current + mpt = panic: Bad link elm 0xffffff80002d6480 next->prev != elm

[Ståle Kristoffersen]

On 2010-07-15 at 14:34, Ståle Kristoffersen wrote:
> Upgraded to from stable to current yesterday and very quickly received a
> panic. It did however not dump it's core, so I was unable to debug it.
> Today it did panic again, and I took a picture: (Sorry about the bad
> quality)
> 
> http://folk.uio.no/stalk/mpt/IMG_1403.JPG
> 
> And from the backtrace:
> http://folk.uio.no/stalk/mpt/IMG_1404.JPG
> 
> Both times I hade the mpt0: request timed out just before the panic.
> 
> I'm not sure why it's not dumping it's core (It was working under stable,
> and I have dumpdev="AUTO" and dumpdir="/var/crash" in rc.conf)

Just to be complete: I also get this LOR at boot:
lock order reversal:
 1st 0xffffff80a5108b38 bufwait (bufwait) @
/usr/src/sys/kern/vfs_bio.c:2607
 2nd 0xffffff0002dc6000 dirhash (dirhash) @
/usr/src/sys/ufs/ufs/ufs_dirhash.c:283
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
_witness_debugger() at _witness_debugger+0x2e
witness_checkorder() at witness_checkorder+0x81e
_sx_xlock() at _sx_xlock+0x55
ufsdirhash_acquire() at ufsdirhash_acquire+0x33
ufsdirhash_remove() at ufsdirhash_remove+0x16
ufs_dirremove() at ufs_dirremove+0x1a4
ufs_remove() at ufs_remove+0x92
VOP_REMOVE_APV() at VOP_REMOVE_APV+0x93
kern_unlinkat() at kern_unlinkat+0x2cb
syscallenter() at syscallenter+0x1b5
syscall() at syscall+0x4c
Xfast_syscall() at Xfast_syscall+0xe2
--- syscall (10, FreeBSD ELF64, unlink), rip = 0x80072f3cc, rsp =
0x7fffffffdb08, rbp = 0x7fffffffef58 ---
lock order reversal:
 1st 0xffffff00407a4458 ufs (ufs) @ /usr/src/sys/kern/vfs_mount.c:1058
 2nd 0xffffff00407aedb8 devfs (devfs) @ /usr/src/sys/kern/vfs_subr.c:2090
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
_witness_debugger() at _witness_debugger+0x2e
witness_checkorder() at witness_checkorder+0x81e
__lockmgr_args() at __lockmgr_args+0xd11
vop_stdlock() at vop_stdlock+0x39
VOP_LOCK1_APV() at VOP_LOCK1_APV+0x9b
_vn_lock() at _vn_lock+0x47
vget() at vget+0x7b
devfs_allocv() at devfs_allocv+0x100
devfs_root() at devfs_root+0x48
vfs_donmount() at vfs_donmount+0xfb2
nmount() at nmount+0x63
syscallenter() at syscallenter+0x1b5
syscall() at syscall+0x4c
Xfast_syscall() at Xfast_syscall+0xe2
--- syscall (378, FreeBSD ELF64, nmount), rip = 0x8007b2b4c, rsp =
0x7fffffffdd28, rbp = 0x800c09048 ---

-- 
Ståle Kristoffersen