kern/56365: LFS/UVM panic: "uvm_page_owner_locked_p(pg, false)" failed

[jarle%norid.no@localhost]

>Number:         56365
>Category:       kern
>Synopsis:       LFS/UVM panic: "uvm_page_owner_locked_p(pg, false)" failed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 16 16:30:00 +0000 2021
>Originator:     Jarle Fredrik Greipsland
>Release:        NetBSD 9.99.88
>Organization:
	
>Environment:
	
	
System: NetBSD vm-2129.internal.tekno.greipsland.no 9.99.88 NetBSD 9.99.88 (XEN3_DOMU) #5: Tue Aug 10 14:57:02 CEST 2021  jarle%nbuilder.internal.tekno.greipsland.no@localhost:/build/current/amd64/obj/sys/arch/amd64/compile/XEN3_DOMU amd64
Architecture: x86_64
Machine: amd64
>Description:
Created a Xen VM and booted a -current amd64 kernel.  The VM has a 2GB
root disk, 2GB swap device and an additional 32GB disk.  All the
virtual disks are backed by LVM on the DOM0 host.  On the additional
disk a (disklabel) partition - a - spanning the entire disk, sans 2048
blocks, was set aside for an LFS filesystem.  The LFS was created with

# newfs_lfs -A /dev/rxbd2a

I then ran:

# mount /dev/xbd2a /mnt
# mkdir /mnt/tmp && chmod 1777 /mnt/tmp
# mkdir /mnt/tmp/root
# tar --no-acls --one-file-system --no-xattrs --no-fflags -cf - -C / . | tar -xpf - -C /mnt/tmp/root

After a while, the following messages were displayed on the console:
[ 1689.8409231] panic: kernel diagnostic assertion "uvm_page_owner_locked_p(pg, false)" failed: file "/build/current/src/sys/uvm/uvm_page.c", line 1859 
[ 1689.8409231] cpu1: Begin traceback...
[ 1689.8409231] vpanic() at netbsd:vpanic+0x14a
[ 1689.8409231] kern_assert() at netbsd:kern_assert+0x4b
[ 1689.8409231] uvm_pageactivate() at netbsd:uvm_pageactivate+0x96
[ 1689.8409231] lfs_gop_write() at netbsd:lfs_gop_write+0x577
[ 1689.8409231] genfs_do_putpages() at netbsd:genfs_do_putpages+0x8b7
[ 1689.8409231] lfs_putpages() at netbsd:lfs_putpages+0x8b1
[ 1689.8409231] VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x5f
[ 1689.8409231] lfs_writefile() at netbsd:lfs_writefile+0x170
[ 1689.8409231] lfs_writevnodes() at netbsd:lfs_writevnodes+0xe1
[ 1689.8409231] lfs_segwrite() at netbsd:lfs_segwrite+0x90
[ 1689.8409231] lfs_flush_fs() at netbsd:lfs_flush_fs+0x9b
[ 1689.8409231] lfs_flush() at netbsd:lfs_flush+0x197
[ 1689.8409231] lfs_check() at netbsd:lfs_check+0x5c2
[ 1689.8409231] lfs_write() at netbsd:lfs_write+0x135
[ 1689.8409231] VOP_WRITE() at netbsd:VOP_WRITE+0x59
[ 1689.8409231] vn_write() at netbsd:vn_write+0xe0
[ 1689.8409231] dofilewrite() at netbsd:dofilewrite+0x7a
[ 1689.8409231] sys_write() at netbsd:sys_write+0x49
[ 1689.8409231] syscall() at netbsd:syscall+0x9c
[ 1689.8409231] --- syscall (number 4) ---
[ 1689.8409231] netbsd:syscall+0x9c:
[ 1689.8409231] cpu1: End traceback...

[ 1689.8409231] dumping to dev 142,17 (offset=4194303, size=0): not possible
[ 1689.8409231] rebooting...

It seems reproducable.

Some additional information:
# dumplfs /dev/rxbd2a
Master LFS32 superblock at 0x8:
    magic    0x70162     version  0x2         size     33554432  
    ssize    194560      dsize    30198900    bsize    8192      
    fsize    1024        frag     8           minfree  10        
    inopb    8           ifpb     409         nindir   2048      
    nseg     176602      sepb     341         cleansz  1         
    segtabsz 518         segmask  0x0         segshift 0         
    bmask    0x1fff      bshift   13          ffmask   0x3FF     
    ffshift  10          fbmask   0x7         fbshift  3
    sushift  0           fsbtodb  1           cksum    0x2b1d    
    nclean   56016       dmeta    135658      minfreeseg 17660     
    roll_id  0x3dafe16c  interleave 0         sumsize  1024      
    seg0addr 0           maxfilesize  0x400801018000
  Superblock disk addresses:
     0x8        0x333308   0x666610   0x999918   0xcccc20   0xffff28  
     0x1333230  0x1666538  0x1999840  0x1cccb48 
  Checkpoint Info
    freehd   4           idaddr   0x19fe19b 
    uinodes  1           bfree    7891579     avail    8965414   
    nfiles   46275       lastseg  0x19fe092   nextseg  0x19fe20e 
    curseg   0x19fe150   offset   0x19fe1b4   serial   143745    
    tstamp   Mon Aug 16 18:07:14 2021
  32-bit only derived or constant fields
    ifile    1         

