kern/40413: KASSERT in uao_dropswap_range1

[spz%NetBSD.org@localhost]

>Number:         40413
>Category:       kern
>Synopsis:       KASSERT in uao_dropswap_range1
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 16 07:35:01 +0000 2009
>Originator:     S.P.Zeidler
>Release:        NetBSD 5.0_BETA 20090107
>Organization:
        TNF
>Environment:
System: NetBSD pkgbuild.netbsd.org 5.0_BETA NetBSD 5.0_BETA (PKGBUILD.SCHED_M2) 
#4: Wed Jan 7 22:24:22 UTC 2009 
spz@ADMIN:/chroots/netbsd-5/src/sys/arch/amd64/compile/obj/PKGBUILD.SCHED_M2 
amd64
Architecture: x86_64
Machine: amd64
>Description:
panic: kernel diagnostic assertion "elt->count > 0" failed: file 
"/chroots/netbsd-5/src/sys/uvm/uvm_aobj.c", line 1546
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80501105 cs 8 rflags 246 cr2  7f7ffda47020 cpl 0 
rsp ffff800087641760
Stopped in pid 13017.1 (rm) at  netbsd:breakpoint+0x5:  leave
db{2}> bt
breakpoint() at netbsd:breakpoint+0x5
cpu_Debugger() at netbsd:cpu_Debugger+0x9
panic() at netbsd:panic+0x260
__kernassert() at netbsd:__kernassert+0x2d
uao_dropswap_range1() at netbsd:uao_dropswap_range1+0x299
uao_detach_locked() at netbsd:uao_detach_locked+0xe5
uao_detach() at netbsd:uao_detach+0x1f
tmpfs_free_node() at netbsd:tmpfs_free_node+0xa1
tmpfs_reclaim() at netbsd:tmpfs_reclaim+0x9b
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x61
vclean() at netbsd:vclean+0x182
vrelel() at netbsd:vrelel+0x4f0
vrele() at netbsd:vrele+0x66
vput() at netbsd:vput+0x25
tmpfs_remove() at netbsd:tmpfs_remove+0x1b7
VOP_REMOVE() at netbsd:VOP_REMOVE+0x69
do_sys_unlink() at netbsd:do_sys_unlink+0x171
sys_unlink() at netbsd:sys_unlink+0x11
syscall() at netbsd:syscall+0xb6
db{2}> sh reg
ds          0x1730
es          0x7
fs          0x8
gs          0x58ae
rdi         0
rsi         0x3f8
rbp         0xffff800087641760
rbx         0xffff800087641780
rdx         0x8
rcx         0
rax         0x1
r8          0xffffffff809d2eea  copyright+0x887aa
r9          0x1
r10         0xffff800087641690
r11         0x8
r12         0x100
r13         0xffffffff809e0ca8  copyright+0x96568
r14         0x1
r15         0
rip         0xffffffff80501105  breakpoint+0x5
cs          0x8
rflags      0x246
rsp         0xffff800087641760
ss          0x10
netbsd:breakpoint+0x5:  leave
db{2}> mach cpu 0
using CPU 0
db{2}> bt
_kernel_lock() at netbsd:_kernel_lock+0x135
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x16
Xintr_ioapic_level1() at netbsd:Xintr_ioapic_level1+0xf7
--- interrupt ---
x86_stihlt() at netbsd:x86_stihlt+0x6
x86_cpu_idle_halt() at netbsd:x86_cpu_idle_halt+0x34
idle_loop() at netbsd:idle_loop+0x198
db{2}> sh reg
ds          0
es          0
fs          0
gs          0
rdi         0x6
rsi         0xffffffff804ecb66  intr_biglock_wrapper+0x16
rbp         0xffff80006c8c7af8
rbx         0x9662bf
rdx         0x6
rcx         0
rax         0
r8          0
r9          0
r10         0
r11         0x1
r12         0x1
r13         0xffffffff80bbfcc0  cpu_info_primary
r14         0x6
r15         0xffff80006c34aba0
rip         0xffffffff80409ec5  _kernel_lock+0x135
cs          0x8
rflags      0x287
rsp         0xffff80006c8c7ab8
ss          0
netbsd:_kernel_lock+0x135:      movzbl  0x8808f4(%rip),%eax
db{2}> mach cpu 1
using CPU 1
db{2}> bt
x86_stihlt() at netbsd:x86_stihlt+0x6
x86_cpu_idle_halt() at netbsd:x86_cpu_idle_halt+0x34
idle_loop() at netbsd:idle_loop+0x198
Bad frame pointer: 0xffff80006c353420
db{2}> mach cpu 3
using CPU 3
db{2}> bt
spllower() at netbsd:spllower+0x8
ltsleep() at netbsd:ltsleep+0x70
rf_RaidIOThread() at netbsd:rf_RaidIOThread+0x16a
db{2}> sh reg
ds          0
es          0
fs          0
gs          0
rdi         0
rsi         0
rbp         0xffff80006ec4abd0
rbx         0
rdx         0x8
rcx         0
rax         0
r8          0xffff800007d29108
r9          0x1
r10         0
r11         0x8
r12         0
r13         0
r14         0x10
r15         0xffff800007d29108
rip         0xffffffff80115818  spllower+0x8
cs          0x8
rflags      0x293
rsp         0xffff80006ec4aba8
ss          0
netbsd:spllower+0x8:    movq    %rbx,%r8

>How-To-Repeat:
>Fix: