Re: LOR from vm_map_lookup() leads to fatal trap:

On Fri, Jun 03, 2005 at 07:03:07AM -0700, othermark wrote:
> I have not seen this before, from -current built from 6/31/2005.  This was
> NOT found on the LOR page (http://sources.zabbadoz.net/freebsd/lor.html),
> so I'm posting it here.

It's not a real lock order reversal -- it just happened to occur while
your kernel was on a journey toward a panic.  That mtx_lock() call in
do_tdsignal() was operating on a bogus struct mtx * (0xaa8).

> lock order reversal
>  1st 0xc15f8e68 process lock (process lock)
> _at_ /usr/src/sys/kern/kern_time.c:595
>  2nd 0xc0a00a64 user map (user map) _at_ /usr/src/sys/vm/vm_map.c:2997
> KDB: stack backtrace:
> kdb_backtrace(c093c54a,c0a00a64,c0954678,c0954678,c09546f8) at
> kdb_backtrace+0x2e
> witness_checkorder(c0a00a64,9,c09546f8,bb5,c151fd80) at
> witness_checkorder+0x6ba
> _sx_xlock(c0a00a64,c09546f8,bb5,c06a1a26,cc01b9f0) at _sx_xlock+0x7e
> _vm_map_lock_read(c0a00a20,c09546f8,bb5,15101dd,0) at _vm_map_lock_read+0x4a
> vm_map_lookup(cc01ba88,0,1,cc01ba8c,cc01ba7c) at vm_map_lookup+0x38
> vm_fault(c0a00a20,0,1,0,c151fd80) at vm_fault+0x7f
> trap_pfault(cc01bb70,0,aa8,c0a33a80,aa8) at trap_pfault+0xf1
> trap(c0a10008,c0a10028,28,c0938bcb,6ab) at trap+0x35e
> calltrap() at calltrap+0x5
> --- trap 0xc, eip = 0xc068fc66, esp = 0xcc01bbb0, ebp = 0xcc01bbd0 ---
> _mtx_lock_flags(aa8,0,c0938bcb,6ab,c15f8f38) at _mtx_lock_flags+0x46
> do_tdsignal(c1547c00,e,0,0,c0938bcb) at do_tdsignal+0x119
> tdsignal(c1547c00,e,0,654) at tdsignal+0x4d
> psignal(c15f8e00,e,c0939794,253,cc01bc88) at psignal+0x83
> realitexpire(c15f8e00,0,c093992c,105,c06a7ed0) at realitexpire+0x3f
> softclock(0,0,c093620e,256,c0a02780) at softclock+0x24e
> ithread_loop(c1517780,cc01bd38,c0935ff9,30d,0) at ithread_loop+0x172
> fork_exit(c0682920,c1517780,cc01bd38) at fork_exit+0xc1
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0x1, eip = 0, esp = 0xcc01bd6c, ebp = 0 ---
> 
> 
> Fatal trap 12: page fault while in kernel mode
> cpuid = 0; apic id = 00
> fault virtual address   = 0xaa8
> fault code              = supervisor read, page not present
> instruction pointer     = 0x20:0xc068fc66
> stack pointer           = 0x28:0xcc01bbb0
> frame pointer           = 0x28:0xcc01bbd0
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 28 (swi4: clock sio)
> [thread pid 28 tid 100029 ]
> Stopped at      _mtx_lock_flags+0x46:   cmpl    $0xc099d624,0(%ebx)
> db> show alllocks
> Process 28 (swi4: clock sio) thread 0xc151fd80 (100029)
> exclusive sleep mutex process lock r = 0 (0xc15f8e68) locked
> _at_ /usr/src/sys/kern/kern_time.c:595

-- 
Brian Fundakowski Feldman                           \'[ FreeBSD ]''''''''''\
  <> green_at_FreeBSD.org                               \  The Power to Serve! \
 Opinions expressed are my own.                       \,,,,,,,,,,,,,,,,,,,,,,\