Re: mutex lock assertion panic in vm_page_free() on sparc64

On Tue, Feb 22, 2005 at 01:03:18PM +0200, Ruslan Ermilov wrote:
> Hi,
> 
> I'm repeatedly getting the following panic (three-four times a day)
> on sparc64 running a fresh -CURRENT, building world:
> 
> db> show msgbuf
> panic: mutex vm object not owned at /usr/src/sys/vm/vm_page.c:608
> cpuid = 0
> KDB: enter: panic
> exclusive sleep mutex vm page queue mutex r = 0 (0xc04be700) locked _at_ /usr/src/sys/sparc64/sparc64/vm_machdep.c:483
> exclusive sleep mutex UMA lock r = 0 (0xc04bdcc0) locked _at_ /usr/src/sys/vm/uma_core.c:1485
> exclusive sleep mutex Giant r = 0 (0xc0422728) locked _at_ /usr/src/sys/vm/vm_pageout.c:666
> db> where
> Tracing pid 7 tid 100016 td 0xfffff80067c0c720
> panic() at panic+0x16c
> _mtx_assert() at _mtx_assert+0x6c
> vm_page_remove() at vm_page_remove+0x34
> vm_page_free_toq() at vm_page_free_toq+0xb8
> vm_page_free() at vm_page_free+0x10
> uma_small_free() at uma_small_free+0x54
> zone_drain() at zone_drain+0x2e8
> zone_foreach() at zone_foreach+0x3c
> uma_reclaim() at uma_reclaim+0x10
> vm_pageout_scan() at vm_pageout_scan+0x13c
> vm_pageout() at vm_pageout+0x3e8
> fork_exit() at fork_exit+0x9c
> fork_trampoline() at fork_trampoline+0x8
> 
I have no idea if this is the correct fix or not, but the necessary
vm_object_t locking is certainly missing in uma_small_free() on all
architectures implementing it (alpha, amd64, ia64, powerpc, and
sparc64).

%%%
Index: vm_machdep.c
===================================================================
RCS file: /home/ncvs/src/sys/sparc64/sparc64/vm_machdep.c,v
retrieving revision 1.71
diff -u -r1.71 vm_machdep.c
--- vm_machdep.c	19 Jan 2005 18:24:07 -0000	1.71
+++ vm_machdep.c	22 Feb 2005 14:21:12 -0000
_at__at_ -67,6 +67,7 _at__at_
 #include <vm/pmap.h>
 #include <vm/vm_kern.h>
 #include <vm/vm_map.h>
+#include <vm/vm_object.h>
 #include <vm/vm_page.h>
 #include <vm/vm_pageout.h>
 #include <vm/vm_param.h>
_at__at_ -477,10 +478,14 _at__at_
 uma_small_free(void *mem, int size, u_int8_t flags)
 {
 	vm_page_t m;
+	vm_object_t object;
 
 	PMAP_STATS_INC(uma_nsmall_free);
 	m = PHYS_TO_VM_PAGE(TLB_DIRECT_TO_PHYS((vm_offset_t)mem));
+	object = m->object;
+	VM_OBJECT_LOCK(object);
 	vm_page_lock_queues();
 	vm_page_free(m);
 	vm_page_unlock_queues();
+	VM_OBJECT_UNLOCK(object);
 }
%%%


Cheers,
-- 
Ruslan Ermilov
ru_at_FreeBSD.org
FreeBSD committer