7.1 panicked removing namecache entry from cache

[Mikolaj Golub]

Hi,

Today we had vfs related panic on 7.1-RELEASE-p5. Does anybody have any idea?
Might it have already been fixed in later versions?

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x0
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc07fd34b
stack pointer           = 0x28:0xe6a97bc8
frame pointer           = 0x28:0xe6a97bdc
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 49 (vnlru)
trap number             = 12
panic: page fault
cpuid = 2
Uptime: 11h19m41s
Physical memory: 3059 MB
Dumping 275 MB: 260 244 228 212 196 180 164 148 132 116 100 84 68 52 36 20 4

(kgdb) where             
#0  doadump () at pcpu.h:196
#1  0xc07910a7 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2  0xc0791379 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:574
#3  0xc0aa7bcc in trap_fatal (frame=0xe6a97b88, eva=0) at /usr/src/sys/i386/i386/trap.c:939
#4  0xc0aa7e50 in trap_pfault (frame=0xe6a97b88, usermode=0, eva=0) at /usr/src/sys/i386/i386/trap.c:852
#5  0xc0aa880c in trap (frame=0xe6a97b88) at /usr/src/sys/i386/i386/trap.c:530
#6  0xc0a8e67b in calltrap () at /usr/src/sys/i386/i386/exception.s:159
#7  0xc07fd34b in cache_zap (ncp=0xcc33783c) at /usr/src/sys/kern/vfs_cache.c:276
#8  0xc07fd57c in cache_purge (vp=0xc890533c) at /usr/src/sys/kern/vfs_cache.c:613
#9  0xc080df18 in vgonel (vp=0xc890533c) at /usr/src/sys/kern/vfs_subr.c:2545
#10 0xc081174d in vnlru_free (count=270) at /usr/src/sys/kern/vfs_subr.c:870
#11 0xc0811ddc in vnlru_proc () at /usr/src/sys/kern/vfs_subr.c:733
#12 0xc076cc19 in fork_exit (callout=0xc0811cf0 <vnlru_proc>, arg=0x0, frame=0xe6a97d38)
    at /usr/src/sys/kern/kern_fork.c:804
#13 0xc0a8e6f0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:264

    267 static void
    268 cache_zap(ncp)
    269         struct namecache *ncp;
    270 {
    271         struct vnode *vp;
    272 
    273         mtx_assert(&cache_lock, MA_OWNED);
    274         CTR2(KTR_VFS, "cache_zap(%p) vp %p", ncp, ncp->nc_vp);
    275         vp = NULL;
    276         LIST_REMOVE(ncp, nc_hash);
    277         LIST_REMOVE(ncp, nc_src);
    278         if (LIST_EMPTY(&ncp->nc_dvp->v_cache_src)) {
    279                 vp = ncp->nc_dvp;
    280                 numcachehv--;
    281         }
    282         if (ncp->nc_vp) {
    283                 TAILQ_REMOVE(&ncp->nc_vp->v_cache_dst, ncp, nc_dst);
    284                 ncp->nc_vp->v_dd = NULL;
    285         } else {
    286                 TAILQ_REMOVE(&ncneg, ncp, nc_dst);
    287                 numneg--;
    288         }
    289         numcache--;
    290         cache_free(ncp);
    291         if (vp)
    292                 vdrop(vp);
    293 }

    603 void
    604 cache_purge(vp)
    605         struct vnode *vp;
    606 {
    607
    608         CTR1(KTR_VFS, "cache_purge(%p)", vp);
    609         CACHE_LOCK();
    610         while (!LIST_EMPTY(&vp->v_cache_src))
    611                 cache_zap(LIST_FIRST(&vp->v_cache_src));
    612         while (!TAILQ_EMPTY(&vp->v_cache_dst))
    613                 cache_zap(TAILQ_FIRST(&vp->v_cache_dst));
    614         vp->v_dd = NULL;
    615         CACHE_UNLOCK();
    616 }

(kgdb) fr 8 
#8  0xc07fd57c in cache_purge (vp=0xc890533c) at /usr/src/sys/kern/vfs_cache.c:613
613             struct namecache *ncp, *nnp;
(kgdb) p *vp
$1 = {v_type = VREG, v_tag = 0xc0b37e38 "ufs", v_op = 0xc0bfbdc0, v_data = 0x0, v_mount = 0x0, 
  v_nmntvnodes = {tqe_next = 0xcc342450, tqe_prev = 0xcc31e350}, v_un = {vu_mount = 0x0, vu_socket = 0x0, 
    vu_cdev = 0x0, vu_fifoinfo = 0x0, vu_yield = 0}, v_hashlist = {le_next = 0x0, le_prev = 0xc65e99fc}, 
  v_hash = 6643674, v_cache_src = {lh_first = 0x0}, v_cache_dst = {tqh_first = 0xcc33783c, 
    tqh_last = 0xcc33784c}, v_dd = 0x0, v_cstart = 0, v_lasta = 0, v_lastw = 0, v_clen = 0, v_lock = {
    lk_object = {lo_name = 0xc0b37e38 "ufs", lo_type = 0xc0b37e38 "ufs", lo_flags = 70844416, 
      lo_witness_data = {lod_list = {stqe_next = 0x0}, lod_witness = 0x0}}, lk_interlock = 0xc0c42d10, 
    lk_flags = 262208, lk_sharecount = 0, lk_waitcount = 0, lk_exclusivecount = 1, lk_prio = 80, 
    lk_timo = 51, lk_lockholder = 0xc64bf8c0, lk_newlock = 0x0}, v_interlock = {lock_object = {
      lo_name = 0xc0b418b9 "vnode interlock", lo_type = 0xc0b418b9 "vnode interlock", 
      lo_flags = 16973824, lo_witness_data = {lod_list = {stqe_next = 0x0}, lod_witness = 0x0}}, 
    mtx_lock = 4, mtx_recurse = 0}, v_vnlock = 0xc8905394, v_holdcnt = 1, v_usecount = 0, v_iflag = 128, 
  v_vflag = 0, v_writecount = 0, v_freelist = {tqe_next = 0xcc30acf0, tqe_prev = 0xc0c4f3ac}, v_bufobj = {
    bo_mtx = 0xc89053c4, bo_clean = {bv_hd = {tqh_first = 0x0, tqh_last = 0xc8905400}, bv_root = 0x0, 
      bv_cnt = 0}, bo_dirty = {bv_hd = {tqh_first = 0x0, tqh_last = 0xc8905410}, bv_root = 0x0, 
      bv_cnt = 0}, bo_numoutput = 0, bo_flag = 0, bo_ops = 0xc0be8e40, bo_bsize = 16384, bo_object = 0x0, 
    bo_synclist = {le_next = 0x0, le_prev = 0xc890520c}, bo_private = 0xc890533c, 
    __bo_vnode = 0xc890533c}, v_pollinfo = 0x0, v_label = 0x0, v_lockf = 0x0}

(kgdb) fr 7
#7  0xc07fd34b in cache_zap (ncp=0xcc33783c) at /usr/src/sys/kern/vfs_cache.c:276
276             LIST_REMOVE(ncp, nc_hash);
(kgdb) p *ncp
$2 = {nc_hash = {le_next = 0x0, le_prev = 0x0}, nc_src = {le_next = 0xcc31650c, le_prev = 0xcc2c51e4}, 
  nc_dst = {tqe_next = 0x0, tqe_prev = 0x0}, nc_dvp = 0x0, nc_vp = 0x0, nc_flag = 0 '\0', 
  nc_nlen = 0 '\0', nc_name = 0xcc33785e ""}

-- 
Mikolaj Golub