kern/46377: Use of Coda file system triggers an immediate kernel panic

[u-bsdmwle%aetey.se@localhost]

>Number:         46377
>Category:       kern
>Synopsis:       Use of Coda file system triggers an immediate kernel panic
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Apr 25 14:55:00 +0000 2012
>Originator:     Rune
>Release:        current as of 2012-04-23
>Organization:
Aetey Global Technologies AB
>Environment:
NetBSD xdat05.ce.chalmers.se 6.99.5 NetBSD 6.99.5 (GENERIC) #0: Mon Apr 23 
19:41:29 UTC 2012  
builds%b8.netbsd.org@localhost:/home/builds/ab/HEAD/i386/201204231220Z-obj/home/builds/ab/HEAD/src/sys/arch/i386/compile/GENERIC
 i386
>Description:
On the console I start the venus process,
in one ssh session I start codacon process,
in a second ssh session I try to read a file from Coda (copy it to a local file)

The kernel panics, as follows:

-- user: ----------------------------------------------------------------
$ cp /coda/coda.cs.cmu.edu/WELCOME /tmp/ignore
Timeout, server not responding.

-- console: -------------------------------------------------------------
# venus-setup xxxx
# venus

Date: Wed 04/25/2012

16:39:10 Coda Venus, version 6.9.5
16:39:10 /var/lib/coda/LOG size is 2705348 bytes
16:39:10 /var/lib/coda/DATA size is 10821392 bytes
16:39:10 Initializing RVM data...
16:39:10 ...done
16:39:10 Loading RVM data
16:39:10 Starting RealmDB scan
16:39:10        Found 1 realms
16:39:10 starting VDB scan
16:39:10        0 volume replicas
16:39:10        0 replicated volumes
16:39:10        0 CML entries allocated
16:39:10        0 CML entries on free-list
16:39:10 starting FSDB scan (4166, 100000) (25, 75, 4)
16:39:10        0 cache files in table (0 blocks)
16:39:10        4166 cache files on free-list
16:39:10 starting HDB scan
16:39:10        0 hdb entries in table
16:39:10        0 hdb entries on free-list
16:39:10 Mounting root volume...
16:39:10 Venus starting...
16:39:10 /coda now mounted.
# uname -a
NetBSD xdat05.ce.chalmers.se 6.99.5 NetBSD 6.99.5 (GENERIC) #0: Mon Apr 23 19:41
:29 UTC 2012  
builds%b8.netbsd.org@localhost:/home/builds/ab/HEAD/i386/201204231220Z-obj/h
ome/builds/ab/HEAD/src/sys/arch/i386/compile/GENERIC i386
# sysctl -w ddb.onpanic=1
ddb.onpanic: 0 -> 1
# panic: kernel diagnostic assertion "uvm_page_locked_p(pg)" failed: file 
"/home/builds/ab/HEAD/src/sys/arch/x86/x86/pmap.c", line 3304 
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c026a5d4 cs 8 eflags 282 cr2 bbbb2564 ilevel 0
Stopped in pid 573.1 (cp) at    netbsd:breakpoint+0x4:  popl    %ebp
db{0}> bt
breakpoint(c0c460e9,c0d04de0,c0b9a3f0,dd1e2b38,c463bdc8,c525fa48,0,0,1,240) at n
etbsd:breakpoint+0x4
vpanic(c0b9a3f0,dd1e2b38,dd1e2b5c,c52ae694,c43086f4,bfedd,dd1e2b7c,c06b1b68,c0b9
a3f0,c0b9a5a1) at netbsd:vpanic+0x1e2
kern_assert(c0b9a3f0,c0b9a5a1,c0c0edd8,c0c0e370,ce8,0,dd1e2b8c,c08faafd,dd1e2b6c
,ffffffff) at netbsd:kern_assert+0x23
pmap_remove_pte(bbaa3000,dd1e2bc4,dd1e2bcc,dd1e2bc8,0,3feaaaaa,2,c0b89c0c,c53562
20,dd1e2c40) at netbsd:pmap_remove_pte+0x33f
pmap_remove(c52ae694,bbaa3000,bbaa4000,c07f2e01,4,c52d70c0,dd1e2c40,c52ec780,1,4
0) at netbsd:pmap_remove+0x3f3
uvm_unmap_remove(c52bb42c,bbaa3000,bbaa4000,dd1e2ca0,0,c0cc5630,dd1e2cac,c07f2f0
f,4,c52d70c0) at netbsd:uvm_unmap_remove+0x226
sys_munmap(c532b2c0,dd1e2cf4,dd1e2d1c,c52bb42c,c52ae9dc,c4b9b000,c532b2c0,c530d5
10,c52ae694,c52ae694) at netbsd:sys_munmap+0x7c
syscall(dd1e2d48,b3,ab,bfbf001f,806001f,3,36f,bfbfeba8,0,bbaa3000) at netbsd:sys
call+0x95
db{0}> show map c52bb42c
MAP 0xc52bb42c: [0x0->0xbfc00000]
        #ent=18, sz=70340608, ref=1, version=37, flags=0x41
        pmap=0xc52ae694(resident=236, wired=0)
db{0}>
-------------------------------------------------------------

-- codacon: (illustrates that the file fetch was completed)
-------------------------------------------------------------
# codacon
NewConnectFS telemann.coda.cs.cmu.edu ( 16:40:34 )
NewConnection telemann.coda.cs.cmu.edu ( 16:40:35 )
BackProbe telemann.coda.cs.cmu.edu ( 16:40:35 )
GetRootVolume @coda.cs.cmu.edu ( 16:40:35 )
GetVolumeInfo /@coda.cs.cmu.edu ( 16:40:35 )
GetVolumeInfo 16777217%coda.cs.cmu.edu@localhost ( 16:40:35 )
NewConnectFS telemann.coda.cs.cmu.edu ( 16:40:36 )
BackProbe telemann.coda.cs.cmu.edu ( 16:40:36 )
bandwidth telemann.coda.cs.cmu.edu 7183 25303 43423 ( 16:40:36 )
GetAttr coda.cs.cmu.edu ( 16:40:36 )
Fetch coda.cs.cmu.edu [2] ( 16:40:36 )
fetching (coda.cs.cmu.edu) 100% ( 16:40:37 )
GetAttr WELCOME ( 16:40:37 )
Fetch WELCOME [1] ( 16:40:37 )
fetching (WELCOME) 100% ( 16:40:37 )
Timeout, server not responding.
-------------------------------------------------------------------------
>How-To-Repeat:
compile Coda via pkgsrc, then:

as root:
venus-setup xxxx       (xxxx is literal, doesn't matter)
venus

as any user:
cp /coda/coda.cs.cmu.edu/WELCOME /tmp/ignore
 -- panic

The expected behaviour:
no panic
the file /tmp/ignore (WELCOME) becoming 879 bytes long

>Fix: