HAMMER: panic: lockmgr: locking against myself

[Matthew Dillon]

:I get this panic consistently after 5-20 minutes when doing buildworld,
:using nfs mount for /usr/src & /usr/obj and using hammer on nfs server.
:
:Crash dump on leaf in crash/hammer/ask/*.13.
:
:HAMMER PFSs are not used on nfs server
:(unlike <https://bugs.dragonflybsd.org/issue1125>).
:
:Retesting got another panic (like .13); on bootup a third panic occurred ju=
:st after HAMMER:
:*.14 and *.15 being uploaded to leaf.

    *.14 looks corrupt.  *.13 and *.15 look good.  They appear to be the
    same panic.

    Ok, please try this patch.  It is a second bug in the same code path
    from a week ago (note this folds in that other patch too, which changed
    the KKASSERT).

					-Matt
					Matthew Dillon 
					<dillon at backplane.com>


Index: hammer_io.c
===================================================================
RCS file: /cvs/src/sys/vfs/hammer/hammer_io.c,v
retrieving revision 1.54
diff -u -p -r1.54 hammer_io.c
--- hammer_io.c	29 Aug 2008 20:19:08 -0000	1.54
+++ hammer_io.c	13 Sep 2008 18:12:34 -0000
@@ -277,17 +277,19 @@ hammer_io_inval(hammer_volume_t volume, 
 		hammer_ref(&iou->io.lock);
 		hammer_io_clear_modify(&iou->io, 1);
 		bundirty(bp);
+		iou->io.released = 0;
+		BUF_KERNPROC(bp);
 		iou->io.reclaim = 1;
 		iou->io.waitdep = 1;
-		KKASSERT(iou->io.lock.refs == 0);
+		KKASSERT(iou->io.lock.refs == 1);
 		hammer_rel_buffer(&iou->buffer, 0);
 		/*hammer_io_deallocate(bp);*/
 	} else {
 		KKASSERT((bp->b_flags & B_LOCKED) == 0);
 		bundirty(bp);
 		bp->b_flags |= B_NOCACHE|B_RELBUF;
+		brelse(bp);
 	}
-	brelse(bp);
 	crit_exit();
 }
 
Index: hammer_object.c
===================================================================
RCS file: /cvs/src/sys/vfs/hammer/hammer_object.c,v
retrieving revision 1.96
diff -u -p -r1.96 hammer_object.c
--- hammer_object.c	9 Aug 2008 07:04:16 -0000	1.96
+++ hammer_object.c	13 Sep 2008 17:55:08 -0000
@@ -897,9 +897,9 @@ hammer_ip_add_bulk(hammer_inode_t ip, of
 		if (conflict->flags & HAMMER_RECF_INTERLOCK_BE) {
 			conflict->flags |= HAMMER_RECF_WANTED;
 			tsleep(conflict, 0, "hmrrc3", 0);
-		} else {
-			conflict->flags |= HAMMER_RECF_DELETED_FE;
+			continue;
 		}
+		conflict->flags |= HAMMER_RECF_DELETED_FE;
 		hammer_rel_mem_record(conflict);
 	}