Re: kern/56931: Panic in vfs_insmntque(): panic: TAILQ_* forw 0xffffec0928771d00 /usr/src/sys/kern/vfs_mount.c:487

[Jason Thorpe <thorpej%me.com@localhost>]

The following reply was made to PR kern/56931; it has been noted by GNATS.

From: Jason Thorpe <thorpej%me.com@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: kern-bug-people%netbsd.org@localhost,
 gnats-admin%netbsd.org@localhost,
 netbsd-bugs%netbsd.org@localhost,
 "leot%netbsd.org@localhost" <leot%NetBSD.org@localhost>
Subject: Re: kern/56931: Panic in vfs_insmntque(): panic: TAILQ_* forw
 0xffffec0928771d00 /usr/src/sys/kern/vfs_mount.c:487
Date: Sun, 17 Jul 2022 16:33:21 -0700

 > On Jul 17, 2022, at 2:55 PM, Leonardo Taccari <leot%NetBSD.org@localhost> wrote:
 >=20
 > I was able to reproduce that again when building www/webkit-gtk and at
 > least in that case I think it was while doing a `make clean' (at least
 > that was the last line I was able to read from an SSH session after it
 > get stuck and dropped to ddb(4)), the bt seems the same:
 >=20
 >  panic: TAILQ_* forw 0xffff98a871b71d00 =
 /usr/src/sys/kern/vfs_mount.c:487
 
 It=E2=80=99s blowing up here:
 
                 TAILQ_REMOVE(&vp->v_mount->mnt_vnodelist, vip, =
 vi_mntvnodes);
 
 =E2=80=A6specifically in this sanity check:
 
 #define QUEUEDEBUG_TAILQ_OP(elm, field)                                 =
 \
         if ((elm)->field.tqe_next &&                                    =
 \
             (elm)->field.tqe_next->field.tqe_prev !=3D                   =
  \
             &(elm)->field.tqe_next)                                     =
 \
                 QUEUEDEBUG_ABORT("TAILQ_* forw %p %s:%d", (elm),        =
 \
                     __FILE__, __LINE__);                                =
 \
         if (*(elm)->field.tqe_prev !=3D (elm))                           =
  \
                 QUEUEDEBUG_ABORT("TAILQ_* back %p %s:%d", (elm),        =
 \
                     __FILE__, __LINE__);
 
 =46rom your core dump, can you print out the values of those pointers?
 
 -- thorpej