kern/41937: ffs+log rmdir diagnostic kernel assertion

[njoly%pasteur.fr@localhost]

>Number:         41937
>Category:       kern
>Synopsis:       ffs+log rmdir diagnostic kernel assertion
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 25 16:35:01 +0000 2009
>Originator:     Nicolas Joly
>Release:        NetBSD 5.99.15
>Organization:
Institut Pasteur
>Environment:
System: NetBSD lanfeust.sis.pasteur.fr 5.99.15 NetBSD 5.99.15 (LANFEUST) #0: 
Tue Aug 25 13:16:28 CEST 2009 
njoly%lanfeust.sis.pasteur.fr@localhost:/local/src/NetBSD/obj.amd64/sys/arch/amd64/compile/LANFEUST
 amd64
Architecture: x86_64
Machine: amd64
>Description:
While running rmdir syscalls regression tests from Linux Testsuite Project
under compat linux emulation, i encountered a kernel diagnostic assertion
with rmdir(2) on ffs+log filesystem. And was then able to reproduce it natively
and later using rump :

panic: kernel diagnostic assertion "wl->wl_dealloccnt < wl->wl_dealloclim" 
failed: file "/local/src/NetBSD/src/sys/kern/vfs_wapbl.c", line 1672

njoly@lanfeust [rump/ffs]> cat ffs_rmdir.c

#include <rump/rump_syscalls.h>
#include <rump/rump.h>

#include <ufs/ufs/ufsmount.h>

#include <err.h>
#include <fcntl.h>
#include <pthread.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define IMAGE "image.ffs"
#define DEVICE "/dev/device.ffs"
#define MNTDIR "/mnt"
#define DIR1 MNTDIR "/rmdir.test"


static int quit = 0;


static void *func1(void *arg) {

  while (quit != 1)
    rump_sys_mkdir(DIR1, 0755);

  return NULL; }

static void *func2(void *arg) {

  while (quit != 1)
    rump_sys_rmdir(DIR1);

  return NULL; }


int main() {
  int res;
  pthread_t th1, th2;
  struct ufs_args args;

  (void)unlink(IMAGE);
  res = system("newfs -F -s 10000 " IMAGE " >/dev/null");
  if (res == -1)
    err(1, "system failed");

  res = rump_init();
  if (res != 0)
    err(1, "rump_init failed");

  res = rump_etfs_register(DEVICE, IMAGE, RUMP_ETFS_BLK);
  if (res != 0)
    err(1, "rump_etfs_register failed");

  res = rump_sys_mkdir(MNTDIR, 0777);
  if (res != 0)
    err(1, "rump_sys_mkdir failed");

  memset(&args, 0x0, sizeof(args));
  args.fspec = DEVICE;

  res = rump_sys_mount(MOUNT_FFS, MNTDIR, MNT_LOG, &args, sizeof(args));
  if (res == -1)
    err(1, "rump_sys_mount failed");

  res = pthread_create(&th1, NULL, func1, NULL);
  if (res != 0)
    errx(1, "pthread_create failed");
  res = pthread_create(&th2, NULL, func2, NULL);
  if (res != 0)
    errx(1, "pthread_create failed");

  sleep(10);
  quit = 1;

  res = pthread_join(th2, NULL);
  if (res != 0)
    errx(1, "pthread_join failed");
  res = pthread_join(th1, NULL);
  if (res != 0)
    errx(1, "pthread_join failed");

  res = rump_sys_unmount(MNTDIR, 0);
  if (res == -1)
    err(1, "rump_sys_unmount failed");

  res = unlink(IMAGE);
  if (res == -1)
    err(1, "unlink failed");

  return 0; }

njoly@lanfeust [rump/ffs]> make ffs_rmdir
cc -g -O0 -Wall -Werror   -lrumpfs_ffs -lrumpvfs -o ffs_rmdir ffs_rmdir.c 
njoly@lanfeust [rump/ffs]> ./ffs_rmdir 
panic: kernel diagnostic assertion "wl->wl_dealloccnt < wl->wl_dealloclim" 
failed: file 
"/local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_wapbl.c", line 
1672
zsh: abort (core dumped)  ./ffs_rmdir
njoly@lanfeust [rump/ffs]> gdb ffs_rmdir ffs_rmdir.core
GNU gdb 6.5
[...]
Core was generated by `ffs_rmdir'.
Program terminated with signal 6, Aborted.
#0  0x00007f7ffd7e0c0a in _lwp_kill () from /usr/lib/libc.so.12
(gdb) bt
#0  0x00007f7ffd7e0c0a in _lwp_kill () from /usr/lib/libc.so.12
#1  0x00007f7ffd7e057e in abort () at 
/local/src/NetBSD/src/lib/libc/stdlib/abort.c:74
#2  0x00007f7ffd10404b in rumpuser_panic ()
    at 
/local/src/NetBSD/src/lib/librumpuser/../../sys/rump/librump/rumpuser/rumpuser.c:449
#3  0x00007f7ffd53c833 in panic (
    fmt=0x7f7ffd55c1b8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d")
    at /local/src/NetBSD/src/lib/librump/../../sys/rump/../kern/subr_prf.c:296
#4  0x00007f7ffd5326bf in __kernassert (t=0x6 <Address 0x6 out of bounds>, 
    f=0x7f7ffd7e0c0a "r\001ÃH\213\r$x\022", l=1, e=0x0)
    at 
/local/src/NetBSD/src/lib/librump/../../sys/rump/../lib/libkern/__assert.c:50
#5  0x00007f7ffda2128d in wapbl_register_deallocation (wl=0x7f7ffc6c0c80, 
blk=9440, len=512)
    at 
/local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_wapbl.c:1672
#6  0x00007f7ffdc1e20e in ffs_truncate (ovp=0x7f7ffaf0b070, length=0, 
ioflag=<value optimized out>, 
    cred=<value optimized out>)
    at 
/local/src/NetBSD/src/sys/rump/fs/lib/libffs/../../../../ufs/ffs/ffs_inode.c:450
#7  0x00007f7ffdc15a94 in ufs_rmdir (v=<value optimized out>)
    at 
/local/src/NetBSD/src/sys/rump/fs/lib/libffs/../../../../ufs/ufs/ufs_vnops.c:1580
#8  0x00007f7ffd5387be in VOP_RMDIR (dvp=0x7f7ffc6ad400, vp=0x6, cnp=<value 
optimized out>)
    at /local/src/NetBSD/src/lib/librump/../../sys/rump/../kern/vnode_if.c:1094
#9  0x00007f7ffda25923 in sys_rmdir (l=<value optimized out>, uap=<value 
optimized out>, 
    retval=<value optimized out>)
    at 
/local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_syscalls.c:3505
#10 0x00007f7ffd551ee8 in rump_sys_rmdir (path=<value optimized out>)
    at 
/local/src/NetBSD/src/lib/librump/../../sys/rump/librump/rumpkern/rump_syscalls.c:1030
#11 0x0000000000400d27 in func2 (arg=0x0) at ffs_rmdir.c:33
#12 0x00007f7ffd30a812 in pthread__create_tramp (cookie=<value optimized out>)
    at /local/src/NetBSD/src/lib/libpthread/pthread.c:476
#13 0x00007f7ffd76e690 in ___lwp_park50 () from /usr/lib/libc.so.12
#14 0x00007f7ffb800000 in ?? ()
#15 0x0000000111110001 in ?? ()
#16 0x0000000033330003 in ?? ()
#17 0x0000000000000000 in ?? ()

>How-To-Repeat:
Compile and run the provided testcase ...
>Fix:
n/a