>Number:         36669
>Category:       kern
>Synopsis:       NetBSD 4.0_BETA2 crashes with "panic: lockmgr: locking against myself"
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 20 12:25:00 +0000 2007
>Originator:     Matthias Scheler
>Release:        NetBSD 4.0_BETA2 built from 2007-04-28 sources
>Organization:
Matthias Scheler                                  http://zhadum.org.uk/
>Environment:
System: NetBSD colwyn.zhadum.org.uk 4.0_BETA2 NetBSD 4.0_BETA2 (COLWYN) #0: Mon Apr 30 16:00:23 BST 2007 tron@colwyn.zhadum.org.uk:/src/sys/compile/COLWYN i386
Architecture: i386
Machine: i386
>Description:
My server running NetBSD 4.0_BETA2 crashed today after 80 days of uptime
with this panic messages:

panic: lockmgr: locking against myself
Begin traceback...
uvm_fault(0xcdc601cc, 0x10000, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c036f9b0 cs 8 eflags 10246 cr2 10002 ilevel 0
panic: trap
Faulted in mid-traceback; aborting...

I have a crash dump. Here is the stack trace produced by "gdb":

#0  0xc03734db in cpu_reboot (howto=0, bootstr=0x0)
    at /usr/src/sys/arch/i386/i386/machdep.c:896
#1  0xc0303ed8 in panic (fmt=0xc04bf47f "trap")
    at /usr/src/sys/kern/subr_prf.c:246
#2  0xc037be7c in trap (frame=0xcff91704)
    at /usr/src/sys/arch/i386/i386/trap.c:339
#3  0xc010b087 in calltrap ()
#4  0xcff90010 in ?? ()
#5  0x00000030 in ?? ()
#6  0xcff90010 in ?? ()
#7  0xc01a0010 in pfr_lookup_addr (kt=0x10002, ad=0x4, exact=-805759120)
    at /usr/src/sys/dist/pf/net/pf_table.c:807
#8  0xc01a2fc3 in db_get_value (addr=65538, size=4, is_signed=0)
    at /usr/src/sys/ddb/db_access.c:62
#9  0xc0370159 in db_stack_trace_print (addr=-805758876, have_addr=1, 
    count=65535, modif=0xc04b7356 "", pr=0xc0303d00 <printf>)
    at /usr/src/sys/arch/i386/i386/db_trace.c:447
#10 0xc0303eaf in panic (fmt=0xc04e8ac0 "lockmgr: locking against myself")
    at /usr/src/sys/kern/subr_prf.c:235
#11 0xc02e0b41 in lockmgr (lkp=0x0, flags=65538, interlkp=0xd38266e4)
    at /usr/src/sys/kern/kern_lock.c:766
#12 0xc033a1c5 in genfs_lock (v=0xcff918e0)
    at /usr/src/sys/miscfs/genfs/genfs_vnops.c:309
#13 0xc0338d85 in VOP_LOCK (vp=0xd38266e4, flags=65538)
    at /usr/src/sys/kern/vnode_if.c:1228
#14 0xc0336047 in vn_lock (vp=0xd38266e4, flags=131074)
    at /usr/src/sys/kern/vfs_vnops.c:703
#15 0xc032918e in getcwd_common (lvp=0xd38266e4, rvp=0xccaf1cc4, 
    bpp=0xcff91aac, bufp=0xc33bb800 "", limit=512, flags=0, l=0xcdb9da74)
    at /usr/src/sys/kern/vfs_getcwd.c:375
#16 0xc0220035 in procfs_readlink (v=0xcff91acc)
#12 0xc033a1c5 in genfs_lock (v=0xcff918e0)
    at /usr/src/sys/miscfs/genfs/genfs_vnops.c:309
#13 0xc0338d85 in VOP_LOCK (vp=0xd38266e4, flags=65538)
    at /usr/src/sys/kern/vnode_if.c:1228
#14 0xc0336047 in vn_lock (vp=0xd38266e4, flags=131074)
    at /usr/src/sys/kern/vfs_vnops.c:703
#15 0xc032918e in getcwd_common (lvp=0xd38266e4, rvp=0xccaf1cc4,
    bpp=0xcff91aac, bufp=0xc33bb800 "", limit=512, flags=0, l=0xcdb9da74)
    at /usr/src/sys/kern/vfs_getcwd.c:375
#16 0xc0220035 in procfs_readlink (v=0xcff91acc)
    at /usr/src/sys/miscfs/procfs/procfs_vnops.c:1457
#17 0xc0338ccb in VOP_READLINK (vp=0xd59e7304, uio=0xcff91b20, cred=0xcd9c16b0)
    at /usr/src/sys/kern/vnode_if.c:1098
#18 0xc032b2a4 in namei (ndp=0xcff91bd8) at /usr/src/sys/kern/vfs_lookup.c:396
#19 0xc0331c56 in sys___stat30 (l=0xcdb9da74, v=0xcff91c48, retval=0xcff91c68)
    at /usr/src/sys/kern/vfs_syscalls.c:2424
#20 0xc037b709 in syscall_plain (frame=0xcff91c88)
    at /usr/src/sys/arch/i386/i386/syscall.c:144
#21 0xc0100623 in syscall1 ()
#22 0xcff91c88 in ?? ()
#23 0x0000001f in ?? ()
#24 0x0000001f in ?? ()
#25 0x0000001f in ?? ()
#26 0x0000001f in ?? ()
#27 0x0805fdce in ?? ()
#28 0x00000004 in ?? ()
#29 0xbfbfe1d8 in ?? ()
#30 0xbfbfe1af in ?? ()
#31 0x00000000 in ?? ()

>How-To-Repeat:
The last thing I did was a "rsync -arv --delete /tmp/subdir ." followed
by a "rm -rf /tmp/subdir". "/tmp" is a tmpfs filesystem:

tmpfs		/tmp		tmpfs	rw,-m=1777,-s=256M

>Fix:
None provided.