Zfs panic

Hello,

I just came back from work to find a nice panic for current and Zfs (src and 
obj located on zfs filesystems in a mirrored tank)
The source tree was updated this morning, around 05:00 UTC.

I do not see new CVS commits related to Zfs : I will check with a make update 
if the panic is still present on the sources.

the ddb trace :

login: Apr 25 07:21:47 multi-cur su: thierry.herbelot to root on /dev/ttyp0
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0xdeadc0ee
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc06f0019
stack pointer           = 0x28:0xd558ca14
frame pointer           = 0x28:0xd558ca14
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = 27384 (rm)
[thread pid 27384 tid 100174 ]
Stopped at      isitmychild+0x9:        movl    0x10(%eax),%eax
db> bt
Tracing pid 27384 tid 100174 td 0xc6ef9360
isitmychild(deadc0de,c0a61978,c0a580f4,0,c09513fc,3aa) at isitmychild+0x9
witness_checkorder(c1474888,9,c0969e06,8d1) at witness_checkorder+0x26d
_mtx_lock_flags(c1474888,0,c0969e06,8d1) at _mtx_lock_flags+0x84
uma_zfree_arg(c146d000,c34e3d80,c34e3f6c) at uma_zfree_arg+0x3b
free(c34e3d80,c276f5a0,c34e3d90,c3acc000,c2680000,...) at free+0xb5
zap_lockdir(c26690c0,2,0,c3703680,0,...) at zap_lockdir+0x276
zap_add(c26690c0,2,0,d558cb58,8,...) at zap_add+0x26
zfs_unlinked_add(c3a3184c,c3703680,c2680044,c2b5b200,c5d4f660,...) at 
zfs_unlinked_add+0x38
zfs_freebsd_remove(d558cbe0) at zfs_freebsd_remove+0x218
VOP_REMOVE_APV(c2771a60,d558cbe0) at VOP_REMOVE_APV+0x7e
kern_unlink(c6ef9360,2821a168,0,d558cd2c,c08c1b6e,...) at kern_unlink+0x173
unlink(c6ef9360,d558cd00) at unlink+0x12
syscall(d558cd38) at syscall+0x252
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (10, FreeBSD ELF32, unlink), eip = 0x2813bfeb, esp = 0xbfbfe7cc, 
ebp = 0xbfbfe7f8 ---
db>

but no crash dump :

db> call doadump
Physical memory: 307 MB
Dumping 141 MB:panic: Assertion !mtx_owned(&w_mtx) failed 
at /tank/files1/src/sys/kern/subr_witness.c:937

the latest full non-verbose dmesg :
GDB: no debug ports present
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2007 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 7.0-CURRENT #1746: Tue Apr 24 19:54:01 CEST 2007

    ZZZZ:/tank/files3/obj/tank/files1/src/sys/GENERIC
WARNING: WITNESS option enabled, expect reduced performance.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Pentium II/Pentium II Xeon/Celeron (334.09-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x665  Stepping = 5
  
