NetBSD Problem Report #60504
From clare@csel.org Sat Jul 25 08:09:41 2026
Return-Path: <clare@csel.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id F2FEE1A923C
for <gnats-bugs@gnats.NetBSD.org>; Sat, 25 Jul 2026 08:09:40 +0000 (UTC)
Message-Id: <20260725080814.80444CB09@mail.csel.org>
Date: Sat, 25 Jul 2026 17:08:14 +0900 (JST)
From: Shinichi Doyashiki <clare@csel.org>
Reply-To: Shinichi Doyashiki <clare@csel.org>
To: gnats-bugs@NetBSD.org
Subject: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL
X-Send-Pr-Version: 3.95
X-From4GNATS: "Shinichi Doyashiki via gnats" <gnats-admin@NetBSD.org>
>Number: 60504
>Category: kern
>Synopsis: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: perseant
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Sat Jul 25 08:10:00 +0000 2026
>Last-Modified: Sat Sep 12 10:40:01 +0000 2026
>Originator: Shinichi Doyashiki
>Release: NetBSD 11.99.7 as of around 2026-07
>Organization:
at home
>Environment:
System: NetBSD kanade2.hq.csel.org 11.99.7 NetBSD 11.99.7 (KANADE2_12) #19: Wed Jul 22 21:21:05 UTC 2026 clare@kanade2.hq.csel.org:/export/netbsd/current/src/sys/arch/amd64/compile/KANADE2_12 amd64
Architecture: x86_64
Machine: amd64
>Description:
lfs_cleanerd can kernel crash on load;
due to lfs_sp NULL dereference in lfs_fcntl.
(gdb) target kvm /export/crash/netbsd.0.core
0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:779
779 dumpsys();
(gdb) bt
#0 0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
at ../../../../arch/amd64/amd64/machdep.c:779
#1 0xffffffff80ae8d3f in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:91
#2 0xffffffff80b32bbd in vpanic (fmt=fmt@entry=0xffffffff8110e736 "trap", ap=ap@entry=0xffffbd098af14b38)
at ../../../../kern/subr_prf.c:288
#3 0xffffffff80b32c92 in panic (fmt=fmt@entry=0xffffffff8110e736 "trap") at ../../../../kern/subr_prf.c:209
#4 0xffffffff8023d04e in trap (frame=0xffffbd098af14c80) at ../../../../arch/amd64/amd64/trap.c:325
#5 0xffffffff80234ad4 in alltraps ()
#6 0xffffffff80a52ce6 in lfs_fcntl (v=0xffffbd098af14e40) at ../../../../ufs/lfs/lfs_vnops.c:2037
#7 lfs_fcntl (v=0xffffbd098af14e40) at ../../../../ufs/lfs/lfs_vnops.c:1851
#8 0xffffffff80bb9a7e in VOP_FCNTL (vp=0xffff82b4e4dc85c0, command=<optimized out>, data=<optimized out>,
fflag=<optimized out>, cred=<optimized out>) at ../../../../kern/vnode_if.c:972
#9 0xffffffff80b446e8 in fcntl_forfs (fd=<optimized out>, fp=<optimized out>, cmd=-1610036220, arg=0x7f7fff4de728)
at ../../../../kern/sys_descrip.c:226
#10 sys_fcntl (l=<optimized out>, uap=<optimized out>, retval=<optimized out>) at ../../../../kern/sys_descrip.c:385
#11 0xffffffff805cc341 in sy_call (sy=0xffffffff81460b20 <sysent+2208>, l=0xffff82b787816000, uap=0xffffbd098af15000,
rval=0xffffbd098af14fb0) at ../../../../sys/syscallvar.h:65
#12 sy_invoke (sy=0xffffffff81460b20 <sysent+2208>, l=0xffff82b787816000, uap=0xffffbd098af15000, rval=0xffffbd098af14fb0,
code=92) at ../../../../sys/syscallvar.h:94
#13 syscall (frame=0xffffbd098af15000) at ../../../../arch/x86/x86/syscall.c:137
#14 0xffffffff8021025d in handle_syscall ()
trap in lfs_fcntl
(gdb) frame 4
#4 0xffffffff8023d04e in trap (frame=0xffffbd098af14c80) at ../../../../arch/amd64/amd64/trap.c:325
325 panic("trap");
(gdb) p/x frame->tf_trapno
$1 = 0x6
(gdb) p/x frame->tf_err
$2 = 0x0
(gdb) p/x frame->tf_rip
$3 = 0xffffffff80a52ce6
(gdb) p/x frame->tf_rdx
$4 = 0x0
(gdb) x/i frame->tf_rip
0xffffffff80a52ce6 <lfs_fcntl+2317>: mov 0x68(%rdx),%rdx
(gdb) frame 6
#6 0xffffffff80a52ce6 in lfs_fcntl (v=0xffffbd098af14e40) at ../../../../ufs/lfs/lfs_vnops.c:2037
2037 lws.offset = lfs_btofsb(fs, fs->lfs_sp->bytes_written);
following are just a log.
(gdb) info args
v = 0xffffbd098af14e40
(gdb) p *(struct vop_fcntl_args *)0xffffbd098af14e40
$5 = {a_desc = 0xffffffff810ea640 <vop_fcntl_desc>, a_vp = 0xffff82b4e4dc85c0, a_command = 2684931076,
a_data = 0xffffbd098af14ed8, a_fflag = 1, a_cred = 0xffff82bab3b264c0}
(gdb) set $vp = (struct vnode *)0xffff82b4e4dc85c0
(gdb) p *$vp
$6 = {v_uobj = {vmobjlock = 0xffff82b7a77fee80, pgops = 0xffffffff810e3ec0 <uvm_vnodeops>, uo_npages = 0, uo_refs = 1,
uo_pages = {t_root = 0x0, t_height = 0}, uo_ubc = {lh_first = 0x0}}, v_size = 18620416, v_writesize = 18620416, v_cv = {
cv_opaque = {0x0, 0xffffffff81153a82}}, v_iflag = 16384, v_uflag = 0, v_usecount = -1073741822, v_numoutput = 0,
v_writecount = 0, v_holdcnt = 152, v_cleanblkhd = {lh_first = 0xffff82b7eb4b9150}, v_dirtyblkhd = {
lh_first = 0xffff82b3ecffc5c0}, v_vflag = 0, v_interlock = 0xffff82b7a4397b80, v_mount = 0xffff82b810360000,
v_op = 0xffff82baafaada00, v_un = {vu_mountedhere = 0x0, vu_socket = 0x0, vu_specnode = 0x0, vu_fifoinfo = 0x0,
vu_ractx = 0x0}, v_type = VREG, v_tag = VT_LFS, v_data = 0xffff82b80e94b038, v_klist = 0xffff82b4e4dc86d8, v_segvguard = 0x0}
(gdb) p/x $vp->v_data
$7 = 0xffff82b80e94b038
(gdb) set $ip = (struct inode *)0xffff82b80e94b038
(gdb) p *$ip
$8 = {i_gnode = {g_op = 0xffffffff810e2840 <lfs_genfsops>, g_glock = {rw_owner = 0}}, i_nextsnap = {tqe_next = 0x0,
tqe_prev = 0x0}, i_vnode = 0xffff82b4e4dc85c0, i_ump = 0xffff82b83b1f1400, i_devvp = 0xffff82b379b6dac0, i_state = 9,
i_dev = 43012, i_number = 1, i_lfs = 0xffff82b7427de000, i_unused1 = 0x0, i_dquot = {0x0, 0x0}, i_modrev = 790894361800104,
i_lockf = 0x0, i_crap = {ulr_count = 0, ulr_endoff = 0, ulr_diroff = 0, ulr_offset = 0, ulr_reclen = 0}, i_crapcounter = 0,
inode_ext = {lfs = 0xffff82b7c69cd038}, i_mode = 33152, i_nlink = 1, i_size = 18620416, i_flags = 131072, i_gen = 1,
i_uid = 0, i_gid = 0, i_omode = 0, i_dirhash = 0x0, i_din = 0xffff82b80c0cc038}
(gdb) p/x $ip->i_lfs
$9 = 0xffff82b7427de000
(gdb) p/x ((struct lfs *)0xffff82b7427de000)->lfs_sp
$10 = 0x0
>How-To-Repeat:
This crash was an incidental event and it is not clear how to reproduce it.
In my opinion, this is caused by overloading the cleaning daemon and other processes.
1. create a LFS partition approx 42GB
2. explode current source tree (and objdirs et al) onto it
(fillup the filesystem)
3. delete objdir, tooldir, destdir
(delete the fillers)
4. run build.sh -j4 ...
>Fix:
unknown.
>Release-Note:
>Audit-Trail:
From: Shinichi Doyashiki <clare@csel.org>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Sun, 26 Jul 2026 08:05:26 +0900
sorry, the kernel contained small local patch mistakenly.
I will test to see if it can be reproduced.
please close this issue for now.
From: Shinichi Doyashiki <clare@csel.org>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Tue, 28 Jul 2026 05:44:07 +0900
kernel crash was triggered while running cvs update on the testing LFS partition.
first and second savecore was failed due to crash kernel again
while running savecore itself. following are taken from third kernel crash.
lfs_sp == NULL deref on fcntl command 2684931076 in lfs_vnops.c line 2037,
same location, reproduced crash.
gdb) target kvm /export/crash/netbsd.15.core
0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:779
779 dumpsys();
(gdb) bt
#0 0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:779
#1 0xffffffff80ae8e6f in kern_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:91
#2 0xffffffff80b32ced in vpanic (fmt=fmt@entry=0xffffffff8110e72e "trap",
ap=ap@entry=0xffffbf89470b5b38) at ../../../../kern/subr_prf.c:288
#3 0xffffffff80b32dc2 in panic (fmt=fmt@entry=0xffffffff8110e72e "trap")
at ../../../../kern/subr_prf.c:209
#4 0xffffffff8023d04e in trap (frame=0xffffbf89470b5c80)
at ../../../../arch/amd64/amd64/trap.c:325
#5 0xffffffff80234ad4 in alltraps ()
#6 0xffffffff80a52e16 in lfs_fcntl (v=0xffffbf89470b5e40)
at ../../../../ufs/lfs/lfs_vnops.c:2037
#7 lfs_fcntl (v=0xffffbf89470b5e40) at ../../../../ufs/lfs/lfs_vnops.c:1851
#8 0xffffffff80bb9bae in VOP_FCNTL (vp=0xffff854afc2cb080,
command=<optimized out>, data=<optimized out>, fflag=<optimized out>,
cred=<optimized out>) at ../../../../kern/vnode_if.c:972
#9 0xffffffff80b44818 in fcntl_forfs (fd=<optimized out>, fp=<optimized out>,
cmd=-1610036220, arg=0x7f7fff4e1e08) at ../../../../kern/sys_descrip.c:226
#10 sys_fcntl (l=<optimized out>, uap=<optimized out>, retval=<optimized out>)
at ../../../../kern/sys_descrip.c:385
#11 0xffffffff805cc341 in sy_call (sy=0xffffffff81460b20 <sysent+2208>,
l=0xffff854afa92a800, uap=0xffffbf89470b6000, rval=0xffffbf89470b5fb0)
at ../../../../sys/syscallvar.h:65
#12 sy_invoke (sy=0xffffffff81460b20 <sysent+2208>, l=0xffff854afa92a800,
uap=0xffffbf89470b6000, rval=0xffffbf89470b5fb0, code=92)
at ../../../../sys/syscallvar.h:94
#13 syscall (frame=0xffffbf89470b6000)
at ../../../../arch/x86/x86/syscall.c:137
#14 0xffffffff8021025d in handle_syscall ()
failed in same location.
gdb) frame 4
#4 0xffffffff8023d04e in trap (frame=0xffffbf89470b5c80)
at ../../../../arch/amd64/amd64/trap.c:325
325 panic("trap");
(gdb) p/x frame->tf_trapno
$1 = 0x6
(gdb) p/x frame->tf_err
$2 = 0x0
(gdb) p/x frame->tf_rip
$3 = 0xffffffff80a52e16
(gdb) p/x frame->tf_rdx
$4 = 0x0
(gdb) x/i frame->tf_rip
0xffffffff80a52e16 <lfs_fcntl+2317>: mov 0x68(%rdx),%rdx
(gdb) frame 6
#6 0xffffffff80a52e16 in lfs_fcntl (v=0xffffbf89470b5e40)
at ../../../../ufs/lfs/lfs_vnops.c:2037
2037 lws.offset = lfs_btofsb(fs, fs->lfs_sp->bytes_written);
failed in same fcntl command.
(gdb) info args
v = 0xffffbf89470b5e40
gdb) p *(struct vop_fcntl_args *)0xffffbf89470b5e40
$5 = {a_desc = 0xffffffff810ea640 <vop_fcntl_desc>, a_vp = 0xffff854afc2cb080,
a_command = 2684931076, a_data = 0xffffbf89470b5ed8, a_fflag = 1,
a_cred = 0xffff855233b26040}
(gdb) p *$vp
$6 = {v_uobj = {vmobjlock = 0xffff854afb693100,
pgops = 0xffffffff810e3ec0 <uvm_vnodeops>, uo_npages = 0, uo_refs = 1,
uo_pages = {t_root = 0x0, t_height = 0}, uo_ubc = {lh_first = 0x0}},
v_size = 32980992, v_writesize = 32980992, v_cv = {cv_opaque = {0x0,
0xffffffff81153aa4}}, v_iflag = 16384, v_uflag = 0,
v_usecount = -1073741821, v_numoutput = 0, v_writecount = 0,
v_holdcnt = 3627, v_cleanblkhd = {lh_first = 0xffff854b03de0d80},
v_dirtyblkhd = {lh_first = 0xffff854b03de0e98}, v_vflag = 0,
v_interlock = 0xffff854b07ec0c40, v_mount = 0xffff854afb88a000,
v_op = 0xffff85522faada00, v_un = {vu_mountedhere = 0x0, vu_socket = 0x0,
vu_specnode = 0x0, vu_fifoinfo = 0x0, vu_ractx = 0x0}, v_type = VREG,
v_tag = VT_LFS, v_data = 0xffff854afbdcc038, v_klist = 0xffff854afc2cb198,
v_segvguard = 0x0}
(gdb) p/x $vp->v_data
$7 = 0xffff854afbdcc038
(gdb) set $ip = (struct inode *)0xffff854afbdcc038
(gdb) p *$ip
$8 = {i_gnode = {g_op = 0xffffffff810e2840 <lfs_genfsops>, g_glock = {
rw_owner = 0}}, i_nextsnap = {tqe_next = 0x0, tqe_prev = 0x0},
i_vnode = 0xffff854afc2cb080, i_ump = 0xffff854af8f64600,
i_devvp = 0xffff854af9354580, i_state = 9, i_dev = 43011, i_number = 1,
i_lfs = 0xffff854afa950000, i_unused1 = 0x0, i_dquot = {0x0, 0x0},
i_modrev = 1615681151458, i_lockf = 0x0, i_crap = {ulr_count = 0,
ulr_endoff = 0, ulr_diroff = 0, ulr_offset = 0, ulr_reclen = 0},
i_crapcounter = 0, inode_ext = {lfs = 0xffff854afc30e038}, i_mode = 33152,
i_nlink = 1, i_size = 32980992, i_flags = 131072, i_gen = 1, i_uid = 0,
i_gid = 0, i_omode = 0, i_dirhash = 0x0, i_din = 0xffff854afbf4d038}
(gdb) p/x $ip->i_lfs
$9 = 0xffff854afa950000
(gdb) p/x ((struct lfs *)0xffff854afa950000)->lfs_sp
$10 = 0x0
# fsck -n /lfs
** /dev/rdk3 (NO WRITE)
** Newer checkpoint verified; recovered 39 seconds of data
** Last Mounted on /lfs
** Phase 0 - Check Inode Free List
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
** Phase 5 - Check Segment Block Accounting
DMETA GIVEN AS 1424365, SHOULD BE 1424395
FIX? no
AVAIL GIVEN AS 2490250, SHOULD BE 2490130
FIX? no
1565695 files, 38944944 used, 4712836 free
Responsible-Changed-From-To: kern-bug-people->perseant
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Sat, 01 Aug 2026 04:39:15 +0000
Responsible-Changed-Why:
Can you take a look at this?
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Shinichi Doyashiki <clare@csel.org>,
"Konrad E. Schroeder" <perseant@hhhh.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL
Date: Sat, 1 Aug 2026 04:58:04 +0000
I'm a little puzzled by how this could possibly ever work.
I don't see anything taking the seglock in this _except_ lfs_segwrite
-- I don't think lfs_writer_enter, lfs_prelock, or lfs_flush_dirops
will do that:
2021 case LFCNRECLAIM:
2022 /*
2023 * Flush dirops and write Ifile, allowing empty segments
2024 * to be immediately reclaimed.
2025 */
2026 lfs_writer_enter(fs, "pndirop");
2027 off =3D lfs_sb_getoffset(fs);
2028 lfs_prelock(fs, 0);
2029 lfs_flush_dirops(fs);
2030 LFS_CLEANERINFO(cip, fs, bp);
2031 oclean =3D lfs_ci_getclean(fs, cip);
2032 LFS_SYNC_CLEANERINFO(cip, fs, bp, 1);
2033 lfs_segwrite(ap->a_vp->v_mount, SEGM_CKP | SEGM_FORCE_CKP);
2034 /* Copy out write stats */
2035 if (ap !=3D NULL && ap->a_data !=3D NULL) {
2036 lws.direct =3D 0;
2037 lws.offset =3D lfs_btofsb(fs, fs->lfs_sp->bytes_written);
2038 *(struct lfs_write_stats *)ap->a_data =3D lws;
2039 }
2040 lfs_preunlock(fs);
2041 lfs_writer_leave(fs);
https://nxr.netbsd.org/xref/src/sys/ufs/lfs/lfs_vnops.c?r=3D1.353#2021
Inside lfs_segwrite, there is only one path out if the file system
isn't read-only -- these are the only two returns:
542 int
543 lfs_segwrite(struct mount *mp, int flags)
544 {
...
563 if (fs->lfs_ronly)
564 return EROFS;
...
588 lfs_seglock(fs, flags | (do_ckp ? SEGM_CKP : 0));
589 sp =3D fs->lfs_sp;
...
807 lfs_segunlock(fs);
808=20
809 DLOG((DLOG_SEG, " returning 0\n"));
810 return (0);
811 }
https://nxr.netbsd.org/xref/src/sys/ufs/lfs/lfs_segment.c?r=3D1.308#539
So I think when we enter lfs_seglock from fcntl(LFCNRECLAIM), we are
guaranteed _not_ to hold the seglock, and thus the seglock depth from
line 588 to line 807 should be 1. And in that case, lfs_segunlock
will free fs->lfs_sp and null it out:
490 void
491 lfs_segunlock(struct lfs *fs)
492 {
...
503 if (fs->lfs_seglock =3D=3D 1) {
...
526 if (!sync)
527 pool_put(&fs->lfs_segpool, sp);
528 fs->lfs_sp =3D NULL;
...
569 if (sync)
570 pool_put(&fs->lfs_segpool, sp);
...
594 } else {
595 --fs->lfs_seglock;
596 KASSERT(fs->lfs_seglock !=3D 0);
597 }
598=20
599 lfs_preunlock(fs);
600 }
https://nxr.netbsd.org/xref/src/sys/ufs/lfs/lfs_subr.c?r=3D1.110#486
So by the time lfs_segwrite returns, fs->lfs_sp should be null!
Now it looks like the LFCNRECLAIM code is racy: it's possible that
_another thread_ will set fs->lfs_sp to nonnull under the seglock, and
then LFCNRECLAIM might get lucky and read out a nonnull fs->lfs_sp by
chance. But I expect that to be the exception, not the rule.
It looks like perseant@ recently added a null test here, in January --
although it is sensible to add this null test for other reasons, I
wonder whether it was prompted by the same crash you're describing?
Module Name: src
Committed By: perseant
Date: Fri Jan 30 15:54:29 UTC 2026
Modified Files:
src/sys/ufs/lfs: lfs_vnops.c
Log Message:
Check whether ap->a_data is NULL before using it. Prevents a crash when
calling LCFNRECLAIM with a null stats pointer.
To generate a diff of this commit:
cvs rdiff -u -r1.352 -r1.353 src/sys/ufs/lfs/lfs_vnops.c
--- a/sys/ufs/lfs/lfs_vnops.c
+++ b/sys/ufs/lfs/lfs_vnops.c
...
@@ -2032,7 +2032,7 @@ lfs_fcntl(void *v)
LFS_SYNC_CLEANERINFO(cip, fs, bp, 1);
lfs_segwrite(ap->a_vp->v_mount, SEGM_CKP | SEGM_FORCE_CKP);
/* Copy out write stats */
- if (ap !=3D NULL) {
+ if (ap !=3D NULL && ap->a_data !=3D NULL) {
lws.direct =3D 0;
lws.offset =3D lfs_btofsb(fs, fs->lfs_sp->bytes_written);
*(struct lfs_write_stats *)ap->a_data =3D lws;
https://mail-index.netbsd.org/source-changes/2026/01/30/msg160457.html
Going back slightly further in January, it looks like LFCNRECLAIM
_used to_ hold the seglock across the logic where this crash happened:
Module Name: src
Committed By: perseant
Date: Tue Jan 20 15:30:15 UTC 2026
Modified Files:
src/sys/ufs/lfs: lfs_segment.c
Log Message:
Avoid a deadlock between vnode reclamation and lfs_writevnodes(). A vnode
being reclaimed will be in state VS_RECLAIMING, while it attemmpts to get t=
he
segment lock. lfs_writevnodes() holds the segment lock while traversing the
list of vnodes; so it must skip vnodes in the process of reclamation in ord=
er
to avoid a deadlock.
To generate a diff of this commit:
cvs rdiff -u -r1.306 -r1.307 src/sys/ufs/lfs/lfs_segment.c
--- a/sys/ufs/lfs/lfs_vnops.c
+++ b/sys/ufs/lfs/lfs_vnops.c
...
@@ -2025,20 +2025,19 @@ lfs_fcntl(void *v)
*/
lfs_writer_enter(fs, "pndirop");
off =3D lfs_sb_getoffset(fs);
- lfs_seglock(fs, SEGM_FORCE_CKP | SEGM_CKP);
+ lfs_prelock(fs, 0);
lfs_flush_dirops(fs);
LFS_CLEANERINFO(cip, fs, bp);
oclean =3D lfs_ci_getclean(fs, cip);
LFS_SYNC_CLEANERINFO(cip, fs, bp, 1);
- lfs_segwrite(ap->a_vp->v_mount, SEGM_FORCE_CKP);
- fs->lfs_sp->seg_flags |=3D SEGM_PROT;
+ lfs_segwrite(ap->a_vp->v_mount, SEGM_CKP | SEGM_FORCE_CKP);
/* Copy out write stats */
if (ap !=3D NULL) {
lws.direct =3D 0;
lws.offset =3D lfs_btofsb(fs, fs->lfs_sp->bytes_written);
*(struct lfs_write_stats *)ap->a_data =3D lws;
}
- lfs_segunlock(fs);
+ lfs_preunlock(fs);
lfs_writer_leave(fs);
https://mail-index.netbsd.org/source-changes/2026/01/20/msg160304.html
So it looks like that change introduced the bug.
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Shinichi Doyashiki <clare@csel.org>,
"Konrad E. Schroeder" <perseant@hhhh.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL
Date: Sat, 1 Aug 2026 05:24:00 +0000
This is a multi-part message in MIME format.
--=_rhGMeJlKcnVU63TmxERqST609Awrm+9s
Content-Transfer-Encoding: quoted-printable
Can you try the attached patch?
I think both null tests are superfluous, because sys_fcntl always
passes a non-ull data argument, and VOP_FCNTL always passes a nonnull
argument pointer:
1391 #define LFCNRECLAIM _FCNW_FSPRIV ('L', 4, struct lfs_write_stats)
https://nxr.netbsd.org/xref/src/sys/ufs/lfs/lfs.h?r=3D1.219#1391
Note that _FCNW_FSPRIV sets F_FSCTL:
250 #define F_FSCTL (int)0x80000000 /* This fcntl goes to the fs */
...
272 #define _FCN_FSPRIV(inout, fs, num, len) \
273 (F_FSCTL | F_FSPRIV | inout | ((len & F_PARAM_MASK) << 16) | \
274 (fs) << 8 | (num))
...
277 #define _FCNW_FSPRIV(f, c, t) _FCN_FSPRIV(F_FSOUT, (f), (c), (int=
)sizeof(t))
https://nxr.netbsd.org/xref/src/sys/sys/fcntl.h?r=3D1.59#245
So sys_fcntl passes it through to fcntl_forfs:
326 int
327 sys_fcntl(struct lwp *l, const struct sys_fcntl_args *uap, register=
_t *retval)
328 {
...
384 if ((cmd & F_FSCTL)) {
385 error =3D fcntl_forfs(fd, fp, cmd, SCARG(uap, arg));
386 fd_putfile(fd);
387 return error;
388 }
https://nxr.netbsd.org/xref/src/sys/kern/sys_descrip.c?r=3D1.54#323
And fcntl_forfs always passes a temporary buffer:
181 static int
182 fcntl_forfs(int fd, file_t *fp, int cmd, void *arg)
183 {
184 int error;
185 u_int size;
186 void *data, *memp;
187 #define STK_PARAMS 128
188 char stkbuf[STK_PARAMS];
....
201 if (size > sizeof(stkbuf)) {
202 memp =3D kmem_alloc(size, KM_SLEEP);
203 data =3D memp;
204 } else
205 data =3D stkbuf;
...
226 error =3D (*fp->f_ops->fo_fcntl)(fp, cmd, data);
https://nxr.netbsd.org/xref/src/sys/kern/sys_descrip.c?r=3D1.54#178
951 int
952 VOP_FCNTL(struct vnode *vp,
953 u_int command,
954 void *data,
955 int fflag,
956 kauth_cred_t cred)
957 {
958 int error;
959 bool mpsafe;
960 struct vop_fcntl_args a;
...
