tmpfs lock error panic with mknod+S_IFMT

[Nicolas Joly <njoly%pasteur.fr@localhost>]

Hi,

While testing some linux binary, i encountered a reproductible lock
error when the program issued the following mknod call on a tmpfs
mount :

   mknod("dummy", S_IFMT|0666, 0);

Here follow the corresponding backtrace :

njoly@lanfeust [/misc/crash]> gdb netbsd.19.gdb 
GNU gdb (GDB) 7.6.1
[...]
(gdb) target kvm netbsd.19.core
#0  0xffffffff805974b5 in cpu_reboot 
(howto=howto@entry=260,bootstr=bootstr@entry=0x0) at 
/local/src/NetBSD/src/sys/arch/amd64/amd64/machdep.c:671
671                     dumpsys();
(gdb) bt
#0  0xffffffff805974b5 in cpu_reboot 
(howto=howto@entry=260,bootstr=bootstr@entry=0x0) at 
/local/src/NetBSD/src/sys/arch/amd64/amd64/machdep.c:671
#1  0xffffffff8078e0e4 in vpanic (fmt=fmt@entry=0xffffffff80c37b3d "lock 
error",ap=ap@entry=0xfffffe8112d1cba8) at 
/local/src/NetBSD/src/sys/kern/subr_prf.c:284
#2  0xffffffff8078e19f in panic (fmt=fmt@entry=0xffffffff80c37b3d "lock error") 
at /local/src/NetBSD/src/sys/kern/subr_prf.c:200
#3  0xffffffff80786a8e in lockdebug_abort 
(lock=0xfffffe8205614130,ops=ops@entry=0xffffffff80f14f10 <rwlock_lockops>,
    func=func@entry=0xffffffff80af7e83 <__func__.5768> 
"rw_vector_exit",msg=msg@entry=0xffffffff80bf7750 "assertion failed: 
RW_COUNT(rw) != 0")
    at /local/src/NetBSD/src/sys/kern/subr_lockdebug.c:858
#4  0xffffffff80532cb8 in rw_abort 
(rw=rw@entry=0xfffffe8205614130,func=func@entry=0xffffffff80af7e83 
<__func__.5768> "rw_vector_exit",
    msg=msg@entry=0xffffffff80bf7750 "assertion failed: RW_COUNT(rw) != 0") at 
/local/src/NetBSD/src/sys/kern/kern_rwlock.c:192
#5  0xffffffff80533329 in rw_vector_exit (rw=0xfffffe8205614130) at 
/local/src/NetBSD/src/sys/kern/kern_rwlock.c:444
#6  0xffffffff80323b88 in genfs_unlock (v=<optimized out>) at 
/local/src/NetBSD/src/sys/miscfs/genfs/genfs_vnops.c:409
#7  0xffffffff808bab7e in VOP_UNLOCK (vp=vp@entry=0xfffffe8205614020) at 
/local/src/NetBSD/src/sys/kern/vnode_if.c:1130
#8  0xffffffff8089ce47 in vput (vp=0xfffffe8205614020) at 
/local/src/NetBSD/src/sys/kern/vfs_vnode.c:579
#9  0xffffffff80898040 in do_sys_mknodat (l=0xfffffe8219cce0e0,fdat=<optimized 
out>,pathname=<optimized out>,mode=<optimized out>,dev=0,retval=<optimized out>,
    seg=seg@entry=UIO_USERSPACE) at 
/local/src/NetBSD/src/sys/kern/vfs_syscalls.c:2279
#10 0xffffffff80581673 in linux_sys_mknodat (l=<optimized 
out>,uap=uap@entry=0xfffffe8112d1ce80,retval=<optimized out>)
    at /local/src/NetBSD/src/sys/compat/linux/common/linux_file.c:667
#11 0xffffffff805816dc in linux_sys_mknod (l=<optimized out>,uap=<optimized 
out>,retval=<optimized out>) at 
/local/src/NetBSD/src/sys/compat/linux/common/linux_file.c:635
#12 0xffffffff80588815 in sy_call 
(rval=0xfffffe8112d1ceb8,uap=0xfffffe8112d1cf00,l=0xfffffe8219cce0e0,sy=0xffffffff80f190b0
 <linux_sysent+2128>)
    at /local/src/NetBSD/src/sys/sys/syscallvar.h:61
#13 linux_syscall (frame=0xfffffe8112d1cf00) at 
/local/src/NetBSD/src/sys/arch/amd64/amd64/linux_syscall.c:106
#14 0xffffffff80100691 in Xsyscall ()
(gdb) p panicstr
$1 = 0xffffffff80fb6f60 <scratchstr.10880> "lock error"
(gdb) p *vp
$2 = {v_uobj = {vmobjlock = 0xfffffe808755f9c0,pgops = 0xffffffff80b885a0 
<uvm_vnodeops>,memq = {tqh_first = 0x0,tqh_last = 0xfffffe8205614030},uo_npages 
= 0,uo_refs = 1,
    rb_tree = {rbt_root = 0x0,rbt_ops = 0xffffffff80b88460 
<uvm_page_tree_ops>,rbt_minmax = {0x0,0x0}},uo_ubc = {lh_first = 0x0}},v_cv = 
{cv_opaque = {0x0,0xfffffe8205614070,
      0xffffffff80c233fa}},v_size = 0,v_writesize = 0,v_iflag = 0,v_vflag = 
16,v_uflag = 0,v_numoutput = 0,v_writecount = 0,v_holdcnt = 0,v_synclist_slot = 
0,
  v_mount = 0xfffffe82246ff000,v_op = 0xfffffe8225506540,v_freelist = {tqe_next 
= 0x0,tqe_prev = 0xfffffe8166505b68},v_freelisthd = 0x0,v_mntvnodes = {tqe_next 
= 0x0,
    tqe_prev = 0xfffffe81a76a75b0},v_cleanblkhd = {lh_first = 0x0},v_dirtyblkhd 
= {lh_first = 0x0},v_synclist = {tqe_next = 0x0,tqe_prev = 0x0},v_dnclist = 
{lh_first = 0x0},
  v_nclist = {lh_first = 0xfffffe8189eeae40},v_un = {vu_mountedhere = 
0x0,vu_socket = 0x0,vu_specnode = 0x0,vu_fifoinfo = 0x0,vu_ractx = 0x0},v_type 
= VDIR,v_tag = VT_TMPFS,
  v_lock = {rw_owner = 0},v_data = 0xfffffe811a71b030,v_klist = {slh_first = 
0x0}}

Thanks.

-- 
Nicolas Joly

Biology IT Center
Institut Pasteur, Paris.