kern/42149: wapbl locking panic if watching DVD

[m.drochner%fz-juelich.de@localhost]

>Number:         42149
>Category:       kern
>Synopsis:       wapbl locking panic if watching DVD
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 04 16:05:00 +0000 2009
>Originator:     Matthias Drochner
>Release:        current of end-September
>Organization:
>Environment:
i386, DIAGNOSTIC+DEBUG kernel,
root filesystem is ffs+wapbl
>Description:
If I either finish watching a DVD (using vlc) or invoke a "sync" during 
playback, the kernel panics:
#9  0xc045801d in panic (
    fmt=0xc06ef044 "kernel %sassertion \"%s\" failed: file \"%s\", line %d")
    at ../../../../kern/subr_prf.c:293
#10 0xc05a0a19 in __kernassert (t=0xc067d24a "diagnostic ", 
    f=0xc06e9952 "../../../../kern/vfs_wapbl.c", l=1543, 
    e=0xc06e9a11 "rw_lock_held(&wl->wl_rwlock)")
    at ../../../../../../lib/libkern/__assert.c:50
#11 0xc055246c in wapbl_jlock_assert (wl=0xc1c37500)
    at ../../../../kern/vfs_wapbl.c:1543
#12 0xc0552744 in wapbl_add_buf (wl=0xc1c37500, bp=0xc1b5abb0)
    at ../../../../kern/vfs_wapbl.c:852
#13 0xc053cd9b in bdwrite (bp=0xc1b5abb0) at ../../../../kern/vfs_bio.c:917
#14 0xc0224676 in ffs_update (vp=0xcc3030bc, acc=0x0, mod=0x0, 
    updflags=<value optimized out>) at ../../../../ufs/ffs/ffs_inode.c:193
#15 0xc0230555 in ffs_full_fsync (vp=0xcc3030bc, flags=16)
    at ../../../../ufs/ffs/ffs_vnops.c:559
#16 0xc0230647 in ffs_fsync (v=0xe6212c28)
    at ../../../../ufs/ffs/ffs_vnops.c:293
#17 0xc0560b00 in VOP_FSYNC (vp=0xcc3030bc, cred=0xcc6e0240, flags=16, 
    offlo=0, offhi=0) at ../../../../kern/vnode_if.c:680
#18 0xc022f8d4 in ffs_sync (mp=0xcc123004, waitfor=2, cred=0xcc6e0240)
    at ../../../../ufs/ffs/ffs_vfsops.c:1638
#19 0xc0545814 in VFS_SYNC (mp=0xcc123004, a=2, b=0xcc6e0240)
    at ../../../../kern/vfs_subr.c:3058
#20 0xc054ec98 in sys_sync (l=0xe6161a80, v=0xe6212d00, retval=0xe6212d28)
    at ../../../../kern/vfs_syscalls.c:781
#21 0xc046d721 in syscall (frame=0xe6212d48) at ../../../../sys/syscallvar.h:61
#22 0xc010058e in syscall1 ()

(In the former cast the initial syscall is close() but the stackframe is 
identical otherwise.)

