[Bug 274538] panic: vrefact: wrong use count 0

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274538

            Bug ID: 274538
           Summary: panic: vrefact: wrong use count 0
           Product: Base System
           Version: 15.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: trasz@FreeBSD.org

Trying to run glxinfo(1) from Ubuntu Jammy under Wayland on amd64 FreeBSD
15-CURRENT results in the following panic:

VNASSERT failed: old > 0 not true at
/usr/home/trasz/git/freebsd-src/sys/kern/vfs_subr.c:3367 (vrefact)
0xfffff802707f5540: type VCHR state VSTATE_CONSTRUCTED op 0xffffffff816ae740
    usecount 1, writecount 0, refcount 6 seqc users 0 rdev 0xfffff80009786c00
    hold count flags ()
    flags ()
    lock type devfs: UNLOCKED
        dev drm/128
panic: vrefact: wrong use count 0
cpuid = 3
time = 1697560355
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00fc392820
vpanic() at vpanic+0x132/frame 0xfffffe00fc392950
panic() at panic+0x43/frame 0xfffffe00fc3929b0
vrefact() at vrefact+0x5e/frame 0xfffffe00fc3929d0
fgetvp_lookup() at fgetvp_lookup+0x97/frame 0xfffffe00fc392a30
namei_setup() at namei_setup+0x191/frame 0xfffffe00fc392a80
namei_emptypath() at namei_emptypath+0x49/frame 0xfffffe00fc392ae0
namei() at namei+0x661/frame 0xfffffe00fc392b40
linux_kern_statat() at linux_kern_statat+0x101/frame 0xfffffe00fc392c70
linux_newfstatat() at linux_newfstatat+0x59/frame 0xfffffe00fc392e00
amd64_syscall() at amd64_syscall+0x153/frame 0xfffffe00fc392f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00fc392f30
--- syscall (262, Linux ELF64, linux_newfstatat), rip = 0x801513f2e, rsp =
0x7fffffffc138, rbp = 0x1090540 ---
Uptime: 2m15s
Dumping 863 out of 16225 MB:..2%..12%..21%..32%..41%..51%..62%..71%..82%..91%

__curthread ()
    at /usr/home/trasz/git/freebsd-src/sys/amd64/include/pcpu_aux.h:57
57              __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct
pcpu,
(kgdb) #0  __curthread ()
    at /usr/home/trasz/git/freebsd-src/sys/amd64/include/pcpu_aux.h:57
#1  doadump (textdump=textdump@entry=1)
    at /usr/home/trasz/git/freebsd-src/sys/kern/kern_shutdown.c:405
#2  0xffffffff80b4ee90 in kern_reboot (howto=260)
    at /usr/home/trasz/git/freebsd-src/sys/kern/kern_shutdown.c:526
#3  0xffffffff80b4f38f in vpanic (
    fmt=0xffffffff811e38b7 "%s: wrong use count %d", 
    ap=ap@entry=0xfffffe00fc392990)
    at /usr/home/trasz/git/freebsd-src/sys/kern/kern_shutdown.c:970
#4  0xffffffff80b4f133 in panic (fmt=<unavailable>)
    at /usr/home/trasz/git/freebsd-src/sys/kern/kern_shutdown.c:894
#5  0xffffffff80c45b9e in vrefact (vp=<optimized out>)
    at /usr/home/trasz/git/freebsd-src/sys/kern/vfs_subr.c:3367
#6  0xffffffff80aee277 in fgetvp_lookup (fd=<optimized out>, 
    ndp=ndp@entry=0xfffffe00fc392b50, vpp=vpp@entry=0xfffffe00fc392ac8)
    at /usr/home/trasz/git/freebsd-src/sys/kern/kern_descrip.c:3095
#7  0xffffffff80c36461 in namei_setup (ndp=ndp@entry=0xfffffe00fc392b50, 
    dpp=dpp@entry=0xfffffe00fc392ac8, pwdp=pwdp@entry=0xfffffe00fc392ac0)
    at /usr/home/trasz/git/freebsd-src/sys/kern/vfs_lookup.c:352
#8  0xffffffff80c36109 in namei_emptypath (ndp=ndp@entry=0xfffffe00fc392b50)
    at /usr/home/trasz/git/freebsd-src/sys/kern/vfs_lookup.c:432
#9  0xffffffff80c35f31 in namei (ndp=ndp@entry=0xfffffe00fc392b50)
    at /usr/home/trasz/git/freebsd-src/sys/kern/vfs_lookup.c:653
#10 0xffffffff83b447d1 in linux_kern_statat (td=0xfffffe01192e0720, 
    flag=16384, fd=4, 
    path=0x8015d846f <error: Cannot access memory at address 0x8015d846f>, 
    pathseg=UIO_USERSPACE, sbp=sbp@entry=0xfffffe00fc392c88)
    at /usr/home/trasz/git/freebsd-src/sys/compat/linux/linux_stats.c:103
#11 0xffffffff83b44519 in linux_newfstatat (td=<unavailable>, 
    args=0xfffffe01192e0b20)
    at /usr/home/trasz/git/freebsd-src/sys/compat/linux/linux_stats.c:606
#12 0xffffffff8104f693 in syscallenter (td=0xfffffe01192e0720)
    at
/usr/home/trasz/git/freebsd-src/sys/amd64/amd64/../../kern/subr_syscall.c:188
#13 amd64_syscall (td=0xfffffe01192e0720, traced=0)
    at /usr/home/trasz/git/freebsd-src/sys/amd64/amd64/trap.c:1194
#14 <signal handler called>
#15 0x0000000801513f2e in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffffffc138

-- 
You are receiving this mail because:
You are the assignee for the bug.