Re: System call munmap returning with the following locks held: Giant

On Wednesday 18 January 2006 02:05, Kris Kennaway wrote:
> I ran some code of ups_at_ that essentially does mmap/munmap of created
> files, which I ran on a nfs-mounted filesystem.  At the same time I
> was running umount -f on that filesystem in a loop (this was all to
> try and provoke another umount -f panic I'm seeing).  It quickly
> panicked with this:
>
> System call munmap returning with the following locks held:
> exclusive sleep mutex Giant r = 0 (0xc07ea408) locked _at_ vm/vm_object.c:449
> panic: witness_warn
> cpuid = 1
> KDB: enter: panic
> [thread pid 3045 tid 100101 ]
> Stopped at      kdb_enter+0x30: leave
> db> wh
> Tracing pid 3045 tid 100101 td 0xc9627000
> kdb_enter(c071c7f5,1,c0720ca2,f7a46c64,c9627000) at kdb_enter+0x30
> panic(c0720ca2,f7a46c8c,1,2,c9627000) at panic+0x13f
> witness_warn(2,0,c073c410,c07214aa,c9922318) at witness_warn+0x16a
> syscall(3b,3b,3b,2804ebb6,bfbfe8a8) at syscall+0x56d
> Xint0x80_syscall() at Xint0x80_syscall+0x1f
> --- syscall (0, FreeBSD ELF32, nosys), eip = 0x28127e7f, esp = 0xbfbfe7fc,
> ebp = 0xbfbfe828 --- db>

I sent this to you on IRC, but for the archives, here's a possible fix.  It 
looks like vm_object_deallocate() never unlocks Giant if it locks it, and the 
leak would only happen if mpsafevfs=0 or you are using a non-safe filesystem:

Index: vm_object.c
===================================================================
RCS file: /usr/cvs/src/sys/vm/vm_object.c,v
retrieving revision 1.353
diff -u -r1.353 vm_object.c
--- vm_object.c	31 Dec 2005 14:39:20 -0000	1.353
+++ vm_object.c	18 Jan 2006 18:50:40 -0000
_at__at_ -467,6 +467,7 _at__at_
 		object->ref_count--;
 		if (object->ref_count > 1) {
 			VM_OBJECT_UNLOCK(object);
+			VFS_UNLOCK_GIANT(vfslocked);
 			return;
 		} else if (object->ref_count == 1) {
 			if (object->shadow_count == 0) {
_at__at_ -495,6 +496,7 _at__at_
 					 * Let the lower priority thread run.
 					 */
 					tsleep(&proc0, PVM, "vmo_de", 1);
+					MPASS(vfslocked == 0);
 					continue;
 				}
 				/*
_at__at_ -535,11 +537,13 _at__at_
 					object = robject;
 					vm_object_collapse(object);
 					VM_OBJECT_UNLOCK(object);
+					MPASS(vfslocked == 0);
 					continue;
 				}
 				VM_OBJECT_UNLOCK(robject);
 			}
 			VM_OBJECT_UNLOCK(object);
+			MPASS(vfslocked == 0);
 			return;
 		}
 doterm:
_at__at_ -562,6 +566,7 _at__at_
 		else
 			VM_OBJECT_UNLOCK(object);
 		object = temp;
+		VFS_UNLOCK_GIANT(vfslocked);
 	}
 }
 

-- 
John Baldwin <jhb_at_FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve"  =  http://www.FreeBSD.org