[up ...]
#15 0xc0230555 in ffs_full_fsync (vp=0xcc3030bc, flags=16)
    at ../../../../ufs/ffs/ffs_vnops.c:559
559             error = ffs_update(vp, NULL, NULL, UPDATE_CLOSE | waitfor);
(gdb) print *vp
$1 = {v_uobj = {vmobjlock = {u = {mtxa_owner = 0}}, pgops = 0xc0673fc8, 
    memq = {tqh_first = 0x0, tqh_last = 0xcc3030c4}, uo_npages = 0, 
    uo_refs = 2, rb_tree = {rbt_root = 0x0, rbt_ops = 0xc0673e20, 
      rbt_minmax = {0x0, 0x0}}}, v_cv = {cv_opaque = {0x0, 0xcc3030e4, 
      0xc06e9606}}, v_size = 0, v_writesize = 0, v_iflag = 0, v_vflag = 48, 
  v_uflag = 0, v_numoutput = 0, v_writecount = 0, v_holdcnt = 6438, 
  v_synclist_slot = 0, v_mount = 0xcc123004, v_op = 0xcb30e19c, v_freelist = {
    tqe_next = 0xcc394e60, tqe_prev = 0xe547234c}, v_freelisthd = 0x0, 
  v_mntvnodes = {tqe_next = 0xe5528514, tqe_prev = 0xcc3031e8}, 
  v_cleanblkhd = {lh_first = 0xc2236794}, v_dirtyblkhd = {lh_first = 0x0}, 
  v_synclist = {tqe_next = 0x0, tqe_prev = 0x0}, v_dnclist = {lh_first = 0x0}, 
  v_nclist = {lh_first = 0xcc301180}, v_un = {vu_mountedhere = 0xcc29ed84, 
    vu_socket = 0xcc29ed84, vu_specnode = 0xcc29ed84, 
    vu_fifoinfo = 0xcc29ed84, vu_ractx = 0xcc29ed84}, v_type = VBLK, 
  v_tag = VT_UFS, v_lock = {vl_lock = {rw_owner = 3860208260}, 
    vl_canrecurse = 0, vl_recursecnt = 0}, v_vnlock = 0xcc30315c, 
  v_data = 0xcc302154, v_klist = {slh_first = 0x0}}
(gdb) print *vp->v_un.vu_specnode
$2 = {sn_next = 0xcc3038a4, sn_dev = 0xcc29ee4c, sn_opencnt = 1, 
  sn_rdev = 1539, sn_gone = false}
(gdb) print *vp->v_un.vu_specnode.sn_dev
$3 = {sd_mountpoint = 0x0, sd_lockf = 0x0, sd_bdevvp = 0xcc3030bc, 
  sd_opencnt = 1, sd_refcnt = 1, sd_rdev = 1539}
(gdb) print *vp->v_mount                
$4 = {mnt_list = {cqe_next = 0xcc234604, cqe_prev = 0xc0731838}, 
  mnt_vnodelist = {tqh_first = 0xcb8abb80, tqh_last = 0xe524aedc}, 
  mnt_op = 0xc0702200, mnt_vnodecovered = 0x0, mnt_syncer = 0xcc1d4178, 
  mnt_transinfo = 0xcb893cc0, mnt_data = 0xc1c37a00, mnt_unmounting = {
    rw_owner = 16}, mnt_renamelock = {u = {mtxa_owner = 0}}, 
  mnt_refcnt = 2418, mnt_recursecnt = 0, mnt_flag = 33574912, mnt_iflag = 448, 
  mnt_fs_bshift = 13, mnt_dev_bshift = 9, mnt_stat = {f_flag = 0, 
    f_bsize = 8192, f_frsize = 1024, f_iosize = 8192, f_blocks = 254551, 
    f_bfree = 32246, f_bavail = 19519, f_bresvd = 12727, f_files = 63358, 
    f_ffree = 44309, f_favail = 44309, f_fresvd = 0, f_syncreads = 8549, 
    f_syncwrites = 0, f_asyncreads = 0, f_asyncwrites = 305, f_fsidx = {
      __fsid_val = {0, 1931}}, f_fsid = 0, f_namemax = 255, f_owner = 0, 
    f_spare = {0, 0, 0, 0}, f_fstypename = "ffs", '\0' <repeats 28 times>, 
    f_mntonname = "/", '\0' <repeats 1022 times>, 
    f_mntfromname = "/dev/wd0a", '\0' <repeats 1014 times>}, 
  mnt_specdataref = {specdataref_container = 0x0, specdataref_lock = {u = {
        mtxa_owner = 0}}}, mnt_updating = {u = {mtxa_owner = 3860208256}}, 
  mnt_wapbl_op = 0xc0731900, mnt_wapbl = 0xc1c37500, mnt_wapbl_replay = 0x0, 
  mnt_gen = 2}


So as this shows the device node is /dev/cd0d --the block device-- which is 
somewhat unintentional but should of course not cause a panic.
>How-To-Repeat:
Play a DVD (using /dev/cd0d).
>Fix:
???