kern/51377: fss(4) panic if snapshot mounted read/write

[paul%whooppee.com@localhost]

>Number:         51377
>Category:       kern
>Synopsis:       fss(4) panic if snapshot mounted read/write
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 29 20:45:00 +0000 2016
>Originator:     Paul Goyette
>Release:        NetBSD 7.99.33
>Organization:
+------------------+--------------------------+------------------------+
| Paul Goyette     | PGP Key fingerprint:     | E-mail addresses:      |
| (Retired)        | FA29 0E3B 35AF E8AE 6651 | paul at whooppee.com   |
| Kernel Developer | 0786 F758 55DE 53BA 7731 | pgoyette at netbsd.org |
+------------------+--------------------------+------------------------+
>Environment:
	
	
System: NetBSD pokey.whooppee.com 7.99.33 NetBSD 7.99.33 (POKEY 2016-07-04 08:34:20) #0: Mon Jul 4 20:24:24 PHT 2016 paul%pokey.whooppee.com@localhost:/build/netbsd-local/obj/amd64/sys/arch/amd64/compile/POKEY amd64
Architecture: x86_64
Machine: amd64
>Description:
	If you attempt to mount a fss(4) snap-shot for read-write access,
	you may get the following panic:

	/dev/fss0: file system not clean (fs_clean=0x4); please fsck(8)
	/dev/fss0: lost blocks 0 files 0
	fss0: snapshot invalid: forced unmount
	panic: kernel diagnostic assertion "LIST_FIRST(&fmi->fmi_cow_handler) == NULL" failed: file "/build/netbsd-local/src/sys/kern/vfs_trans.c", line 148 
	cpu0: Begin traceback...
	vpanic() at netbsd:vpanic+0x140
	cd_play_msf() at netbsd:cd_play_msf
	fstrans_mount_dtor() at netbsd:fstrans_mount_dtor+0x82
	fstrans_get_lwp_info() at netbsd:fstrans_get_lwp_info+0x76
	_fstrans_start.part.2() at netbsd:_fstrans_start.part.2+0x1e
	genfs_lock() at netbsd:genfs_lock+0x3d
	VOP_LOCK() at netbsd:VOP_LOCK+0x32
	vn_lock() at netbsd:vn_lock+0x90
	vrelel() at netbsd:vrelel+0x113
	do_sys_waitid() at netbsd:do_sys_waitid+0x960
	do_sys_wait() at netbsd:do_sys_wait+0x8f
	sys___wait450() at netbsd:sys___wait450+0x42
	syscall() at netbsd:syscall+0x15b
	--- syscall (number 449) ---
	75092f43d8ba:
	cpu0: End traceback...

	The panic does not happen immediately, rather it is delayed for
	some seconds.  Note that mount complains about the file system
	being dirty.

	(Note that in the backtrace above, "cd_play_msf" is at the
	same address as "kern_assert + 0x48" - the end of kern_assert.)
	
>How-To-Repeat:
	Manually execute the body of the src/tests/dev/fss/t_fss atf
	test, but remove the '-o rdonly' from the 'mount fss0' command.
	
>Fix:
	Unknown
	

>Unformatted: