panic: getnewbuf: locked buf

I just got a new panic on a high load situation. Kernel dump is
available if needed.

This is RELENG_5 from yesterday:

FreeBSD 5.3-BETA1 #0: Mon Aug 23 11:11:23 CEST 2004
    toor_at_mx3:/usr/obj/usr/src/sys/MAIL

debug.mpsafenet is set to 1. It's a Dual Opteron with SCHED_4BSD,
ADAPTIVE_GIANT, and no WITNESS or INVARIANTS.

panic: getnewbuf: locked buf
cpuid = 1;
KDB: enter: panic

db> where
kdb_enter(c089bd0a,1,c089f5d3,e9a75930,2) at kdb_enter+0x30
panic(c089f5d3,80012,0,c4903dc0,d7611bdc) at panic+0x14a
getnewbuf(0,0,800,4000,c07a7367) at getnewbuf+0x2cd
getblk(c47ef528,0,0,800,0) at getblk+0x494
ffs_balloc_ufs2(c47ef528,0,0,130,c3c95e80) at ffs_balloc_ufs2+0x116b
ffs_write(e9a75c08,20002,c4903dc0,c07db27c,e9a75c5c) at ffs_write+0x388
vn_write(c4acfd48,e9a75c7c,c3c95e80,0,c4903dc0) at vn_write+0x237
dofilewrite(c4903dc0,c4acfd48,3,9ed3000,130) at dofilewrite+0xb6
write(c4903dc0,e9a75d14,c,c4903dc0,c3e76258) at write+0x6a
syscall(2f,2f,2f,9ed3000,282a47a0) at syscall+0x300
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (4, FreeBSD ELF32, write), eip = 0x2821a503, esp = 0xbfbfe23c, ebp = 0xbfbfe258 ---

#24 0xc0653eec in panic (fmt=0xc089f5d3 "getnewbuf: locked buf") at
/usr/src/sys/kern/kern_shutdown.c:542
#25 0xc06a34fd in getnewbuf (slpflag=0, slptimeo=0, size=2048, maxsize=16384) at
/usr/src/sys/kern/vfs_bio.c:1879
#26 0xc06a4dd2 in getblk (vp=0xc47ef528, blkno=0, size=2048, slpflag=0,
slptimeo=0, flags=0)
    at /usr/src/sys/kern/vfs_bio.c:2586
#27 0xc07ae824 in ffs_balloc_ufs2 (vp=0xc47ef528, startoffset=Unhandled dwarf
expression opcode 0x93
) at /usr/src/sys/ufs/ffs/ffs_balloc.c:640
#28 0xc07c5f6f in ffs_write (ap=0xe9a75c08) at
/usr/src/sys/ufs/ffs/ffs_vnops.c:650
#29 0xc06c2608 in vn_write (fp=0xc4acfd48, uio=0xe9a75c7c,
active_cred=0xc3c95e80, flags=0, td=0xc4903dc0)
    at vnode_if.h:432
#30 0xc0678b5e in dofilewrite (td=0xc4903dc0, fp=0xc4acfd48, fd=0, buf=0x0,
nbyte=3230631136, offset=Unhandled dwarf expression opcode 0x93
) at file.h:246
#31 0xc06789c7 in write (td=0xc4903dc0, uap=0xe9a75d14) at
/usr/src/sys/kern/sys_generic.c:282
#32 0xc0834224 in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 166539264, tf_esi =
673859488, tf_ebp = -1077943720, tf_isp = -374907532, tf_ebx = 673781228, tf_edx
= 673859488, tf_ecx = 673859488, tf_eax = 4, tf_trapno = 12, tf_err = 2, tf_eip
= 673293571, tf_cs = 31, tf_eflags = 514, tf_esp = -1077943748, tf_ss = 47}) at
/usr/src/sys/i386/i386/trap.c:1004
#33 0xc081ff3f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:201

(kgdb) frame 25
#25 0xc06a34fd in getnewbuf (slpflag=0, slptimeo=0, size=2048, maxsize=16384) at
/usr/src/sys/kern/vfs_bio.c:1879
1879                            panic("getnewbuf: locked buf");
(kgdb) list
1874                     * Start freeing the bp.  This is somewhat involved.
nbp
1875                     * remains valid only for QUEUE_EMPTY[KVA] bp's.
1876                     */
1877
1878                    if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT, NULL) != 0)
1879                            panic("getnewbuf: locked buf");
1880                    bremfreel(bp);
1881                    mtx_unlock(&bqlock);
1882
1883                    if (qindex == QUEUE_CLEAN) {

(kgdb) p *bp
$2 = {b_io = {bio_cmd = 2 '\002', bio_flags = 2 '\002', bio_cflags = 0 '\0',
bio_pflags = 0 '\0', bio_dev = 0x0,    bio_disk = 0x0, bio_offset = 1734344704, bio_bcount = 16384,
bio_data = 0xd7c60000 <Address 0xd7c60000 out of bounds>, bio_error = 0,
bio_resid = 0,bio_done = 0xc06a5db8 <bufdonebio>, bio_driver1 = 0x0, bio_driver2 = 0x0,
bio_caller1 = 0x0,bio_caller2 = 0xd752b2e4, bio_queue = {tqe_next = 0x0, tqe_prev = 0x0},
bio_attribute = 0x0, bio_from = 0x0,bio_to = 0x0, bio_length = 0, bio_completed = 0, bio_children = 3, bio_inbed
= 0, bio_parent = 0x0, bio_t0 = {sec = 0, frac = 0}, bio_task = 0, bio_task_arg = 0x0, bio_pblkno = 0},
b_op = 0xc08f67c8, b_magic = 280038160,
b_iodone = 0, b_blkno = 3387392, b_offset = 1734344704, b_vnbufs = {tqe_next =
0xd778faac, tqe_prev = 0xd75f6f4c},
b_left = 0xd75f6eac, b_right = 0xd778faac, b_vflags = 0, b_freelist =
{tqe_next = 0xd752bed0,
tqe_prev = 0xc095c838}, b_qindex = 3, b_flags = 139808, b_xflags = 0 '\0',
b_lock = {lk_interlock = 0xc09554a4,
lk_flags = 2097664, lk_sharecount = 0, lk_waitcount = 2, lk_exclusivecount =
0, lk_prio = 80,
lk_wmesg = 0xc089f36a "bufwait", lk_timo = 0, lk_lockholder = 0xffffffff,
lk_newlock = 0x0}, b_bufsize = 0,
b_runningbufspace = 0, b_kvabase = 0xd7c60000 <Address 0xd7c60000 out of
bounds>, b_kvasize = 16384,
b_lblkno = 3387392, b_vp = 0x0, b_object = 0x0, b_dirtyoff = 0, b_dirtyend =
0, b_rcred = 0x0, b_wcred = 0x0,
b_saveaddr = 0xd7c60000, b_pager = {pg_reqpage = 0}, b_cluster = {cluster_head
= {tqh_first = 0x0,
tqh_last = 0x0}, cluster_entry = {tqe_next = 0x0, tqe_prev = 0x0}},
b_pages = {0x0 <repeats 32 times>},
b_npages = 0, b_dep = {lh_first = 0x0}}

Martin

Martin Blapp, <mb_at_imp.ch> <mbr_at_FreeBSD.org>
------------------------------------------------------------------
ImproWare AG, UNIXSP & ISP, Zurlindenstrasse 29, 4133 Pratteln, CH
Phone: +41 61 826 93 00 Fax: +41 61 826 93 01
PGP: <finger -l mbr_at_freebsd.org>
PGP Fingerprint: B434 53FC C87C FE7B 0A18 B84C 8686 EF22 D300 551E
------------------------------------------------------------------