OpenSolaris

Printable Version Enter a New Search
Bug ID 6621609
Synopsis hsfs panics debug kernel after 6588256
State 10-Fix Delivered (Fix available in build)
Category:Subcategory kernel:hsfs
Keywords rtiq_regression
Responsible Engineer Moinak Ghosh
Reported Against snv_75 , snv_77
Duplicate Of
Introduced In solaris_nevada
Commit to Fix snv_77
Fixed In snv_77
Release Fixed solaris_nevada(snv_77)
Related Bugs 6588256 , 6622783 , 6632145 , 6635906
Submit Date 25-October-2007
Last Update Date 31-December-2007
Description
Contributed by Juergen Keil:

Unmount of hsfs in debug kernel panics after 6588256. This is caused by the following 2 problems:

kernel memory allocator: 
buffer freed to wrong cache
buffer was allocated from kmem_alloc_384,
caller attempting free to kmem_alloc_8.
buffer=ffffff016a43fc40  bufctl=ffffff016a2002c0  cache: kmem_alloc_8
previous transaction on buffer ffffff016a43fc40:
thread=ffffff017fa74520  time=T-845.919929632  slab=ffffff016a1e0b60  cache: kme
m_alloc_384
kmem_cache_alloc_debug+28b
kmem_cache_alloc+a7
kmem_alloc+88
hsfs_setup_named_kstats+85
hsfs_init_kstats+39
hs_mountfs+81e
hsfs_mount+1ed                        
fsop_mount+21
domount+981
mount+d2
syscall_ap+8f%)

panic[cpu1]/thread=ffffff03232aa760: 
kernel heap corruption detected


ffffff0004fb8cc0 genunix:kmem_error+48d ()
ffffff0004fb8ce0 genunix:kmem_free+d6 ()
ffffff0004fb8d20 hsfs:hsfs_fini_kstats+3c ()
ffffff0004fb8d70 hsfs:hsfs_unmount+cd ()
ffffff0004fb8da0 genunix:fsop_unmount+1e ()
ffffff0004fb8df0 genunix:dounmount+71 ()
ffffff0004fb8e40 genunix:umount2_engine+5a ()
ffffff0004fb8eb0 genunix:umount2+146 ()
ffffff0004fb8f00 unix:brand_sys_syscall32+292 ()

syncing file systems...
 1
 1
 done
dumping to /dev/dsk/c1t0d0s1, offset 431030272, content: kernel
NOTICE: /pci@0,0/pci1043,8239@5:
 port 0: device reset

> > $c
vpanic()
kmem_error+0x48d(1, ffffff0146625508, ffffff016a43fc40)
kmem_free+0xd6(ffffff016a43fc40, 8)
hsfs_fini_kstats+0x3c(ffffff017e243440)
hsfs_unmount+0xcd(ffffff017ece2700, 0, ffffff016f874350)
fsop_unmount+0x1e(ffffff017ece2700, 0, ffffff016f874350)
dounmount+0x71(ffffff017ece2700, 0, ffffff016f874350)
umount2_engine+0x5a(ffffff017ece2700, 0, ffffff016f874350, 1)
umount2+0x146(8065640, 0)
sys_syscall32+0x1fc()

----------------------------------

> ::status
debugging crash dump vmcore.1 (32-bit) from elise
operating system: 5.11 wos_b77_debug (i86pc)
panic message:
assertion failed: tree->avl_numnodes == 0, file: ../../../common/avl/avl.c, line 
: 841
dump content: kernel pages only

> > ::stack
vpanic(feae0cc4, feaca1d8, feaca34c, 349)
assfail+0x5a(feaca1d8, feaca34c, 349)
avl_destroy+0x49(cec20928)
hsched_fini+0x17(cec20910)
hsfs_unmount+0x12d(cf7f5900, 0, ce99b5d8)
fsop_unmount+0x18(cf7f5900, 0, ce99b5d8)
dounmount+0x5c(cf7f5900, 0, ce99b5d8)
umount2_engine+0x3f(cf7f5900, 0, ce99b5d8, 1)
umount2+0x114()
sys_call+0x1aa()

> > cec20928::print avl_tree_t
{
    avl_root = 0xd0040f4c
    avl_compar = hsched_offset_compare
    avl_offset = 0x24
    avl_numnodes = 0x1
    avl_size = 0x44
}
I am seeing consistantly seeing this panic trying to mount/umount an solarisdvd.iso
 

kernel memory allocator: 
buffer freed to wrong cache
buffer was allocated from kmem_alloc_384,
caller attempting free to kmem_alloc_8.
buffer=ffffff017d764580  bufctl=ffffff017d690aa0  cache: kmem_alloc_8
previous transaction on buffer ffffff017d764580:
thread=ffffff0155dd71a0  time=T-434.030707008  slab=ffffff019bebc2f0  cache: kme
m_alloc_384
kmem_cache_alloc_debug+28b
kmem_cache_alloc+a7
kmem_alloc+88
hsfs_setup_named_kstats+85
hsfs_init_kstats+39
hs_mountfs+821
hsfs_mount+1ed
fsop_mount+21
domount+91b
mount+d2
syscall_ap+8f

panic[cpu1]/thread=ffffff0155dc6740: 
kernel heap corruption detected


ffffff0004d2dcc0 genunix:kmem_error+48d ()
ffffff0004d2dce0 genunix:kmem_free+d6 ()
ffffff0004d2dd20 hsfs:hsfs_fini_kstats+3c ()
ffffff0004d2dd70 hsfs:hsfs_unmount+cd ()
ffffff0004d2dda0 genunix:fsop_unmount+1e ()
ffffff0004d2ddf0 genunix:dounmount+71 ()
ffffff0004d2de40 genunix:umount2_engine+5a ()
ffffff0004d2deb0 genunix:umount2+146 ()
ffffff0004d2df00 unix:brand_sys_syscall32+328 ()

syncing file systems...
 done
dumping to /dev/dsk/c0t0d0s1, offset 429391872, content: kernel
NOTICE: ahci_tran_reset_dport: port 0 reset port
>
Work Around
N/A
Comments
N/A