kern/60820: LFS in-kernel cleaner can enter deadlock with build.sh

["clare%csel.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60820
>Category:       kern
>Synopsis:       LFS in-kernel cleaner can enter deadlock with build.sh
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Sep 28 21:40:00 +0000 2026
>Originator:     Shinichi Doyashiki
>Release:        11.99.8 around 2026-09-28 04:00 JST
>Organization:
at home
>Environment:
NetBSD kanade2.hq.csel.org 11.99.8 NetBSD 11.99.8 (KANADE2_12) #27: Mon Sep 28 04:34:19 JST 2026  clare%kanade2.hq.csel.org@localhost:/export/netbsd/debuglfs/src/sys/arch/amd64/compile/KANADE2_12 amd64
>Description:
LFS in-kernel cleaner can enter deadlock with build.sh
reproducibility is currently unknown

db{0}> ps
PID     LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
3229   3229 3   0         0   ffff89ac014a4800               find prelockcv
10122 10122 3   1         0   ffff89ac5c118400                 rm prelockcv
0     21402 3   2       200   ffff89a80059f400        lfs_cleaner vnode
0      8556 3   3       200   ffff89abe64d2000         lfs_writer lfswrite
0       169 3   3       240   ffff89a7f8561c00            ioflush prelockcv
0        12 3   0       200   ffff89af30ab7800             lfsswq lfsswq
0        11 3   2       200   ffff89af30ab7400             lfscwq lfscwq

find process

db{0}> bt /a ffff89ac014a4800
trace: pid 3229 lid 3229 at 0xffff9c894c8ccd20
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
lfs_prelock() at netbsd:lfs_prelock+0x59
lfs_itimes() at netbsd:lfs_itimes+0x3c6
lfs_close() at netbsd:lfs_close+0x81
VOP_CLOSE() at netbsd:VOP_CLOSE+0xa0
vn_close() at netbsd:vn_close+0x34
closef() at netbsd:closef+0xa1
fd_close() at netbsd:fd_close+0xf3
sys_close() at netbsd:sys_close+0x22
syscall() at netbsd:syscall+0x9d
--- syscall (number 6) ---
netbsd:syscall+0x9d:

rm process

db{0}> bt /a ffff89ac5c118400
trace: pid 10122 lid 10122 at 0xffff9c895e5fbc00
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
lfs_prelock() at netbsd:lfs_prelock+0x59
lfs_vfree() at netbsd:lfs_vfree+0xc2
lfs_reclaim() at netbsd:lfs_reclaim+0x275
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x60
vcache_reclaim() at netbsd:vcache_reclaim+0x19e
vrelel() at netbsd:vrelel+0x24d
lfs_remove() at netbsd:lfs_remove+0xca
VOP_REMOVE() at netbsd:VOP_REMOVE+0xe7
do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x2bc
syscall() at netbsd:syscall+0x9d
--- syscall (number 10) ---
netbsd:syscall+0x9d:

lfs_cleaner thread

db{0}> bt /a ffff89a80059f400
trace: pid 0 lid 21402 at 0xffff9c8949164a80
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
vstate_assert_wait_stable() at netbsd:vstate_assert_wait_stable+0x4b
vcache_vget() at netbsd:vcache_vget+0x34
vcache_get() at netbsd:vcache_get+0x31b
lfs_vget() at netbsd:lfs_vget+0x23
finfo_func_checkempty() at netbsd:finfo_func_checkempty+0xe2
lfs_parse_pseg() at netbsd:lfs_parse_pseg+0x39f
lfs_checkempty() at netbsd:lfs_checkempty+0xee
lfs_markclean() at netbsd:lfs_markclean+0x3e
lfs_auto_segclean() at netbsd:lfs_auto_segclean+0x24b
lfs_segunlock() at netbsd:lfs_segunlock+0x781
lfs_segwrite() at netbsd:lfs_segwrite+0x531
lfs_cleanerd() at netbsd:lfs_cleanerd+0x89e

db{0}> bt /a ffff89abe64d2000
trace: pid 0 lid 8556 at 0xffff9c895448bf50
sleepq_block() at netbsd:sleepq_block+0x233
cv_timedwait() at netbsd:cv_timedwait+0xd4
lfs_writerd() at netbsd:lfs_writerd+0x3ad

ioflush

db{0}> bt /a ffff89a7f8561c00
trace: pid 0 lid 169 at 0xffff9c8946d5ce20
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
lfs_prelock() at netbsd:lfs_prelock+0x59
lfs_seglock() at netbsd:lfs_seglock+0x16
lfs_segwrite() at netbsd:lfs_segwrite+0x71
lfs_sync() at netbsd:lfs_sync+0xc6
VFS_SYNC() at netbsd:VFS_SYNC+0x22
sched_sync() at netbsd:sched_sync+0xd6

db{0}> bt /a ffff89af30ab7800
trace: pid 0 lid 12 at 0xffff9c8936382f60
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
workqueue_worker() at netbsd:workqueue_worker+0x90

db{0}> bt /a ffff89af30ab7400
trace: pid 0 lid 11 at 0xffff9c893637bf60
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
workqueue_worker() at netbsd:workqueue_worker+0x90

db{0}> call fstrans_dump(0)
Fstrans locks by lwp:
[ 88245.5130885] 3229.322 (/lfs) shared 1 cow 0 alias 0
[ 88245.5130885] 10122.10 (/lfs) shared 2 cow 0 alias 0
[ 88245.5130885] 0.21402  (/lfs) shared 1 cow 0 alias 0
[ 88245.5130885] 0.169    (/lfs) shared 1 cow 0 alias 0
[ 88245.5130885] Fstrans state by mount:
0

db{0}> show all locks
PID     LID CPU       STRUCT LWP *              OWNER BITS LOCK


>How-To-Repeat:
$ cat /run-build.sh 
#!/bin/sh
TMPDIR=/tmp
export TMPDIR

OBJMACHINE=yes
export OBJMACHINE

testdir=/lfs/netbsd/current

while true; do
  if fsck_lfs -nf /lfs; then
    echo "===> FSCK OK";
  else
    echo "===> FSCK ERROR";
    exit 1
  fi
  if mount /lfs; then
    echo "===> MOUNT OK";
  else
    echo "===> MOUNT ERROR";
    exit 1
  fi
  rm ${testdir}/build.log
  for machine in amd64; do
    (
    cd ${testdir}/src || exit
    tooldir=${testdir}/tools.${machine}
    destdir=${testdir}/destdir.${machine}
    objdir=${testdir}/objdir.${machine}
    releasedir=${testdir}/release.test
    rm -rf ${tooldir}
    rm -rf ${destdir}
    rm -rf ${objdir}
    rm -rf ${releasedir}
    mkdir -p ${objdir}
    ./build.sh -m ${machine} \
        -j 5 \
        -U \
        -O ${objdir} \
        -D ${destdir} \
        -R ${releasedir} \
        -T ${tooldir} \
        release
    ) 2>&1 | tee ${testdir}/build.log
  done
  sync
  if umount /lfs; then
    echo "===> UMOUNT OK";
  else
    echo "===> UMOUNT ERROR";
    exit 1
  fi
done

>Fix:
unknown