NetBSD Problem Report #60462
From www@netbsd.org Sun Jul 19 03:12:34 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits)
client-signature RSA-PSS (2048 bits))
(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 8344D1A923B
for <gnats-bugs@gnats.NetBSD.org>; Sun, 19 Jul 2026 03:12:34 +0000 (UTC)
Message-Id: <20260719031233.398801A923C@mollari.NetBSD.org>
Date: Sun, 19 Jul 2026 03:12:33 +0000 (UTC)
From: riz@tastylime.net
Reply-To: riz@tastylime.net
To: gnats-bugs@NetBSD.org
Subject: panic importing zpools under LOCKDEBUG
X-Send-Pr-Version: www-1.0
X-From4GNATS: "riz@tastylime.net via gnats" <gnats-admin@NetBSD.org>
>Number: 60462
>Category: kern
>Synopsis: panic importing zpools under LOCKDEBUG
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: kern-bug-people
>State: needs-pullups
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Sun Jul 19 03:15:00 +0000 2026
>Closed-Date:
>Last-Modified: Sun Jul 19 15:50:01 +0000 2026
>Originator: Jeff Rizzo
>Release: 11.99.7
>Organization:
>Environment:
[ 1.0000000] NetBSD 11.99.7 (GENERIC_LOCKDEBUG) #0: Sun Jul 19 00:50:26 UTC 2026
[ 1.0000000] riz@acai.tastylime.net:/tank/netbsd/current/obj/sys/arch/amd64/compile/GENERIC_LOCKDEBUG
>Description:
While debugging another issue (PR#60457), I ran into a repeatable panic in a LOCKDEBUG kernel upon reboot:
Sat Jul 18 19:16:27 PDT 2026
Starting root file system check:
/dev/rdk0: 61788 files, 1172986 used, 100454123 free (1627 frags, 12556562 blocks, 0.0% fragmentation)
/dev/rdk0: MARKING FILE SYSTEM CLEAN
[ 21.2583656] ZFS filesystem version: 5
[ 24.0084563] Mutex error: kmem_intr_free,397: allocation contains active lock
[ 24.0183539] lock address : ffff843809f972f0
[ 24.0283529] type : sleep/adaptive
[ 24.0283529] initialized : zfs:rrw_init+0x19
[ 24.0283529] shared holds : 0 exclusive: 0
[ 24.0383528] shares wanted: 0 exclusive: 0
[ 24.0483529] relevant cpu : 3 last held: 9
[ 24.0583528] relevant lwp : 0xffff84380afd8800 last held: 000000000000000000
[ 24.0683528] last locked : 0
[ 24.0683528] unlocked* : 0
[ 24.0683528] owner field : 000000000000000000 wait/spin: 0/0
[ 24.0783527] Turnstile: no active turnstile for this lock.
[ 24.0883527] panic: LOCKDEBUG: Mutex error: kmem_intr_free,397: allocation contains active lock
[ 24.0983526] cpu3: Begin traceback...
[ 24.0983526] vpanic() at netbsd:vpanic+0x189
[ 24.1083526] panic() at netbsd:panic+0x3c
[ 24.1083526] lockdebug_abort1() at netbsd:lockdebug_abort1+0xdd
[ 24.1183526] kmem_intr_free() at netbsd:kmem_intr_free+0x91
[ 24.1283527] dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x4ff
[ 24.1283527] dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x575
[ 24.1383525] dmu_objset_find_dp_impl() at zfs:dmu_objset_find_dp_impl+0xf1
[ 24.1483524] dmu_objset_find_dp_cb() at zfs:dmu_objset_find_dp_cb+0x25
[ 24.1583524] task_executor() at solaris:task_executor+0x67
[ 24.1583524] threadpool_thread() at netbsd:threadpool_thread+0xd8
[ 24.1683524] cpu3: End traceback...