IFILE inode
    mode  o100600       nlink 1 uid   0 gid   0 size  5185536
    atime Thu Jan  1 01:00:00 1970
    mtime Mon Aug 16 18:07:14 2021
    ctime Mon Aug 16 17:42:56 2021
    inum  1
    Direct Addresses
        0x19fe151       0x19fe171       0xbeb9ce        0xbeb9d6        0xbeb9de        0xbeb9e6
        0xbeb9ee        0xbeb9f6        0xbeb9fe        0xbeba06        0xbeba0e        0xbeba16
    Indirect Addresses
        0x19fe1ac       0x0     0x0

IFILE contents
free_head 4
free_tail 46625
clean   56016   dirty   120586
bfree   7891583 avail   8965482

SEGMENT 0 (Disk Address 0x0)
Disklabel at 0x0
Superblock at 0x8
Segment Summary Info at 0x10
    next     0xbe       nfinfo   2      ninos    2      flags    ---R
    sumsum   0xb9d7     datasum  0x5534 create   Thu Jan  1 01:00:00 1970
    roll_id  3dafe16c   serial   1
    Inode addresses:    0x12 {2v1, 1v1}
    FINFO for inode: 2 version 1 nblocks 1 lastlength 1024
        0
    FINFO for inode: 1 version 1 nblocks 21 lastlength 8192
        0       1       501     502     503     504     505     506
        507     508     509     510     511     512     513     514
        515     516     517     518     519

[ ... ]
# dmesg -t
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
    2018, 2019, 2020, 2021 The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 9.99.88 (XEN3_DOMU) #5: Tue Aug 10 14:57:02 CEST 2021
        jarle%nbuilder.internal.tekno.greipsland.no@localhost:/build/current/amd64/obj/sys/arch/amd64/compile/XEN3_DOMU
total memory = 2048 MB
avail memory = 1968 MB
timecounter: Timecounters tick every 10.000 msec
Kernelized RAIDframe activated
mainbus0 (root)
hypervisor0 at mainbus0: Xen version 4.11.3nb1
hypervisor0: features:  mmu_pt_update_preserve_ad highmem_assist gnttab_map_avail_bits
VIRQ_DEBUG interrupt using event channel 3
vcpu0 at hypervisor0
vcpu0: Intel(R) Xeon(R) CPU           E5530  @ 2.40GHz, id 0x106a5
vcpu0: node 0, package 0, core 0, smt 0
vcpu1 at hypervisor0
vcpu1: Intel(R) Xeon(R) CPU           E5530  @ 2.40GHz, id 0x106a5
vcpu1: node 0, package 0, core 0, smt 0
xenbus0 at hypervisor0: Xen Virtual Bus Interface
xencons0 at hypervisor0: Xen Virtual Console Driver
xencons0: console major 143, unit 0
xencons0: using event channel 2
entropy: WARNING: extracting entropy too early
timecounter: Timecounter "xen_system_time" frequency 1000000000 Hz quality 10000
Xen vcpu0 clock: using event channel 5
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
Xen vcpu1 clock: using event channel 7
xenbus0: using event channel 1
xenbus0: autoconfiguration error: can't get state for device/suspend/event-channel (2)
IPsec: Initialized Security Association Processing.
xbd0 at xenbus0 id 0: Xen Virtual Block Device Interface
xbd0: using event channel 8
aes: Intel SSSE3 vpaes
chacha: x86 SSE2 ChaCha
adiantum: self-test passed
aes_ccm: self-test passed
blake2s: self-test passed
xbd1 at xenbus0 id 1: Xen Virtual Block Device Interface
xbd1: using event channel 9
xbd0: 2048 MB, 512 bytes/sect x 4194304 sectors
xbd0: backend features 0x1<CACHE-FLUSH>
xbd2 at xenbus0 id 2: Xen Virtual Block Device Interface
xbd2: using event channel 10
xennet0 at xenbus0 id 0: Xen Virtual Network Interface
xennet0: backend features 0x4<RX-COPY>
xennet0: MAC address aa:00:00:d1:00:0a
xennet0: using event channel 11
balloon0 at xenbus0 id 0: Xen Balloon driver
balloon0: current reservation: 2097152 KiB
xbd1: 2048 MB, 512 bytes/sect x 4194304 sectors
xbd1: backend features 0x1<CACHE-FLUSH>
xbd2: 32768 MB, 512 bytes/sect x 67108864 sectors
xbd2: backend features 0x1<CACHE-FLUSH>
cgd: self-test aes-xts-256
cgd: self-test aes-xts-512
cgd: self-test aes-cbc-128
cgd: self-test aes-cbc-256
cgd: self-test 3des-cbc-192
cgd: self-test blowfish-cbc-448
cgd: self-test aes-cbc-128 (encblkno8)
cgd: self-tests passed
xenbus0: autoconfiguration error: can't get state for device/suspend/event-channel (2)
balloon0: current reservation: 524288 pages => target: 524288 pages
xenbus0: autoconfiguration error: can't get state for device/suspend/event-channel (2)
WARNING: 3 errors while detecting hardware; check system log.
boot device: xbd0
root on xbd0a dumps on xbd0b

	
>How-To-Repeat:
	
>Fix:
	

>Unformatted: