Re: kern/59663 (ffs_snapshot_read -> uvm_fault (or pool page empty) doing dump/restore with snapshot)

["Henryk Paluch via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/59663; it has been noted by GNATS.

From: Henryk Paluch <hpaluch%seznam.cz@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/59663 (ffs_snapshot_read -> uvm_fault (or pool page empty)
 doing dump/restore with snapshot)
Date: Thu, 23 Jul 2026 22:03:41 +0200

 I'm now able to reliably freeze 11.0_RC6 with this simple setup.
 
 Running on serial console as root:
 
    fssconfig -cx fss0 / /root/backup
    dd if=/dev/fss0 of=/dev/null bs=1024k
 
 At same time running on local (graphical) wscons console:
 - login as root
 - logout - typically logout freezes whole system
 
 After logout everything is frozen and idle. I was able
 to send break on serial console and dump all locks:
 
 db{0}>   show all locks/t
 
 [Locks tracked through LWPs]
 
 
 
 ****** LWP 1089.1089 (dd) @ 0xffff80f8b86db400, l_stat=3
 
 
 
 *** Locks held:
 
 
 
 * Lock 0 (initialized at netbsd:vcache_alloc+0x6b)
 
 lock address : ffff80f8b4fe1480
 
 type         : sleep/adaptive
 
 initialized  : netbsd:vcache_alloc+0x6b
 
 shared holds :                  0 exclusive:                  1
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  0 last held:                  0
 
 relevant lwp : 0xffff80f8b86db400 last held: 0xffff80f8b86db400
 
 last locked* : netbsd:genfs_lock+0x89
 
 unlocked     : netbsd:genfs_unlock+0x14
 
 owner/count  : 0xffff80f8b86db400 flags    : 0x0000000000000004
 
 Turnstile: no active turnstile for this lock.
 
 
 
 *** Locks wanted: none
 
 
 
 *** Traceback:
 
 
 
 trace: pid 1089 lid 1089 at 0xffffa980c2c1fc20
 
 sleepq_block() at netbsd:sleepq_block+0xee
 
 cv_timedwait() at netbsd:cv_timedwait+0xd4
 
 bbusy() at netbsd:bbusy+0xe3
 
 getblk() at netbsd:getblk+0x68
 
 bio_doread() at netbsd:bio_doread+0x1d
 
 bread() at netbsd:bread+0x18
 
 spec_read() at netbsd:spec_read+0x1e6
 
 VOP_READ() at netbsd:VOP_READ+0x42
 
 vn_read() at netbsd:vn_read+0x136
 
 dofileread() at netbsd:dofileread+0x79
 
 sys_read() at netbsd:sys_read+0x49
 
 syscall() at netbsd:syscall+0x9d
 
 --- syscall (number 3) ---
 
 netbsd:syscall+0x9d:
 
 
 
 
 
 ****** LWP 850.850 (login) @ 0xffff80f8b822f000, l_stat=3
 
 
 
 *** Locks held:
 
 
 
 * Lock 0 (initialized at netbsd:fork1+0x1e5)
 
 lock address : ffff80f8b84e2710
 
 type         : sleep/adaptive
 
 initialized  : netbsd:fork1+0x1e5
 
 shared holds :                  0 exclusive:                  1
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  0 last held:                  0
 
 relevant lwp : 0xffff80f8b822f000 last held: 0xffff80f8b822f000
 
 last locked* : netbsd:exit1+0x11c
 
 unlocked     : netbsd:execve_runproc+0x95d
 
 owner/count  : 0xffff80f8b822f000 flags    : 0x0000000000000004
 
 Turnstile: no active turnstile for this lock.
 
 
 
 * Lock 1 (initialized at netbsd:fstrans_init+0x1b)
 
 lock address : netbsd:vfs_suspend_lock
 
 type         : sleep/adaptive
 
 initialized  : netbsd:fstrans_init+0x1b
 
 shared holds :                  0 exclusive:                  1
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  0 last held:                  0
 
 relevant lwp : 0xffff80f8b822f000 last held: 0xffff80f8b822f000
 
 last locked* : netbsd:vfs_suspend+0xd2
 
 unlocked     : netbsd:ffs_snapshot+0x67c
 
 owner field  : 0xffff80f8b822f000 wait/spin:                0/0
 
 Turnstile: no active turnstile for this lock.
 
 
 
 *** Locks wanted: none
 
 
 
 *** Traceback:
 
 
 
 trace: pid 850 lid 850 at 0xffffa980c2c26cd0
 
 sleepq_block() at netbsd:sleepq_block+0xee
 
 cv_wait_sig() at netbsd:cv_wait_sig+0xd2
 
 fstrans_setstate() at netbsd:fstrans_setstate+0x10c
 
 genfs_suspendctl() at netbsd:genfs_suspendctl+0x32
 
 VFS_SUSPENDCTL() at netbsd:VFS_SUSPENDCTL+0x25
 
 vfs_suspend() at netbsd:vfs_suspend+0x8d
 
 vrevoke_suspend_next() at netbsd:vrevoke_suspend_next+0x2a
 
 vrevoke() at netbsd:vrevoke+0x44
 
 genfs_revoke() at netbsd:genfs_revoke+0x13
 
 VOP_REVOKE() at netbsd:VOP_REVOKE+0x3b
 
 exit1() at netbsd:exit1+0x7bd
 
 sys_exit() at netbsd:sys_exit+0x3b
 
 syscall() at netbsd:syscall+0x9d
 
 --- syscall (number 1) ---
 
 netbsd:syscall+0x9d:
 
 
 
 
 
 ****** LWP 309.309 (dhcpcd) @ 0xffff80f8b822f800, l_stat=3
 
 
 
 *** Locks held: none
 
 
 
 *** Locks wanted:
 
 
 
 * Lock 0 (initialized at netbsd:module_hook_init+0x17)
 
 lock address : netbsd:module_hook
 
 type         : sleep/adaptive
 
 initialized  : netbsd:module_hook_init+0x17
 
 shared holds :                  0 exclusive:                  0
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  1 last held:                  0
 
 relevant lwp : 0xffff80f8b822f800 last held: 000000000000000000
 
 last locked  : 0
 
 unlocked*    : 0
 
 owner field  : 000000000000000000 wait/spin:                0/0
 
 Turnstile: no active turnstile for this lock.
 
 
 
 *** Traceback:
 
 
 
 trace: pid 309 lid 309 at 0xffffa980c3a24d10
 
 sleepq_block() at netbsd:sleepq_block+0xee
 
 sel_do_scan() at netbsd:sel_do_scan+0x5a2
 
 pollcommon() at netbsd:pollcommon+0xbb
 
 sys___pollts50() at netbsd:sys___pollts50+0x68
 
 syscall() at netbsd:syscall+0x9d
 
 --- syscall (number 437) ---
 
 netbsd:syscall+0x9d:
 
 
 
 
 
 ****** LWP 308.308 (dhcpcd) @ 0xffff80f8b86bfc00, l_stat=3
 
 
 
 *** Locks held: none
 
 
 
 *** Locks wanted:
 
 
 
 * Lock 0 (initialized at netbsd:module_hook_init+0x17)
 
 lock address : netbsd:module_hook
 
 type         : sleep/adaptive
 
 initialized  : netbsd:module_hook_init+0x17
 
 shared holds :                  0 exclusive:                  0
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  0 last held:                  0
 
 relevant lwp : 0xffff80f8b86bfc00 last held: 000000000000000000
 
 last locked  : 0
 
 unlocked*    : 0
 
 owner field  : 000000000000000000 wait/spin:                0/0
 
 Turnstile: no active turnstile for this lock.
 
 
 
 *** Traceback:
 
 
 
 trace: pid 308 lid 308 at 0xffffa980c2c64d10
 
 sleepq_block() at netbsd:sleepq_block+0x230
 
 sel_do_scan() at netbsd:sel_do_scan+0x5a2
 
 pollcommon() at netbsd:pollcommon+0xbb
 
 sys___pollts50() at netbsd:sys___pollts50+0x68
 
 syscall() at netbsd:syscall+0x9d
 
 --- syscall (number 437) ---
 
 netbsd:syscall+0x9d:
 
 
 
 
 
 ****** LWP 0.26 (softclk/1) @ 0xffff80f87d1ba000, l_stat=1
 
 
 
 *** Locks held: none
 
 
 
 *** Locks wanted:
 
 
 
 * Lock 0 (initialized at netbsd:module_hook_init+0x17)
 
 lock address : netbsd:module_hook
 
 type         : sleep/adaptive
 
 initialized  : netbsd:module_hook_init+0x17
 
 shared holds :                  0 exclusive:                  0
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  1 last held:                  0
 
 relevant lwp : 0xffff80f87d1ba000 last held: 000000000000000000
 
 last locked  : 0
 
 unlocked*    : 0
 
 owner field  : 000000000000000000 wait/spin:                0/0
 
 Turnstile: no active turnstile for this lock.
 
 
 
 *** Traceback:
 
 
 
 trace: pid 0 lid 26 at 0xffff80f87d2bf840
 
 cpu_intr_p() at netbsd:cpu_intr_p+0x36
 
 Bad user frame pointer: 0xffff80f87d2bf800
 
 
 
 
 
 ****** LWP 0.11 (iflnkst) @ 0xffff80f8b88f0400, l_stat=3
 
 
 
 *** Locks held: none
 
 
 
 *** Locks wanted:
 
 
 
 * Lock 0 (initialized at netbsd:module_hook_init+0x17)
 
 lock address : netbsd:module_hook
 
 type         : sleep/adaptive
 
 initialized  : netbsd:module_hook_init+0x17
 
 shared holds :                  0 exclusive:                  0
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  1 last held:                  0
 
 relevant lwp : 0xffff80f8b88f0400 last held: 000000000000000000
 
 last locked  : 0
 
 unlocked*    : 0
 
 owner field  : 000000000000000000 wait/spin:                0/0
 
 Turnstile: no active turnstile for this lock.
 
