Nullfs - Panic when umounting and lower fs has been removed

[Konstantin Belousov]

On Sun, May 19, 2013 at 08:41:03PM +0000, Antoine Brodin wrote:
> Hi there,
> 
> I encountered a panic on head today with nullfs using poudriere.
> 
> It is quite easy to reproduce,  the script is probably doing something
> wrong but panicking is not nice
> 
> %%%
> mkdir /tmp/.new_packages /mnt/new_packages
> mount -t nullfs /tmp/.new_packages /mnt/new_packages
> dd if=/dev/zero of=/mnt/new_packages/bar count=20000
> mv /tmp/.new_packages/bar /tmp/
> rm -rf /tmp/.new_packages
> umount -f /mnt/new_packages
> %%%
> 
> The panic:
> 
> userret: returning with the following locks held:
> exclusive lockmgr ufs (ufs) r = 0 (0xfffffe0010a77548) locked @
> /usr/src/sys/modules/nullfs/../../fs/nullfs/null_vnops.c:615
> panic: witness_warn
> cpuid = 0
> KDB: enter: panic

This is strange, do you have witness enabled, but invariants not ?

Please try the following change.

diff --git a/sys/fs/nullfs/null_vfsops.c b/sys/fs/nullfs/null_vfsops.c
index ad02236..bece8c8 100644
--- a/sys/fs/nullfs/null_vfsops.c
+++ b/sys/fs/nullfs/null_vfsops.c
@@ -417,8 +417,13 @@ nullfs_unlink_lowervp(struct mount *mp, struct vnode *lowervp)
 	 */
 	if (vp->v_usecount == 0) {
 		KASSERT((vp->v_iflag & VI_DOOMED) != 0,
-		    ("not reclaimed %p", vp));
+		    ("not reclaimed nullfs vnode %p", vp));
 		VOP_UNLOCK(vp, 0);
+	} else {
+		ASSERT_VOP_ELOCKED(vp, "unlink_lowervp");
+		KASSERT((vp->v_iflag & VI_DOOMED) == 0,
+		    ("reclaimed nullfs vnode %p", vp));
+		xp->null_flags &= ~NULLV_NOUNLOCK;
 	}
 	vdrop(vp);
 }
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 834 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-fs/attachments/20130520/e11b69d5/attachment.sig>