Features=0x183fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR>
real memory  = 335544320 (320 MB)
avail memory = 318644224 (303 MB)
MPTable: <OEM00000 PROD00000000>
FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
 cpu0 (BSP): APIC ID:  0
 cpu1 (AP): APIC ID:  1
ioapic0: Assuming intbase of 0
ioapic0 <Version 1.1> irqs 0-23 on motherboard
kbd1 at kbdmux0
ath_hal: 0.9.20.3 (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413)
cpu0 on motherboard
cpu1 on motherboard
pcib0: <MPTable Host-PCI bridge> pcibus 0 on motherboard
pci0: <PCI bus> on pcib0
agp0: <Intel 82443BX (440 BX) host to PCI bridge> on hostb0
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
isab0: <PCI-ISA bridge> at device 7.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel PIIX4 UDMA33 controller> port 
0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xf000-0xf00f at device 7.1 on pci0
ata0: <ATA channel 0> on atapci0
ata0: [ITHREAD]
ata1: <ATA channel 1> on atapci0
ata1: [ITHREAD]
uhci0: <Intel 82371AB/EB (PIIX4) USB controller> port 0xc000-0xc01f irq 19 at 
device 7.2 on pci0
uhci0: [GIANT-LOCKED]
uhci0: [ITHREAD]
usb0: <Intel 82371AB/EB (PIIX4) USB controller> on uhci0
usb0: USB revision 1.0
uhub0: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb0
uhub0: 2 ports with 2 removable, self powered
piix0: <PIIX Timecounter> port 0x5000-0x500f at device 7.3 on pci0
Timecounter "PIIX" frequency 3579545 Hz quality 0
dc0: <82c169 PNIC 10/100BaseTX> port 0xc400-0xc4ff mem 0xd8002000-0xd80020ff 
irq 19 at device 9.0 on pci0
miibus0: <MII bus> on dc0
bmtphy0: <BCM5201 10/100baseTX PHY> PHY 1 on miibus0
bmtphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
dc0: Ethernet address: 00:02:e3:08:63:af
dc0: [ITHREAD]
ohci0: <AcerLabs M5237 (Aladdin-V) USB controller> mem 0xd8003000-0xd8003fff 
irq 19 at device 11.0 on pci0
ohci0: [GIANT-LOCKED]
ohci0: [ITHREAD]
usb1: OHCI version 1.0, legacy support
usb1: <AcerLabs M5237 (Aladdin-V) USB controller> on ohci0
usb1: USB revision 1.0
uhub1: <AcerLabs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb1
uhub1: 2 ports with 2 removable, self powered
ohci1: <AcerLabs M5237 (Aladdin-V) USB controller> mem 0xd8004000-0xd8004fff 
irq 16 at device 11.1 on pci0
ohci1: [GIANT-LOCKED]
ohci1: [ITHREAD]
usb2: OHCI version 1.0, legacy support
usb2: <AcerLabs M5237 (Aladdin-V) USB controller> on ohci1
usb2: USB revision 1.0
uhub2: <AcerLabs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb2
uhub2: 2 ports with 2 removable, self powered
ohci2: <AcerLabs M5237 (Aladdin-V) USB controller> mem 0xd8000000-0xd8000fff 
irq 17 at device 11.2 on pci0
ohci2: [GIANT-LOCKED]
ohci2: [ITHREAD]
usb3: OHCI version 1.0, legacy support
usb3: <AcerLabs M5237 (Aladdin-V) USB controller> on ohci2
usb3: USB revision 1.0
uhub3: <AcerLabs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb3
uhub3: 2 ports with 2 removable, self powered
ehci0: <ALi M5239 USB 2.0 controller> mem 0xd8001000-0xd80010ff irq 18 at 
device 11.3 on pci0
ehci0: [GIANT-LOCKED]
ehci0: [ITHREAD]
usb4: EHCI version 1.0
usb4: companion controllers, 2 ports each: usb1 usb2 usb3
usb4: <ALi M5239 USB 2.0 controller> on ehci0
usb4: USB revision 2.0
uhub4: <AcerLabs EHCI root hub, class 9/0, rev 2.00/1.00, addr 1> on usb4
uhub4: 6 ports with 6 removable, self powered
pci0: <mass storage, SCSI> at device 13.0 (no driver attached)
vgapci0: <VGA-compatible display> mem 
0xd5000000-0xd5003fff,0xd6000000-0xd67fffff,0xd7000000-0xd77fffff irq 16 at 
device 15.0 on pci0
pci0: <multimedia, audio> at device 17.0 (no driver attached)
atapci1: <HighPoint HPT366 UDMA66 controller> port 
0xd000-0xd007,0xd400-0xd403,0xd800-0xd8ff irq 18 at device 19.0 on pci0
atapci1: [ITHREAD]
ata2: <ATA channel 0> on atapci1
ata2: [ITHREAD]
atapci2: <HighPoint HPT366 UDMA66 controller> port 
0xdc00-0xdc07,0xe000-0xe003,0xe400-0xe4ff irq 18 at device 19.1 on pci0
atapci2: [ITHREAD]
ata3: <ATA channel 0> on atapci2
ata3: [ITHREAD]
pmtimer0 on isa0
orm0: <ISA Option ROMs> at iomem 0xc0000-0xc7fff,0xef000-0xeffff pnpid ORM0000 
on isa0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
atkbd0: [ITHREAD]
fdc0: <Enhanced floppy controller> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on 
isa0
fdc0: [FILTER]
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode
ppbus0: <Parallel port bus> on ppc0
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
ppc0: [GIANT-LOCKED]
ppc0: [ITHREAD]
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x100>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A, console
sio0: [FILTER]
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
sio1: [FILTER]
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
unknown: <PNP0303> can't assign resources (port)
unknown: <PNP0c01> can't assign resources (memory)
unknown: <PNP0c02> can't assign resources (memory)
unknown: <PNP0a03> can't assign resources (port)
unknown: <PNP0501> can't assign resources (port)
unknown: <PNP0700> can't assign resources (port)
unknown: <PNP0400> can't assign resources (port)
unknown: <PNP0501> can't assign resources (port)
Timecounters tick every 1.000 msec
ad0: 9671MB <IBM DTTA-351010 T56OA73A> at ata0-master UDMA33
ad2: 9671MB <IBM DTTA-351010 T56OA73A> at ata1-master UDMA33
acd0: CDROM <NEC CD-ROM DRIVE:28B/3.05> at ata3-master PIO4
SMP: AP CPU #1 Launched!
Trying to mount root from ufs:/dev/ad0s1a

and the filsesystem hierarchy :
# df -k
Filesystem  1024-blocks    Used   Avail Capacity  Mounted on
/dev/ad0s1a      198126  178290    3986    98%    /
devfs                 1       1       0   100%    /dev
tank            3688064       0 3688064     0%    /tank
tank/files1     4169728  481664 3688064    12%    /tank/files1
tank/files3     4160896  472832 3688064    11%    /tank/files3
/dev/ad0s1d      198126    1022  181254     1%    /tmp
/dev/ad0s1e      198126   41896  140380    23%    /var
/dev/ad0s1f     4152734 2370358 1450158    62%    /usr

	TfH

-- 
Internet users, on the other hand, are perhaps not dealt
with harshly enough; ultimately, the only way to secure the
Internet is to ensure that these users secure their systems.
Harvard Law Review, june06 ("immunizing the internet")