[ 24.1683524] fatal breakpoint trap in supervisor mode
[ 24.1783523] trap type 1 code 0 rip 0xffffffff8023541d cs 0x8 rflags 0x202 cr2 0 ilevel 0 rsp 0xffffca14bca93bd0
[ 24.1883523] curlwp 0xffff84380afd8800 pid 0.740 lowest kstack 0xffffca14bca8f2c0
Stopped in pid 0.740 (system) at netbsd:breakpoint+0x5: leave
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x189
panic() at netbsd:panic+0x3c
lockdebug_abort1() at netbsd:lockdebug_abort1+0xdd
kmem_intr_free() at netbsd:kmem_intr_free+0x91
dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x4ff
dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x575
dmu_objset_find_dp_impl() at zfs:dmu_objset_find_dp_impl+0xf1
dmu_objset_find_dp_cb() at zfs:dmu_objset_find_dp_cb+0x25
task_executor() at solaris:task_executor+0x67
threadpool_thread() at netbsd:threadpool_thread+0xd8
ds 0
es 3
fs 3c18
gs 3b80
rdi 0
rsi 2d6
rbp ffffca14bca93bd0
rbx ffffffff81700568
rdx 1
rcx ffffffffffffff
rax 800000000000000
r8 0
r9 0
r10 0
r11 ffffffff81612ae2 ostype+0x54f72
r12 ffffca14bca93c18
r13 104
r14 ffffffff81700678
r15 1
rip ffffffff8023541d breakpoint+0x5
cs 8
rflags 202
rsp ffffca14bca93bd0
ss 10
netbsd:breakpoint+0x5: leave
db{3}>
>How-To-Repeat:
Boot a LOCKDEBUG kernel with this particular zpool
>Fix:
Per riastradh, its missing some "rrw_destroy(&ds->ds_bp_rwlock); in a couple kmem_free(ds, ...) branches
>Release-Note:
>Audit-Trail:
From: Jeff Rizzo <riz@tastylime.net>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60462: panic importing zpools under LOCKDEBUG
Date: Sat, 18 Jul 2026 20:46:10 -0700
This is a multi-part message in MIME format.
--------------NZiYZq21lyJb300tCoDheSUZ
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
This seems to fix the LOCKDEBUG panic:
cvs diff -u ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c
Index: ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c
===================================================================
RCS file: /cvsroot/src/external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c,v
retrieving revision 1.5
diff -u -r1.5 dsl_dataset.c
--- ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c 13 Aug 2019 08:03:25 5
+++ ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c 19 Jul 2026 03:32:30 0
@@ -495,6 +495,7 @@
mutex_destroy(&ds->ds_opening_lock);
mutex_destroy(&ds->ds_sendstream_lock);
refcount_destroy(&ds->ds_longholds);
+ rrw_destroy(&ds->ds_bp_rwlock);
bplist_destroy(&ds->ds_pending_deadlist);
dsl_deadlist_close(&ds->ds_deadlist);
kmem_free(ds, sizeof (dsl_dataset_t));
@@ -557,6 +558,7 @@
mutex_destroy(&ds->ds_opening_lock);
mutex_destroy(&ds->ds_sendstream_lock);
refcount_destroy(&ds->ds_longholds);
+ rrw_destroy(&ds->ds_bp_rwlock);
kmem_free(ds, sizeof (dsl_dataset_t));
if (err != 0) {
dmu_buf_rele(dbuf, tag);
--------------NZiYZq21lyJb300tCoDheSUZ
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<pre>This seems to fix the LOCKDEBUG panic:
cvs diff -u ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c
Index: ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c
===================================================================
RCS file: /cvsroot/src/external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c,v
retrieving revision 1.5
diff -u -r1.5 dsl_dataset.c
--- ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c 13 Aug 2019 08:03:25 5
+++ ./external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c 19 Jul 2026 03:32:30 0
@@ -495,6 +495,7 @@
mutex_destroy(&ds->ds_opening_lock);
mutex_destroy(&ds->ds_sendstream_lock);
refcount_destroy(&ds->ds_longholds);
+ rrw_destroy(&ds->ds_bp_rwlock);
bplist_destroy(&ds->ds_pending_deadlist);
dsl_deadlist_close(&ds->ds_deadlist);
kmem_free(ds, sizeof (dsl_dataset_t));
@@ -557,6 +558,7 @@
mutex_destroy(&ds->ds_opening_lock);
mutex_destroy(&ds->ds_sendstream_lock);
refcount_destroy(&ds->ds_longholds);
+ rrw_destroy(&ds->ds_bp_rwlock);
kmem_free(ds, sizeof (dsl_dataset_t));
if (err != 0) {
dmu_buf_rele(dbuf, tag);</pre>
</body>
</html>
--------------NZiYZq21lyJb300tCoDheSUZ--
State-Changed-From-To: open->needs-pullups
State-Changed-By: riz@NetBSD.org
State-Changed-When: Sun, 19 Jul 2026 15:41:24 +0000
State-Changed-Why:
fix committed, waiting for a bit before requesting pullup
From: "Jeff Rizzo" <riz@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60462 CVS commit: src/external/cddl/osnet/dist/uts/common/fs/zfs
Date: Sun, 19 Jul 2026 15:37:56 +0000
Module Name: src
Committed By: riz
Date: Sun Jul 19 15:37:56 UTC 2026
Modified Files:
src/external/cddl/osnet/dist/uts/common/fs/zfs: dsl_dataset.c
Log Message:
Don't leak locks in the error case. PR kern/60462
ok riastradh@
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 \
src/external/cddl/osnet/dist/uts/common/fs/zfs/dsl_dataset.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home