972 error =3D (VCALL(vp, VOFFSET(vop_fcntl), &a));
https://nxr.netbsd.org/xref/src/sys/kern/vnode_if.c?r=3D1.119#972
While here, I also made sure to zero-initialize the entire output
structure up front so we don't inadvertently leak kernel stack garbage
to userland in case not all fields are initialized. (If they are all
initialized, no big deal, the compiler can delete the memset.)
--=_rhGMeJlKcnVU63TmxERqST609Awrm+9s
Content-Type: text/plain; charset="ISO-8859-1"; name="pr60504-lfsfcntlnpd"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr60504-lfsfcntlnpd.patch"
# HG changeset patch
# User Taylor R Campbell <riastradh@NetBSD.org>
# Date 1785561141 0
# Sat Aug 01 05:12:21 2026 +0000
# Branch trunk
# Node ID 1f2d855671ed4d4eee9ff4420a357756f04e271a
# Parent 5531308329cc7c89866cd27c64e657e58d8b92fc
# EXP-Topic riastradh-pr60504-lfsfcntlnpd
WIP: lfs: fcntl(LFCNRECLAIM): Fix null pointer deref.
XXX explain further
PR kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp =3D=3D NULL
diff -r 5531308329cc -r 1f2d855671ed sys/ufs/lfs/lfs_vnops.c
--- a/sys/ufs/lfs/lfs_vnops.c Wed Jul 29 20:17:12 2026 +0000
+++ b/sys/ufs/lfs/lfs_vnops.c Sat Aug 01 05:12:21 2026 +0000
@@ -2030,13 +2030,14 @@ lfs_fcntl(void *v)
LFS_CLEANERINFO(cip, fs, bp);
oclean =3D lfs_ci_getclean(fs, cip);
LFS_SYNC_CLEANERINFO(cip, fs, bp, 1);
+ lfs_seglock(fs, 0);
lfs_segwrite(ap->a_vp->v_mount, SEGM_CKP | SEGM_FORCE_CKP);
/* Copy out write stats */
- if (ap !=3D NULL && ap->a_data !=3D NULL) {
- lws.direct =3D 0;
- lws.offset =3D lfs_btofsb(fs, fs->lfs_sp->bytes_written);
- *(struct lfs_write_stats *)ap->a_data =3D lws;
- }
+ memset(&lws, 0, sizeof(lws));
+ lws.direct =3D 0;
+ lws.offset =3D lfs_btofsb(fs, fs->lfs_sp->bytes_written);
+ *(struct lfs_write_stats *)ap->a_data =3D lws;
+ lfs_segunlock(fs);
lfs_preunlock(fs);
lfs_writer_leave(fs);
=20
--=_rhGMeJlKcnVU63TmxERqST609Awrm+9s--
From: Shinichi Doyashiki <clare@csel.org>
To: Taylor R Campbell <riastradh@netbsd.org>, gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Sat, 08 Aug 2026 19:47:30 +0900
I experienced kernel crash while running cvs update on the LFS with the WIP patch.
[ 2136.0027704] panic: cpu0: softints stuck for 16 seconds
[ 2136.0027704] cpu0: Begin traceback...
[ 2136.0027704] vpanic() at netbsd:vpanic+0x171
[ 2136.0027704] panic() at netbsd:panic+0x3c
[ 2136.0027704] heartbeat() at netbsd:heartbeat+0x310
[ 2136.0027704] hardclock() at netbsd:hardclock+0x89
[ 2136.0027704] Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
[ 2136.0027704] --- interrupt ---
[ 2136.0027704] _kernel_lock() at netbsd:_kernel_lock+0x13e
[ 2136.0027704] lfs_cluster_work() at netbsd:lfs_cluster_work+0x22
[ 2136.0027704] workqueue_worker() at netbsd:workqueue_worker+0xf3
[ 2136.0027704] cpu0: End traceback...
[ 2136.0027704] dumping to dev 168,1 (offset=336543, size=8346540):
[ 2136.0027704] dump WARNING: lwp 105 (system softclk/3) flags 0xa0000060: timecounter went backwards from (2136 + 0xb83852b386fac85c/2^64) sec to (2136 + 0x160083cff7f83894/2^64) sec in netbsd:mi_switch+0xde
[ 2136.0027704] WARNING: lwp 169 (system ioflush) flags 0x20020020: timecounter went backwards from (2136 + 0xb837c827179da464/2^64) sec to (2136 + 0x15ff5fa8acf31ca4/2^64) sec in netbsd:mi_switch+0xde
[ 2136.0027704] WARNING: lwp 2559 (system lfs_writer) flags 0x20000000: timecounter went backwards from (2136 + 0xb83829994bec390c/2^64) sec to (2136 + 0x16007bbf19626b94/2^64) sec in netbsd:mi_switch+0xde
[ 2136.0027704] 3023 3022 3021 3020 3019 WARNING: lwp 0 (system swapper): negative runtime: (-1 + 0xbf1fe5405497c9d4/2^64) sec
[ 2136.0027704] 3018 3017 3016 3015 3014 3013 3012 3011 3010 3009 3008 3007 3006 3005 3004 3003 3002 3001 3000 2999 2998 2997 2996 2995 2994 2993 2992 2991 2990 2989 2988 2987 2986 2985 2984 2983 2982 2981 2980 2979 2978 2977 2976 2975 2974 2973 2972 2971 2970 2969 2968 2967 2966 2965 2964 2963 2962 2961 2960 2959 2958 2957 2956 2955 2954 2953 2952 2951 2950 2949 2948 2947 2946 2945 2944 2943 2942 2941 2940 2939 2938 2937 2936 2935 2934 2933 2932 2931 2930 2929 2928 2927 2926 2925 2924 2923 2922 2921 2920 2919 2918 2917 2916 2915 2914 2913 2912 wddump: device timed out
[ 2136.0027704] i/o error
From: Shinichi Doyashiki <clare@csel.org>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Sun, 09 Aug 2026 13:35:55 +0900
I reverted `sysctl vfs.lfs.debug.freelist` and `vfs.lfs.debug.log.avail` to 0 and attempted
to reproduce the issue to verify the provided WIP patch;
however, the result was a kernel panic caused by a kernel lock spin-out.
[ 3368.3280741] cpu0[11 lfscwq]: kernel lock spinout
[ 3368.3280741] cpu3[1619 lfs_writer]: hogging kernel lock
[ 3368.3380740] ipi_msg_cpu_handler() at netbsd:ipi_msg_cpu_handler+0x5c
[ 3368.3380740] ipi_cpu_handler() at netbsd:ipi_cpu_handler+0x87
[ 3368.3480734] x86_ipi_handler() at netbsd:x86_ipi_handler+0x76
[ 3368.3580732] Xresume_lapic_ipi() at netbsd:Xresume_lapic_ipi+0x18
[ 3368.3580732] --- interrupt ---
[ 3368.3680732] uvm_map_findspace() at netbsd:uvm_map_findspace+0xf37
[ 3368.3680732] uvm_map_prepare() at netbsd:uvm_map_prepare+0x205
[ 3368.3780773] uvm_map() at netbsd:uvm_map+0x13d
[ 3368.3780773] uvm_pagermapin() at netbsd:uvm_pagermapin+0x91
[ 3368.3880756] lfs_gop_write() at netbsd:lfs_gop_write+0x274
[ 3368.3980729] genfs_do_putpages() at netbsd:genfs_do_putpages+0x66d
[ 3368.3980729] lfs_putpages() at netbsd:lfs_putpages+0x977
[ 3368.4080728] VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x6b
[ 3368.4180727] lfs_writefile() at netbsd:lfs_writefile+0x10b
[ 3368.4180727] lfs_writevnodes() at netbsd:lfs_writevnodes+0xe3
[ 3368.4280726] lfs_segwrite() at netbsd:lfs_segwrite+0x727
[ 3368.4380725] lfs_flush_fs() at netbsd:lfs_flush_fs+0x7c
[ 3368.4380725] lfs_writerd() at netbsd:lfs_writerd+0x5df
[ 3373.0080308] panic: cpu0: softints stuck for 16 seconds
[ 3373.0080308] cpu0: Begin traceback...
[ 3373.0080308] vpanic() at netbsd:vpanic+0x171
[ 3373.0080308] panic() at netbsd:panic+0x3c
[ 3373.0080308] heartbeat() at netbsd:heartbeat+0x310
[ 3373.0080308] hardclock() at netbsd:hardclock+0x89
[ 3373.0080308] Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
[ 3373.0080308] --- interrupt ---
[ 3373.0080308] _kernel_lock() at netbsd:_kernel_lock+0x13e
[ 3373.0080308] intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x16
[ 3373.0080308] Xhandle_ioapic_edge17() at netbsd:Xhandle_ioapic_edge17+0x75
[ 3373.0080308] --- interrupt ---
[ 3373.0080308] _kernel_lock() at netbsd:_kernel_lock+0x13e
[ 3373.0080308] wqinput_work() at netbsd:wqinput_work+0x8d
[ 3373.0080308] workqueue_worker() at netbsd:workqueue_worker+0xf3
[ 3373.0080308] cpu0: End traceback...
[ 3373.0080308] fatal breakpoint trap in supervisor mode
[ 3373.0080308] trap type 1 code 0 rip 0xffffffff8023541d cs 0x8 rflags 0x202 cr2 0xffffdb893daaf000 ilevel 0x7 rsp 0xffffdb8946c02b28
[ 3373.0080308] curlwp 0xffffb732f83c5000 pid 0.219 lowest kstack 0xffffdb8946bfe2c0
Stopped in pid 0.219 (system) at netbsd:breakpoint+0x5: leave
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x171
panic() at netbsd:panic+0x3c
heartbeat() at netbsd:heartbeat+0x310
hardclock() at netbsd:hardclock+0x89
Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
--- interrupt ---
_kernel_lock() at netbsd:_kernel_lock+0x13e
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x16
Xhandle_ioapic_edge17() at netbsd:Xhandle_ioapic_edge17+0x75
--- interrupt ---
_kernel_lock() at netbsd:_kernel_lock+0x13e
wqinput_work() at netbsd:wqinput_work+0x8d
workqueue_worker() at netbsd:workqueue_worker+0xf3
ds 0
es 180
fs 2ad8
gs 2b28
rdi 7
rsi 3f8
rbp ffffdb8946c02b28
rbx ffffffff81211968 ostype+0xefda0
rdx 1
rcx ffffffffffffff
rax 84000000a000000
r8 74000000a000000
r9 700000000000000
r10 0
r11 ffffffff8116467d ostype+0x42ab5
r12 ffffdb8946c02b70
r13 104
r14 0
r15 ffffffff8143cf00 cpu_info_primary
rip ffffffff8023541d breakpoint+0x5
cs 8
rflags 202
rsp ffffdb8946c02b28
ss 10
netbsd:breakpoint+0x5: leave
From: "Konrad Schroder" <perseant@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60504 CVS commit: src/sys/ufs/lfs
Date: Tue, 25 Aug 2026 16:34:33 +0000
Module Name: src
Committed By: perseant
Date: Tue Aug 25 16:34:33 UTC 2026
Modified Files:
src/sys/ufs/lfs: lfs_vnops.c
Log Message:
Hold the segment lock across the bytes reporting in LFCNRECLAIM.
This is a trivial modification of riastradh's patch from PR 60504.
To generate a diff of this commit:
cvs rdiff -u -r1.353 -r1.354 src/sys/ufs/lfs/lfs_vnops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Shinichi Doyashiki <clare@csel.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org, perseant@NetBSD.org
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Thu, 27 Aug 2026 02:22:18 +0000
This is a multi-part message in MIME format.
--=_9iRVuQui7SP0XI0my0i42KB+RbbJU+ZS
> Date: Sat, 08 Aug 2026 19:47:30 +0900
> From: Shinichi Doyashiki <clare@csel.org>
>
> I experienced kernel crash while running cvs update on the LFS with
> the WIP patch.
>
> [ 2136.0027704] panic: cpu0: softints stuck for 16 seconds
> [ 2136.0027704] cpu0: Begin traceback...
> [ 2136.0027704] vpanic() at netbsd:vpanic+0x171
> [ 2136.0027704] panic() at netbsd:panic+0x3c
> [ 2136.0027704] heartbeat() at netbsd:heartbeat+0x310
> [ 2136.0027704] hardclock() at netbsd:hardclock+0x89
> [ 2136.0027704] Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
> [ 2136.0027704] --- interrupt ---
> [ 2136.0027704] _kernel_lock() at netbsd:_kernel_lock+0x13e
> [ 2136.0027704] lfs_cluster_work() at netbsd:lfs_cluster_work+0x22
> [ 2136.0027704] workqueue_worker() at netbsd:workqueue_worker+0xf3
> [ 2136.0027704] cpu0: End traceback...
I bet this is just a matter of doing too much work in lfs with the
kernel lock held. I think this is going to require ripping the
band-aid that is the kernel lock off lfs, which we need to do anyway
sooner or later. Most of it is serialized by lfs_lock anyway. Try
the attached patch?
--=_9iRVuQui7SP0XI0my0i42KB+RbbJU+ZS
Content-Type: text/plain; charset="ISO-8859-1"; name="lfskernellock"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="lfskernellock.patch"
# HG changeset patch
# User Taylor R Campbell <riastradh@NetBSD.org>
# Date 1787517532 0
# Sun Aug 23 20:38:52 2026 +0000
# Branch trunk
# Node ID ab8e67a9238a093c16504fef6720a224a9f31a9e
# Parent 4fbd288ac1da9e7d9592ddecf04f7513e244152f
# EXP-Topic riastradh-20260823-lfshacks
WIP: lfs: Run this without the kernel lock.
diff -r 4fbd288ac1da -r ab8e67a9238a sys/ufs/lfs/lfs_syscalls.c
--- a/sys/ufs/lfs/lfs_syscalls.c Mon Aug 10 13:36:10 2026 +0000
+++ b/sys/ufs/lfs/lfs_syscalls.c Sun Aug 23 20:38:52 2026 +0000
@@ -130,7 +130,6 @@ sys_lfs_markv(struct lwp *l, const struc
if ((u_int) blkcnt > LFS_MARKV_MAXBLKCNT)
return (EINVAL);
=20
- KERNEL_LOCK(1, NULL);
blkiov =3D lfs_malloc(fs, blkcnt * sizeof(BLOCK_INFO), LFS_NB_BLKIOV);
if ((error =3D copyin(SCARG(uap, blkiov), blkiov,
blkcnt * sizeof(BLOCK_INFO))) !=3D 0)
@@ -141,7 +140,6 @@ sys_lfs_markv(struct lwp *l, const struc
blkcnt * sizeof(BLOCK_INFO));
out:
lfs_free(fs, blkiov, LFS_NB_BLKIOV);
- KERNEL_UNLOCK_ONE(NULL);
return error;
}
#else
@@ -171,7 +169,6 @@ sys_lfs_markv(struct lwp *l, const struc
if ((u_int) blkcnt > LFS_MARKV_MAXBLKCNT)
return (EINVAL);
=20
- KERNEL_LOCK(1, NULL);
blkiov =3D lfs_malloc(fs, blkcnt * sizeof(BLOCK_INFO), LFS_NB_BLKIOV);
blkiov15 =3D lfs_malloc(fs, blkcnt * sizeof(BLOCK_INFO_15), LFS_NB_BLKIOV=
);
if ((error =3D copyin(SCARG(uap, blkiov), blkiov15,
@@ -204,7 +201,6 @@ sys_lfs_markv(struct lwp *l, const struc
out:
lfs_free(fs, blkiov, LFS_NB_BLKIOV);
lfs_free(fs, blkiov15, LFS_NB_BLKIOV);
- KERNEL_UNLOCK_ONE(NULL);
return error;
}
#endif
@@ -575,7 +571,6 @@ sys_lfs_bmapv(struct lwp *l, const struc
if ((u_int) blkcnt > SIZE_T_MAX / sizeof(BLOCK_INFO))
return (EINVAL);
#endif
- KERNEL_LOCK(1, NULL);
blkiov =3D lfs_malloc(fs, blkcnt * sizeof(BLOCK_INFO), LFS_NB_BLKIOV);
if ((error =3D copyin(SCARG(uap, blkiov), blkiov,
blkcnt * sizeof(BLOCK_INFO))) !=3D 0)
@@ -586,7 +581,6 @@ sys_lfs_bmapv(struct lwp *l, const struc
blkcnt * sizeof(BLOCK_INFO));
out:
lfs_free(fs, blkiov, LFS_NB_BLKIOV);
- KERNEL_UNLOCK_ONE(NULL);
return error;
}
#else
@@ -615,7 +609,6 @@ sys_lfs_bmapv(struct lwp *l, const struc
blkcnt =3D SCARG(uap, blkcnt);
if ((size_t) blkcnt > SIZE_T_MAX / sizeof(BLOCK_INFO))
return (EINVAL);
- KERNEL_LOCK(1, NULL);
blkiov =3D lfs_malloc(fs, blkcnt * sizeof(BLOCK_INFO), LFS_NB_BLKIOV);
blkiov15 =3D lfs_malloc(fs, blkcnt * sizeof(BLOCK_INFO_15), LFS_NB_BLKIOV=
);
if ((error =3D copyin(SCARG(uap, blkiov), blkiov15,
@@ -648,7 +641,6 @@ sys_lfs_bmapv(struct lwp *l, const struc
out:
lfs_free(fs, blkiov, LFS_NB_BLKIOV);
lfs_free(fs, blkiov15, LFS_NB_BLKIOV);
- KERNEL_UNLOCK_ONE(NULL);
return error;
}
#endif
@@ -683,9 +675,17 @@ lfs_bmapv(struct lwp *l, fsid_t *fsidp,=20
ump =3D VFSTOULFS(mntp);
fs =3D ump->um_lfs;
=20
- if (fs->lfs_cleaner_thread =3D=3D NULL)
+ mutex_enter(&lfs_lock);
+ if (fs->lfs_cleaner_thread =3D=3D NULL) {
fs->lfs_cleaner_thread =3D curlwp;
+ } else if (fs->lfs_cleaner_thread !=3D curlwp) {
+ error =3D EBUSY;
+ mutex_exit(&lfs_lock);
+ goto out;
+ }
+ panic("cleaning");
KASSERT(fs->lfs_cleaner_thread =3D=3D curlwp);
+ mutex_exit(&lfs_lock);
=20
cnt =3D blkcnt;
=20
@@ -791,6 +791,12 @@ lfs_bmapv(struct lwp *l, fsid_t *fsidp,=20
=20
KASSERTMSG((numrefed =3D=3D 0), "lfs_bmapv: numrefed=3D%d", numrefed);
=20
+ mutex_enter(&lfs_lock);
+ KASSERTMSG(fs->lfs_cleaner_thread =3D=3D curlwp, "cleaner thread is %p",
+ fs->lfs_cleaner_thread);
+ fs->lfs_cleaner_thread =3D NULL;
+ mutex_exit(&lfs_lock);
+out:
vfs_unbusy(mntp);
=20
return 0;
@@ -833,11 +839,9 @@ sys_lfs_segclean(struct lwp *l, const st
if ((error =3D vfs_busy(mntp)) !=3D 0)
return (error);
=20
- KERNEL_LOCK(1, NULL);
lfs_prelock(fs, 0);
error =3D lfs_do_segclean(fs, segnum, l->l_cred, l);
lfs_preunlock(fs);
- KERNEL_UNLOCK_ONE(NULL);
vfs_unbusy(mntp);
return error;
}
diff -r 4fbd288ac1da -r ab8e67a9238a sys/ufs/lfs/lfs_vfsops.c
--- a/sys/ufs/lfs/lfs_vfsops.c Mon Aug 10 13:36:10 2026 +0000
+++ b/sys/ufs/lfs/lfs_vfsops.c Sun Aug 23 20:38:52 2026 +0000
@@ -1184,6 +1184,7 @@ lfs_mountfs(struct vnode *devvp, struct=20
mp->mnt_stat.f_namemax =3D LFS_MAXNAMLEN;
mp->mnt_stat.f_iosize =3D lfs_sb_getbsize(fs);
mp->mnt_flag |=3D MNT_LOCAL;
+ mp->mnt_iflag |=3D IMNT_MPSAFE;
mp->mnt_iflag |=3D IMNT_SHRLOOKUP;
mp->mnt_fs_bshift =3D lfs_sb_getbshift(fs);
mp->mnt_iflag |=3D IMNT_CAN_RWTORO;
diff -r 4fbd288ac1da -r ab8e67a9238a sys/ufs/lfs/lfs_vnops.c
--- a/sys/ufs/lfs/lfs_vnops.c Mon Aug 10 13:36:10 2026 +0000
+++ b/sys/ufs/lfs/lfs_vnops.c Sun Aug 23 20:38:52 2026 +0000
@@ -547,10 +547,8 @@ lfs_set_dirop(struct vnode *dvp, struct=20
if ((error =3D mtsleep(&lfs_dirvcount,
PCATCH | PUSER | PNORELOCK, "lfs_maxdirop", 0,
&lfs_lock)) !=3D 0) {
- mutex_exit(&lfs_lock);
goto unreserve;
}
- mutex_exit(&lfs_lock);
goto restart;
}
=20
--=_9iRVuQui7SP0XI0my0i42KB+RbbJU+ZS--
From: Shinichi Doyashiki <clare@csel.org>
To: Taylor R Campbell <riastradh@netbsd.org>
Cc: gnats-bugs@netbsd.org, perseant@netbsd.org
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Sun, 06 Sep 2026 23:39:34 +0900
> I bet this is just a matter of doing too much work in lfs with the
> kernel lock held. I think this is going to require ripping the
> band-aid that is the kernel lock off lfs, which we need to do anyway
> sooner or later. Most of it is serialized by lfs_lock anyway. Try
> the attached patch?
Using relatively recent kernel code and the your patch,
I was able to successfully complete `cvs update` and `build.sh`
within a working directory on LFS.
At the moment, I am testing using the userland cleaner daemon.
From: Shinichi Doyashiki <clare@csel.org>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Wed, 09 Sep 2026 06:18:59 +0900
> > I bet this is just a matter of doing too much work in lfs with the
> > kernel lock held. I think this is going to require ripping the
> > band-aid that is the kernel lock off lfs, which we need to do anyway
> > sooner or later. Most of it is serialized by lfs_lock anyway. Try
> > the attached patch?
>
> Using relatively recent kernel code and the your patch,
> I was able to successfully complete `cvs update` and `build.sh`
> within a working directory on LFS.
>
> At the moment, I am testing using the userland cleaner daemon.
When I tried build.sh again, a deadlock was observed.
db{0}> show proc /a ffff9022a8487800
lwp_t ffff9022a8487800
find: pid 17999 proc ffff902040e570c0 vmspace/map ffff9025b8930200 flags 4000
lwp 17999 ffff9022a8487800 pcb ffffb989853db000
stat 3 flags 0 cpu 2 pri 37 ref 0
wmesg prelockcv wchan ffff902307c66228
db{0}> bt /a ffff9022a8487800
trace: pid 17999 lid 17999 at 0xffffb989853dfd30
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
lfs_prelock() at netbsd:lfs_prelock+0x51
lfs_itimes() at netbsd:lfs_itimes+0x3c9
lfs_close() at netbsd:lfs_close+0x81
VOP_CLOSE() at netbsd:VOP_CLOSE+0x40
vn_close() at netbsd:vn_close+0x34
closef() at netbsd:closef+0xa1
fd_close() at netbsd:fd_close+0xf3
sys_close() at netbsd:sys_close+0x22
syscall() at netbsd:syscall+0x9d
--- syscall (number 6) ---
netbsd:syscall+0x9d:
db{0}> show proc /a ffff902178766000
lwp_t ffff902178766000
system: pid 0 proc ffffffff81465040 vmspace/map ffffffff8155a2e0 flags 20002
lwp 169 [ioflush] ffff902178766000 pcb ffffb98946d5f000
stat 3 flags 240 cpu 1 pri 124 ref 0
wmesg prelockcv wchan ffff902307c66228
lwp 168 [pgdaemon] ffff9021783c0000 pcb ffffb98946b39000
stat 3 flags 200 cpu 0 pri 126 ref 0
wmesg pgdaemon wchan ffffffff814f5b68
lwp 165 [swwreboot] ffff902178439c00 pcb ffffb98946b87000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg swwreboot wchan ffff902178347988
lwp 162 [npfgc0] ffff9021783c0800 pcb ffffb98946b40000
stat 3 flags 200 cpu 1 pri 96 ref 0
wmesg npfgcw wchan ffff902178286b88
lwp 161 [rt_free] ffff902178561800 pcb ffffb98946c28000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg rt_free wchan ffff9021784abdc8
lwp 160 [unpgc] ffff902178561400 pcb ffffb98946c21000
stat 3 flags 200 cpu 0 pri 96 ref 0
wmesg unpgc wchan ffffffff81566450
lwp 95 [key_timehandler] ffff902178561000 pcb ffffb98946c1a000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg key_timehandler wchan ffff9021784abc88
lwp 222 [icmp6_wqinput/3] ffff9021783c5c00 pcb ffffb98946c13000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg icmp6_wqinput wchan ffff90217761b708
lwp 221 [icmp6_wqinput/2] ffff9021783c5800 pcb ffffb98946c0c000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg icmp6_wqinput wchan ffff90217761b6c8
lwp 220 [icmp6_wqinput/1] ffff9021783c5400 pcb ffffb98946c05000
stat 3 flags 200 cpu 1 pri 222 ref 0
wmesg icmp6_wqinput wchan ffff90217761b688
lwp 219 [icmp6_wqinput/0] ffff9021783c5000 pcb ffffb98946bfe000
stat 3 flags 200 cpu 0 pri 222 ref 0
wmesg icmp6_wqinput wchan ffff90217761b648
lwp 218 [nd6_timer] ffff902178629c00 pcb ffffb98946bf7000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg nd6_timer wchan ffff9021784abb48
lwp 217 [carp6_wqinput/3] ffff902178629800 pcb ffffb98946bf0000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg carp6_wqinput wchan ffff90217761b308
lwp 216 [carp6_wqinput/2] ffff902178629400 pcb ffffb98946be9000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg carp6_wqinput wchan ffff90217761b2c8
lwp 215 [carp6_wqinput/1] ffff902178629000 pcb ffffb98946be2000
stat 3 flags 200 cpu 1 pri 222 ref 0
wmesg carp6_wqinput wchan ffff90217761b288
lwp 214 [carp6_wqinput/0] ffff9021784cdc00 pcb ffffb98946bdb000
stat 3 flags 200 cpu 0 pri 222 ref 0
wmesg carp6_wqinput wchan ffff90217761b248
lwp 213 [carp_wqinput/3] ffff9021784cd800 pcb ffffb98946bd4000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg carp_wqinput wchan ffff902178482f08
lwp 212 [carp_wqinput/2] ffff9021784cd400 pcb ffffb98946bcd000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg carp_wqinput wchan ffff902178482ec8
lwp 211 [carp_wqinput/1] ffff9021784cd000 pcb ffffb98946bc6000
stat 3 flags 200 cpu 1 pri 222 ref 0
wmesg carp_wqinput wchan ffff902178482e88
lwp 210 [carp_wqinput/0] ffff902178531c00 pcb ffffb98946bbf000
stat 3 flags 200 cpu 0 pri 222 ref 0
wmesg carp_wqinput wchan ffff902178482e48
lwp 209 [icmp_wqinput/3] ffff902178531800 pcb ffffb98946bb8000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg icmp_wqinput wchan ffff902178482b08
lwp 208 [icmp_wqinput/2] ffff902178531400 pcb ffffb98946bb1000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg icmp_wqinput wchan ffff902178482ac8
lwp 207 [icmp_wqinput/1] ffff902178531000 pcb ffffb98946baa000
stat 3 flags 200 cpu 1 pri 222 ref 0
wmesg icmp_wqinput wchan ffff902178482a88
lwp 206 [icmp_wqinput/0] ffff9021784d5c00 pcb ffffb98946ba3000
stat 3 flags 200 cpu 0 pri 222 ref 0
wmesg icmp_wqinput wchan ffff902178482a48
lwp 205 [rt_timer] ffff9021784d5800 pcb ffffb98946b95000
stat 3 flags 200 cpu 2 pri 43 ref 0
wmesg rt_timer wchan ffff9021784aba08
lwp 204 [vmem_rehash] ffff9021784d5400 pcb ffffb98946b9c000
stat 3 flags 200 cpu 0 pri 125 ref 0
wmesg vmem_rehash wchan ffff9021784ab8c8
lwp 198 [usb0] ffff902178439800 pcb ffffb98946b80000
stat 3 flags 200 cpu 1 pri 96 ref 0
wmesg usbevt wchan ffff90217831d4c0
lwp 197 [usb1] ffff902178439400 pcb ffffb98946b79000
stat 3 flags 200 cpu 1 pri 96 ref 0
wmesg usbevt wchan ffff90217831d978
lwp 196 [coretemp3] ffff902178439000 pcb ffffb98946b72000
stat 3 flags 200 cpu 2 pri 43 ref 0
wmesg coretemp3 wchan ffff9021784ab508
lwp 195 [coretemp2] ffff90217849dc00 pcb ffffb98946b6b000
stat 3 flags 200 cpu 3 pri 43 ref 0
wmesg coretemp2 wchan ffff9021784ab148
lwp 194 [coretemp1] ffff90217849d800 pcb ffffb98946b64000
stat 3 flags 200 cpu 2 pri 43 ref 0
wmesg coretemp1 wchan ffff90217836fec8
lwp 193 [coretemp0] ffff90217849d400 pcb ffffb98946b5d000
stat 3 flags 200 cpu 3 pri 43 ref 0
wmesg coretemp0 wchan ffff90217836fd88
lwp 192 [acpitz0] ffff90217849d000 pcb ffffb98946b56000
stat 3 flags 200 cpu 2 pri 43 ref 0
wmesg acpitz0 wchan ffff90217836fc48
lwp 122 [entbutler] ffff902177cb2c00 pcb ffffb98936b30000
stat 3 flags 200 cpu 1 pri 43 ref 0
wmesg entropy wchan ffffffff8148d630
lwp 121 [usbtask-dr] ffff902177cb2800 pcb ffffb98936b29000
stat 3 flags 200 cpu 0 pri 96 ref 0
wmesg usbtsk wchan ffffffff814b2e58
lwp 120 [usbtask-hc] ffff902177cb2400 pcb ffffb98936b22000
stat 3 flags 200 cpu 2 pri 96 ref 0
wmesg usbtsk wchan ffffffff814b2e18
lwp 119 [wm0Reset] ffff902177cb2000 pcb ffffb98936aeb000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg wm0Reset wchan ffff9021773d0ac8
lwp 118 [wm0TxRx/3] ffff902177cd6c00 pcb ffffb98936ae4000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg wm0TxRx wchan ffff9028afa90908
lwp 117 [wm0TxRx/2] ffff902177cd6800 pcb ffffb98936add000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg wm0TxRx wchan ffff9028afa908c8
lwp 116 [wm0TxRx/1] ffff902177cd6400 pcb ffffb98936ad6000
stat 3 flags 200 cpu 1 pri 222 ref 0
wmesg wm0TxRx wchan ffff9028afa90888
lwp 115 [wm0TxRx/0] ffff902177cd6000 pcb ffffb98936acf000
stat 3 flags 200 cpu 0 pri 222 ref 0
wmesg wm0TxRx wchan ffff9028afa90848
lwp 114 [igc0_tx_rx/3] ffff902177b76c00 pcb ffffb98936a84000
stat 3 flags 200 cpu 3 pri 222 ref 0
wmesg igc0_tx_rx wchan ffff9028afa90708
lwp 113 [igc0_tx_rx/2] ffff902177b76800 pcb ffffb98936a7d000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg igc0_tx_rx wchan ffff9028afa906c8
lwp 112 [igc0_tx_rx/1] ffff902177b76400 pcb ffffb98936a76000
stat 3 flags 200 cpu 1 pri 222 ref 0
wmesg igc0_tx_rx wchan ffff9028afa90688
lwp 111 [igc0_tx_rx/0] ffff902177b76000 pcb ffffb98936a6f000
stat 3 flags 200 cpu 0 pri 222 ref 0
wmesg igc0_tx_rx wchan ffff9028afa90648
lwp 110 [atabus1] ffff9021772b7c00 pcb ffffb98936946000
stat 3 flags 200 cpu 3 pri 96 ref 0
wmesg atath wchan ffffb98042f3cbe0
lwp 109 [atabus0] ffff9021772b7800 pcb ffffb9893693b000
stat 3 flags 240 cpu 2 pri 96 ref 0
wmesg atath wchan ffffb98042f3c3f0
lwp 107 [xcall/3] ffff9021772b7000 pcb ffffb989364f0000
stat 3 flags 200 cpu 3 pri 127 ref 0
wmesg xcall wchan ffffb989364bc010
lwp 106 [softser/3] ffff9021772dbc00 pcb ffffb989364e9000
stat 1 flags 200 cpu 3 pri 223 ref 0
lwp 105 [softclk/3] ffff9021772db800 pcb ffffb989364e2000
stat 1 flags 200 cpu 3 pri 220 ref 0
lwp 104 [softbio/3] ffff9021772db400 pcb ffffb989364db000
stat 1 flags 200 cpu 3 pri 221 ref 0
lwp 103 [softnet/3] ffff9021772db000 pcb ffffb989364d4000
stat 1 flags 200 cpu 3 pri 222 ref 0
> lwp 102 [idle/3] ffff90217722cc00 pcb ffffb989364c5000
stat 1 flags 201 cpu 3 pri 0 ref 0
lwp 101 [xcall/2] ffff90217722c800 pcb ffffb989364b3000
stat 3 flags 200 cpu 2 pri 127 ref 0
wmesg xcall wchan ffffb9893647f010
lwp 100 [softser/2] ffff90217722c400 pcb ffffb989364ac000
stat 1 flags 200 cpu 2 pri 223 ref 0
lwp 99 [softclk/2] ffff90217722c000 pcb ffffb989364a5000
stat 1 flags 200 cpu 2 pri 220 ref 0
lwp 98 [softbio/2] ffff90217717bc00 pcb ffffb9893649e000
stat 1 flags 200 cpu 2 pri 221 ref 0
lwp 97 [softnet/2] ffff90217717b800 pcb ffffb98936497000
stat 1 flags 200 cpu 2 pri 222 ref 0
> lwp 96 [idle/2] ffff90217717b400 pcb ffffb98936488000
stat 1 flags 201 cpu 2 pri 0 ref 0
lwp 30 [xcall/1] ffff90217717b000 pcb ffffb98936474000
stat 3 flags 200 cpu 1 pri 127 ref 0
wmesg xcall wchan ffffb98935da0010
lwp 29 [softser/1] ffff90217715fc00 pcb ffffb9893646d000
stat 1 flags 200 cpu 1 pri 223 ref 0
lwp 28 [softclk/1] ffff90217715f800 pcb ffffb98936466000
stat 1 flags 200 cpu 1 pri 220 ref 0
lwp 27 [softbio/1] ffff90217715f400 pcb ffffb9893645f000
stat 1 flags 200 cpu 1 pri 221 ref 0
lwp 26 [softnet/1] ffff90217715f000 pcb ffffb98936458000
stat 1 flags 200 cpu 1 pri 222 ref 0
> lwp 25 [idle/1] ffff9028afa4ec00 pcb ffffb98935da9000
stat 1 flags 201 cpu 1 pri 0 ref 0
lwp 24 [lnxsyswq] ffff9028afa4e800 pcb ffffb989363d2000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg lnxsyswq wchan ffff9028b4b81e08
lwp 23 [lnxubdwq] ffff9028afa4e400 pcb ffffb989363cb000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg lnxubdwq wchan ffff9028b4b81d08
lwp 22 [lnxpwrwq] ffff9028afa4e000 pcb ffffb989363c4000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg lnxpwrwq wchan ffff9028b4b81c08
lwp 21 [lnxlngwq] ffff9028afa77c00 pcb ffffb989363bd000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg lnxlngwq wchan ffff9028b4b81b08
lwp 20 [lnxhipwq] ffff9028afa77800 pcb ffffb989363b6000
stat 3 flags 200 cpu 2 pri 43 ref 0
wmesg lnxhipwq wchan ffff9028b4b81a08
lwp 19 [lnxrcugc] ffff9028afa77400 pcb ffffb989363af000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg lnxrcugc wchan ffffffff8148bb08
lwp 18 [sysmon] ffff9028afa77000 pcb ffffb989363a8000
stat 3 flags 200 cpu 1 pri 96 ref 0
wmesg smtaskq wchan ffffffff814d3ff0
lwp 17 [pmfsuspend] ffff9028afa91c00 pcb ffffb989363a1000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg pmfsuspend wchan ffff9028b3b34948
lwp 16 [pmfevent] ffff9028afa91800 pcb ffffb9893639a000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg pmfevent wchan ffff9028b3b34808
lwp 15 [sopendfree] ffff9028afa91400 pcb ffffb98936393000
stat 3 flags 200 cpu 0 pri 96 ref 0
wmesg sopendfr wchan ffffffff815663d0
lwp 14 [ifwdog] ffff9028afa91000 pcb ffffb9893638c000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg ifwdog wchan ffff9028b3b346c8
lwp 13 [iflnkst] ffff9028b0ab7c00 pcb ffffb98936385000
stat 3 flags 200 cpu 2 pri 222 ref 0
wmesg iflnkst wchan ffff9028b3b34588
lwp 12 [lfsswq] ffff9028b0ab7800 pcb ffffb9893637e000
stat 3 flags 200 cpu 1 pri 123 ref 0
wmesg lfsswq wchan ffff9028b3b34448
lwp 11 [lfscwq] ffff9028b0ab7400 pcb ffffb98936377000
stat 3 flags 200 cpu 0 pri 123 ref 0
wmesg lfscwq wchan ffff9028b3b34308
lwp 10 [nfssilly] ffff9028b0ab7000 pcb ffffb98936370000
stat 3 flags 200 cpu 0 pri 43 ref 0
wmesg nfssilly wchan ffff9028b3b341c8
lwp 9 [pooldisp] ffff9028b3ae9c00 pcb ffffb98936369000
stat 3 flags 200 cpu 2 pri 43 ref 0
wmesg pooldisp wchan ffff9028b4b81728
lwp 8 [modunload] ffff9028b3ae9800 pcb ffffb98936362000
stat 3 flags 200 cpu 0 pri 125 ref 0
wmesg mod_unld wchan ffffffff815593b0
lwp 7 [xcall/0] ffff9028b3ae9400 pcb ffffb9893635b000
stat 3 flags 200 cpu 0 pri 127 ref 0
wmesg xcall wchan ffffffff8143cf10
lwp 6 [softser/0] ffff9028b3ae9000 pcb ffffb98936354000
stat 1 flags 200 cpu 0 pri 223 ref 0
lwp 5 [softclk/0] ffff9028b3b21c00 pcb ffffb9893634d000
stat 1 flags 200 cpu 0 pri 220 ref 0
lwp 4 [softbio/0] ffff9028b3b21800 pcb ffffb98936346000
stat 1 flags 200 cpu 0 pri 221 ref 0
lwp 3 [softnet/0] ffff9028b3b21400 pcb ffffb9893633f000
stat 1 flags 200 cpu 0 pri 222 ref 0
> lwp 2 [idle/0] ffff9028b3b21000 pcb ffffb98936330000
stat 1 flags 201 cpu 0 pri 0 ref 0
lwp 0 [swapper] ffffffff814648c0 pcb ffffffff818a3000
stat 3 flags 200 cpu 3 pri 125 ref 0
wmesg uvm wchan ffffffff814648c0
db{0}> bt /a ffff902178766000
trace: pid 0 lid 169 at 0xffffb98946d63e30
sleepq_block() at netbsd:sleepq_block+0xea
cv_wait() at netbsd:cv_wait+0xca
lfs_prelock() at netbsd:lfs_prelock+0x51
lfs_seglock() at netbsd:lfs_seglock+0x16
lfs_segwrite() at netbsd:lfs_segwrite+0x71
lfs_sync() at netbsd:lfs_sync+0xc6
VFS_SYNC() at netbsd:VFS_SYNC+0x22
sched_sync() at netbsd:sched_sync+0xd6
db{0}> show proc /a ffff90217fe78800
lwp_t ffff90217fe78800
lfs_cleanerd: pid 6449 proc ffff90218cd25840 vmspace/map ffff90217b132740 flags
0
lwp 6449 ffff90217fe78800 pcb ffffb98946df7000
stat 3 flags 180 cpu 2 pri 43 ref 0
wmesg segment wchan ffffffff814f3840
db{0}> bt /a ffff90217fe78800
trace: pid 6449 lid 6449 at 0xffffb98946dfbd00
sleepq_block() at netbsd:sleepq_block+0x233
cv_timedwait_sig() at netbsd:cv_timedwait_sig+0xda
lfs_segwait() at netbsd:lfs_segwait+0x5c
lfs_fcntl() at netbsd:lfs_fcntl+0x76c
VOP_FCNTL() at netbsd:VOP_FCNTL+0x46
sys_fcntl() at netbsd:sys_fcntl+0x461
syscall() at netbsd:syscall+0x9d
--- syscall (number 92) ---
netbsd:syscall+0x9d:
db{0}> show proc /a ffff90204263b400
lwp_t ffff90204263b400
nbinstallboot: pid 9544 proc ffff90263e24f500 vmspace/map ffff90249bdce580 flags
4000
lwp 9544 ffff90204263b400 pcb ffffb989470f4000
stat 3 flags 0 cpu 2 pri 31 ref 0
wmesg seg_iocount wchan ffff9024d483c0dc
db{0}> bt /a ffff90204263b400
trace: pid 9544 lid 9544 at 0xffffb989470f8c40
sleepq_block() at netbsd:sleepq_block+0xea
mtsleep() at netbsd:mtsleep+0x11f
lfs_segunlock() at netbsd:lfs_segunlock+0x1d9
lfs_segwrite() at netbsd:lfs_segwrite+0x531
lfs_flush_fs() at netbsd:lfs_flush_fs+0x7c
lfs_putpages() at netbsd:lfs_putpages+0x36d
VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x43
lfs_fsync() at netbsd:lfs_fsync+0xf4
VOP_FSYNC() at netbsd:VOP_FSYNC+0x47
sys_fsync() at netbsd:sys_fsync+0x5f
syscall() at netbsd:syscall+0x9d
--- syscall (number 95) ---
netbsd:syscall+0x9d:
From: "Konrad Schroder" <perseant@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60504 CVS commit: src/sys/ufs/lfs
Date: Tue, 8 Sep 2026 22:57:29 +0000
Module Name: src
Committed By: perseant
Date: Tue Sep 8 22:57:29 UTC 2026
Modified Files:
src/sys/ufs/lfs: lfs_segment.c
Log Message:
Decrement seg_iocount only while the segment lock is held. May help
with the deadlock reported in PR kern/60504.
To generate a diff of this commit:
cvs rdiff -u -r1.312 -r1.313 src/sys/ufs/lfs/lfs_segment.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: Shinichi Doyashiki <clare@csel.org>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
lfs_sp == NULL
Date: Sat, 12 Sep 2026 19:39:04 +0900
After confirming that the patch attempting to resolve the deadlock had been committed,
I ran `build.sh` twice with the LFS MPSAFE patch applied; no deadlock was observed.
The tests were conducted using the userland cleaner daemon.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home