 
 
 *** Traceback:
 
 
 
 trace: pid 0 lid 11 at 0xffffa980b2604f60
 
 sleepq_block() at netbsd:sleepq_block+0xee
 
 cv_wait() at netbsd:cv_wait+0xca
 
 workqueue_worker() at netbsd:workqueue_worker+0x97
 
 
 
 
 
 ****** LWP 0.0 (swapper) @ 0xffffffff81a8be80, l_stat=3
 
 
 
 *** Locks held: none
 
 
 
 *** Locks wanted:
 
 
 
 * Lock 0 (initialized at netbsd:module_hook_init+0x17)
 
 lock address : netbsd:module_hook
 
 type         : sleep/adaptive
 
 initialized  : netbsd:module_hook_init+0x17
 
 shared holds :                  0 exclusive:                  0
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  0 last held:                  0
 
 relevant lwp : 0xffffffff81a8be80 last held: 000000000000000000
 
 last locked  : 0
 
 unlocked*    : 0
 
 owner field  : 000000000000000000 wait/spin:                0/0
 
 Turnstile: no active turnstile for this lock.
 
 
 
 *** Traceback:
 
 
 
 trace: pid 0 lid 0 at 0xffffffff81f5de90
 
 sleepq_block() at netbsd:sleepq_block+0x230
 
 uvm_scheduler() at netbsd:uvm_scheduler+0x6f
 
 main() at netbsd:main+0x782
 
 
 
 
 
 [Locks tracked through CPUs]
 
 
 
 ******* Locks held on cpu0:
 
 
 
 * Lock 0 (initialized at netbsd:com_attach_subr+0xba)
 
 lock address : ffff80f87d3323a0
 
 type         : spin
 
 initialized  : netbsd:com_attach_subr+0xba
 
 shared holds :                  0 exclusive:                  1
 
 shares wanted:                  0 exclusive:                  0
 
 relevant cpu :                  0 last held:                  0
 
 relevant lwp : 0xffff80f8b8c5d000 last held: 0xffff80f8b8c5d000
 
 last locked* : netbsd:comintr+0x4b
 
 unlocked     : netbsd:comsoft+0x1b9
 
 owner field  : 0x0000000000010800 wait/spin:                0/1
 
 trace: pid 0 lid 2 at 0xffffa980b2178db8
 
 breakpoint() at netbsd:breakpoint+0x5
 
 comintr() at netbsd:comintr+0x840
 
 intr_wrapper() at netbsd:intr_wrapper+0x4b
 
 Xhandle_ioapic_edge1() at netbsd:Xhandle_ioapic_edge1+0x75
 
 --- interrupt ---
 
 x86_stihlt() at netbsd:x86_stihlt+0x6
 
 acpicpu_cstate_idle() at netbsd:acpicpu_cstate_idle+0x19a
 
 idle_loop() at netbsd:idle_loop+0x13d
 
 
 
 
 To me most suspicious is that:
 
 1. dd is sleeping with:
 
 trace: pid 1089 lid 1089 at 0xffffa980c2c1fc20
 
 sleepq_block() at netbsd:sleepq_block+0xee
 
 cv_timedwait() at netbsd:cv_timedwait+0xd4
 
 bbusy() at netbsd:bbusy+0xe3
 
 getblk() at netbsd:getblk+0x68
 
 bio_doread() at netbsd:bio_doread+0x1d
 
 bread() at netbsd:bread+0x18
 
 spec_read() at netbsd:spec_read+0x1e6
 
 VOP_READ() at netbsd:VOP_READ+0x42
 
 vn_read() at netbsd:vn_read+0x136
 
 dofileread() at netbsd:dofileread+0x79
 
 sys_read() at netbsd:sys_read+0x49
 
 syscall() at netbsd:syscall+0x9d
 
 --- syscall (number 3) ---
 
 netbsd:syscall+0x9d:
 
 2. and logout (sys_exit) is also sleeping:
 
 trace: pid 850 lid 850 at 0xffffa980c2c26cd0
 
 sleepq_block() at netbsd:sleepq_block+0xee
 
 cv_wait_sig() at netbsd:cv_wait_sig+0xd2
 
 fstrans_setstate() at netbsd:fstrans_setstate+0x10c
 
 genfs_suspendctl() at netbsd:genfs_suspendctl+0x32
 
 VFS_SUSPENDCTL() at netbsd:VFS_SUSPENDCTL+0x25
 
 vfs_suspend() at netbsd:vfs_suspend+0x8d
 
 vrevoke_suspend_next() at netbsd:vrevoke_suspend_next+0x2a
 
 vrevoke() at netbsd:vrevoke+0x44
 
 genfs_revoke() at netbsd:genfs_revoke+0x13
 
 VOP_REVOKE() at netbsd:VOP_REVOKE+0x3b
 
 exit1() at netbsd:exit1+0x7bd
 
 sys_exit() at netbsd:sys_exit+0x3b
 
 syscall() at netbsd:syscall+0x9d
 
 --- syscall (number 1) ---
 
 netbsd:syscall+0x9d:
 
 
 
 In other words basically all processes are sleeping/waiting but there is 
 nothing that would wake them up...