panic in daprobedone: Unholding 4 with cnt = 0

[Warner Losh]

That's interesting. What did you do to get there? There's some code path
that's unholding the periph without first holding it. I've been trying to
find a scenario.

Warner

On Sat, Feb 17, 2018 at 5:01 AM, Hans Petter Selasky <hps at selasky.org>
wrote:

> I've started to hit this panic with USB mass storage, before even the
> device has become in-use:
>
> panic: Unholding 4 with cnt = 0
>
> Backtrace:
>
> vpanic()
> panic()
> daprobedone()
> dadone()
> xpt_done_process()
> xpt_done_td()
> fork_exit()
> fork_trampoline()
>
> db>
>
>
> static inline void
>> da_periph_unhold(struct cam_periph *periph, da_ref_token token)
>> {
>>         int cnt;
>>         struct da_softc *softc = periph->softc;
>>
>>         token_sanity(token);
>>         DA_PERIPH_PRINT(periph, "Unholding device %s (%d)\n",
>>             da_ref_text[token], token);
>>         cnt = atomic_fetchadd_int(&softc->ref_flags[token], -1);
>>         if (cnt != 1)
>>                 panic("Unholding %d with cnt = %d", token, cnt);
>>         cam_periph_unhold(periph);
>> }
>>
>