zfs discuss - Nov 2005 - zfs panic in buf_hash_remove()

zfs panicked on me today:

buf_hash_remove+0x3b(dd674f30)
arc_change_state+0x12a(d5cf9698, dd674f30, d5cf5d6c)
arc_delete_state+0xaf(d5cf9758, 2e34f500, 0)
arc_adjust+0x180()
arc_evict_for_state+0xe6(d5cf96c8, 20000, 0)
arc_access+0x2d3(e640c958, d5cf84ec)
arc_write_done+0xca(d7a18600)
zio_done+0x1b2(d7a18600)
zio_next_stage+0x73(d7a18600)
zio_wait_for_children+0x58()
zio_wait_children_done+0x18(d7a18600)
zio_next_stage+0x73(d7a18600)
zio_vdev_io_assess+0xc6(d7a18600)
zio_next_stage+0x73(d7a18600)
vdev_disk_io_done+0x2b()
vdev_io_done+0x18()
zio_vdev_io_done+0xe()
taskq_thread+0x16c(d5de1bf8, 0)
thread_start+8()

I looked around in the bugs a bit, but didn''t find anything that
seemed to fit it.  I can provide the core if anyone wants it.

--
Eric Enright

Eric Enright wrote:
> zfs panicked on me today:
> 
> buf_hash_remove+0x3b(dd674f30)
> arc_change_state+0x12a(d5cf9698, dd674f30, d5cf5d6c)
> arc_delete_state+0xaf(d5cf9758, 2e34f500, 0)
> arc_adjust+0x180()
> arc_evict_for_state+0xe6(d5cf96c8, 20000, 0)
> arc_access+0x2d3(e640c958, d5cf84ec)
> arc_write_done+0xca(d7a18600)
> zio_done+0x1b2(d7a18600)
> zio_next_stage+0x73(d7a18600)
> zio_wait_for_children+0x58()
> zio_wait_children_done+0x18(d7a18600)
> zio_next_stage+0x73(d7a18600)
> zio_vdev_io_assess+0xc6(d7a18600)
> zio_next_stage+0x73(d7a18600)
> vdev_disk_io_done+0x2b()
> vdev_io_done+0x18()
> zio_vdev_io_done+0xe()
> taskq_thread+0x16c(d5de1bf8, 0)
> thread_start+8()
> 
> I looked around in the bugs a bit, but didn''t find anything that
> seemed to fit it.  I can provide the core if anyone wants it.
> 
> --
> Eric Enright
> _______________________________________________
> zfs-discuss mailing list
> zfs-discuss at opensolaris.org
> http://opensolaris.org/mailman/listinfo/zfs-discuss
Please do... what does mdb report as the output of
::status?

If it''s like this:


 > ::status
debugging crash dump vmcore.6 (64-bit) from cyber
operating system: 5.11 onnv-gate:2005-11-01 (i86pc)
panic message:
ZFS: I/O failure (write on /dev/dsk/c1d0s0 off c8db40000: zio 
ffffffff9197e280 [L0 unallocated] vdev=0 offset=c8d740000 
size=20000L/20000P/20000A fletcher2 uncompressed LE contiguous 
birth=332206 fil
dump content: kernel pages only
 >

it''s bug
CR 6354389 Updated P1 driver/cmdk cmlb_partinfo can return bogus info 
for apparently any device during hot-plug events

fixed today (thanks Shidokht!) in solaris nevada.

- Bart

-- 
Bart Smaalders			Solaris Kernel Performance
barts at cyber.eng.sun.com		http://blogs.sun.com/barts

On 11/29/05, Bart Smaalders <bart.smaalders at sun.com>
wrote:
> Eric Enright wrote:
> > zfs panicked on me today:
> >
> > buf_hash_remove+0x3b(dd674f30)
> > arc_change_state+0x12a(d5cf9698, dd674f30, d5cf5d6c)
> > arc_delete_state+0xaf(d5cf9758, 2e34f500, 0)
> > arc_adjust+0x180()
> > arc_evict_for_state+0xe6(d5cf96c8, 20000, 0)
> > arc_access+0x2d3(e640c958, d5cf84ec)
> > arc_write_done+0xca(d7a18600)
> > zio_done+0x1b2(d7a18600)
> > zio_next_stage+0x73(d7a18600)
> > zio_wait_for_children+0x58()
> > zio_wait_children_done+0x18(d7a18600)
> > zio_next_stage+0x73(d7a18600)
> > zio_vdev_io_assess+0xc6(d7a18600)
> > zio_next_stage+0x73(d7a18600)
> > vdev_disk_io_done+0x2b()
> > vdev_io_done+0x18()
> > zio_vdev_io_done+0xe()
> > taskq_thread+0x16c(d5de1bf8, 0)
> > thread_start+8()
> >
> > I looked around in the bugs a bit, but didn''t find anything
that
> > seemed to fit it.  I can provide the core if anyone wants it.
>
> Please do... what does mdb report as the output of
> ::status?
>
> If it''s like this:
>
>
>  > ::status
> debugging crash dump vmcore.6 (64-bit) from cyber
> operating system: 5.11 onnv-gate:2005-11-01 (i86pc)
> panic message:
> ZFS: I/O failure (write on /dev/dsk/c1d0s0 off c8db40000: zio
> ffffffff9197e280 [L0 unallocated] vdev=0 offset=c8d740000
> size=20000L/20000P/20000A fletcher2 uncompressed LE contiguous
> birth=332206 fil
> dump content: kernel pages only
Nope;
> ::status
debugging crash dump vmcore.1 (32-bit) from yamano
operating system: 5.11 snv_27 (i86pc)
panic message:
BAD TRAP: type=e (#pf Page fault) rp=d599e97c addr=2c occurred in module
"zfs" d
ue to a NULL pointer dereference
dump content: kernel pages only


--
Eric Enright