kern/39405: ffs snapshot triggers KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp)

[Manuel Bouyer <bouyer%antioche.lip6.fr@localhost>]

>Number:         39405
>Category:       kern
>Synopsis:       ffs snapshot triggers KASSERT(vp == 
>vp->v_specnode->sn_dev->sd_bdevvp)
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 25 16:10:00 +0000 2008
>Originator:     bouyer%antioche.lip6.fr@localhost
>Release:        NetBSD 4.99.72
>Organization:
>Environment:
System: NetBSD borneo 4.99.72 NetBSD 4.99.72 (XEN3_DOM0) #222: Mon Aug 25 
16:54:11 CEST 2008  
bouyer@rock:/dsk/l1/misc/bouyer/tmp/amd64/obj/dsk/l1/misc/bouyer/current/src/sys/arch/amd64/compile/XEN3_DOM0
 amd64
Architecture: amd64
Machine: amd64
>Description:
        I've found another kernel assertion triggered by ffs snapshots.
        This one occurs when taking a snapshot of /, on a filesystem different
        from /.
        (or more specifically, I suspect a storage different from /dev):

        My system has 3 filesystems (but I've also reproduced it with only 2):
borneo:/home/bouyer#df -hl
Filesystem        Size       Used      Avail %Cap Mounted on
/dev/wd0a          35G        33G       251M  99% /
/dev/wd0g          48M        35M        11M  77% /eboot
/dev/wd0h          71G        37G        30G  55% /domains2


dump -ax/snap -f /dev/null /eboot
        works fine
dump -ax/domains2/snap -f /dev/null /eboot
        works fine too
dump -ax/domains2/snap -f /dev/null /
        gives:
panic: kernel diagnostic assertion "vp == vp->v_specnode->sn_dev->sd_bdevvp" 
failed: file "/dsk/l1/misc/bouyer/current/src/sys/miscfs/specfs/spec_vnops.c", 
line 670
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff804b82fd cs e030 rflags 246 cr2  7f7ffdb868b0 
cpl 0 rsp ffffa0001b2456a0
Stopped in pid 728.1 (dump) at  netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x255
__kernassert() at netbsd:__kernassert+0x2d
spec_ioctl() at netbsd:spec_ioctl+0x106
VOP_IOCTL() at netbsd:VOP_IOCTL+0x31
fss_ioctl() at netbsd:fss_ioctl+0x6e3
VOP_IOCTL() at netbsd:VOP_IOCTL+0x31
vn_ioctl() at netbsd:vn_ioctl+0x6d
sys_ioctl() at netbsd:sys_ioctl+0x134
syscall() at netbsd:syscall+0x98


>How-To-Repeat:
        have 2 different ffs mounted, say / and /mnt
        try dump -ax/mnt/snap -f /dev/null  /
>Fix: