amd64/158197: geom_cache with size>1000 leads to panics

[Pavel Polyakov]

>Number:         158197
>Category:       amd64
>Synopsis:       geom_cache with size>1000 leads to panics
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-amd64
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jun 23 09:40:08 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Pavel Polyakov
>Release:        gcache create -b128k -s2000
>Organization:
me
>Environment:
FreeBSD cel.home 9.0-CURRENT FreeBSD 9.0-CURRENT #0 r223293M: Mon Jun 20 03:06:27 EEST 2011     root at cel.home:/usr/obj/var/src9/sys/PDC90  amd64

>Description:
Using geom_cache with size>1000 leads to panics in g_up/g_down (g_cache_deliver/g_cache_read)

panic44:    full log http://paste.org.ru/?l1sjnk
Tracing pid 13 tid 100014 td 0xfffffe0002c20460
kdb_enter() at kdb_enter+0x3b
panic() at panic+0x180
g_cache_deliver() at g_cache_deliver+0x274
g_cache_done() at g_cache_done+0x80
g_io_schedule_up() at g_io_schedule_up+0xce
g_up_procbody() at g_up_procbody+0x72
fork_exit() at fork_exit+0x135
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffff8000275d00, rbp = 0 ---

panic45:    full log http://paste.org.ru/?egp7hk
Tracing pid 13 tid 100015 td 0xfffffe0002c20000
g_cache_read() at g_cache_read+0xee
g_cache_start() at g_cache_start+0x34e
g_io_schedule_down() at g_io_schedule_down+0x1d4
g_down_procbody() at g_down_procbody+0x72
fork_exit() at fork_exit+0x135
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffff800027ad00, rbp = 0 ---


>How-To-Repeat:
Create geom cache with parameters like "gcache create -b128k -s2000 test".
(seems gcache works stable if using size 100-200, but panics on 1000+).
ports & src trees work good as test pattern for filesystem.  
  
panics occur during massive io operations:
"find /mnt/test" or reading all files often leads to panic in g_down;
dumping/restoring entire fs (ports+src) always triggers panic.

>Fix:
Using smaller size for gcache or turning it off with kern.geom.cache.enable=0


>Release-Note:
>Audit-Trail:
>Unformatted: