6d508,cea49218,0,6,d35490ac,ce95db10) at 
netbsd:lockdebug_abort1+0xbb
mutex_vector_enter(ce95a02c,8,ce95db6c,c025e587,ce95a004,0,cec93000,ce8df000,c3b6a100,ce95db58)
 at netbsd:mutex_vector_enter+0x464
genfs_renamelock_enter(ce95a004,0,cec93000,ce8df000,c3b6a100,ce95db58,ce95db54,ce95db44,cea49060,0)
 at netbsd:genfs_renamelock_enter+0x14
nfsrv_rename(cec18e10,ce8df000,cea49060,ce95dbd0,cd137b00,c0713d58,0,c06aed18,c0713d58,0)
 at netbsd:nfsrv_rename+0x4b7
nfssvc_nfsd(ce95dc38,804a2e0,cea49060,0,0,0,0,0,0,ffffffff) at 
netbsd:nfssvc_nfsd+0x3d6
sys_nfssvc(cea49060,ce95dd00,ce95dd28,bfbff000,cea449f8,cea449f8,2,4,804a2e0,bfbfee94)
 at netbsd:sys_nfssvc+0x332
syscall(ce95dd48,b3,ab,bfbf001f,bbbd001f,6,1,bfbfee94,0,bfbffff0) at 
netbsd:syscall+0xc8

I have a core dump and netbsd.gdb if it helps

>How-To-Repeat:
        Run a LOCKDEBUG nfs server with a SMP linux client running
        build.sh -j16 and bonnie++
>Fix: