kern/49234: PUFFS regression in netbsd-7 and -current

[manu%netbsd.org@localhost]

>Number:         49234
>Category:       kern
>Synopsis:       PUFFS regression in netbsd-7 and -current
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Sep 24 06:45:00 +0000 2014
>Originator:     Emmanuel Dreyfus
>Release:        netbsd-7
>Organization:
>Environment:
NetBSD bacasable.net.espci.fr 7.0_BETA NetBSD 7.0_BETA (GFS.xen) #4: Mon Sep 15 05:51:54 CEST 2014  root%netbsd7.cloud.gluster.org@localhost:/usr/src/sys/arch/i386/compile/GFS.xen i386

>Description:
Change pulled up in http://releng.netbsd.org/cgi-bin/req-7.cgi?show=67 causes a critical regression. A panic now happens a few seconds
after mouting a glusterfs volume (through libperfuse). The backtrace is always the same (see below), and the problem disapear if I build without the pulled-up change.

If we cannot fix it, we need to back out the change, as it brings more harm than good.

uvm_fault(0xc0594500, 0xbb501000, 1) -> 0xe                
fatal page fault in supervisor mode        
trap type 6 code 0 eip c044a56b cs 9 eflags 210202 cr2 bb501240 ilevel 0
esp c1e24700
curlwp 0xc1e247e0 pid 0 lid 38 lowest kstack 0xd9f2c2c0
db{0}> bt                                              
vcache_get(c29cf008,bb501240,4,d9f2ef7c,c04db517,c057beb0,1,c1b7ed40,c29
d0fd4,c29d0000) at netbsd:vcache_get+0x6b
puffs_cookie2vnode(c29d0000,bb501240,d9f2ef7c,fffffffe,c1e247e0,c1e242a0
,c1e247e0,d9f2ef88,c0241ac9,c1e247e0) at netbsd:puffs_cookie2vnode+0x3a
puffs_sop_thread(c29d0000,8d6000,c05cf200,0,c010007b,0,0,0,0,0) at
netbsd:puffs_sop_thread+0xf6  

Most likely, puffs_cookie2vnode(() is from puffsop_expire() performing a node expiration.
>How-To-Repeat:
See description
>Fix:
no fix known