kern/43247: KASSERT while copying 32GB file from NFS to TMPFS

[njoly%pasteur.fr@localhost]

>Number:         43247
>Category:       kern
>Synopsis:       KASSERT while copying 32GB file from NFS to TMPFS
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue May 04 11:25:00 +0000 2010
>Originator:     Nicolas Joly
>Release:        NetBSD 5.99.29
>Organization:
Intitut Pasteur
>Environment:
System: NetBSD kiri-001.cluster.pasteur.fr 5.99.29 NetBSD 5.99.29 (KIRI001) 
#10: Mon May  3 16:38:11 CEST 2010  
njoly%lanfeust.sis.pasteur.fr@localhost:/local/src/NetBSD/obj.amd64/sys/arch/amd64/compile/KIRI001
 amd64
Architecture: x86_64
Machine: amd64
>Description:
While stress testing a new amd64 machine with 64GB ram, i hit a KASSERT while
copying (with dd) a 32GB file from NFS to a big TMPFS filesystem.

njoly@kiri-001 [/mnt]> ls -lh /local/gensoft/tmp/nico/netbsd.1.core
-rw-r--r--  1 njoly  sis   32G Apr 16 11:32 
/local/gensoft/tmp/nico/netbsd.1.core
njoly@kiri-001 [/mnt]> df -h .
Filesystem        Size       Used      Avail %Cap Mounted on
tmpfs             126G       4.0K       126G   0% /mnt
njoly@kiri-001 [/mnt]> while :
while> do
while> dd if=/local/gensoft/tmp/nico/netbsd.1.core of=netbsd.1.core
while> done
67107561+1 records in
67107561+1 records out
34359071256 bytes transferred in 888.801 secs (38657777 bytes/sec)
67107561+1 records in
67107561+1 records out
34359071256 bytes transferred in 1957.106 secs (17556060 bytes/sec)
[...PANIC...]

panic: kernel diagnostic assertion "uvm_pagelookup(&aobj->u_obj, 
(UAO_SWHASH_ELT_PAGEIDX_BASE(elt) + j) << PAGE_SHIFT) == NULL" failed: file 
"/loc
al/src/NetBSD/src/sys/uvm/uvm_aobj.c", line 1544
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80229d35 cs 8 rflags 246 cr2  7f7ffd7212d8 cpl 0 
rsp ffff8000d1bf2720
Stopped in pid 1593.1 (dd) at   netbsd:breakpoint+0x5:  leave
db{0}> bt
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x2ba
kern_assert() at netbsd:kern_assert+0x2d
uao_dropswap_range1() at netbsd:uao_dropswap_range1+0x2ac
tmpfs_reg_resize() at netbsd:tmpfs_reg_resize+0x1de
tmpfs_truncate() at netbsd:tmpfs_truncate+0x42
tmpfs_chsize() at netbsd:tmpfs_chsize+0xbe
tmpfs_setattr() at netbsd:tmpfs_setattr+0x10c

Full dmesg available at :
http://mail-index.netbsd.org/current-users/2010/04/30/msg013247.html

>How-To-Repeat:
Copy a 32GB into a big TMPFS in a loop.
>Fix: