DragonFlyBSD

:I had a ntfs read-only mount and copied a few files off of it. After that I
:tried unmounting it, which resulted in the panic mentioned in the subject. The
:core is available at leaf:~rumko/crash/vnode/*.6 and the kernel was from about
:31st Jan.

Ok, try this patch.  It looks like NTFS accesses auxillary vnodes
    while flushing other vnodes, so a single vflush scan won't catch them
    all.  I don't even know if multiple vflushes will catch them all
    but lets try it and find out.

-Matt

diff --git a/sys/vfs/ntfs/ntfs_vfsops.c b/sys/vfs/ntfs/ntfs_vfsops.c
index d3d80d2..2a8c1a5 100644
--- a/sys/vfs/ntfs/ntfs_vfsops.c
+++ b/sys/vfs/ntfs/ntfs_vfsops.c
@ -633,6 +633,8 @ ntfs_unmount(struct mount *mp, int mntflags)

dprintf(("ntfs_unmount: vflushing...\n"));
     error = vflush(mp, 0, flags | SKIPSYSTEM);
+    error = vflush(mp, 0, flags | SKIPSYSTEM);
+    error = vflush(mp, 0, flags | SKIPSYSTEM);
     if (error) {
         kprintf("ntfs_unmount: vflush failed: %d\n",error);
         return (error);
@ -649,6 +651,8 @ ntfs_unmount(struct mount *mp, int mntflags)

/* vflush system vnodes */
     error = vflush(mp, 0, flags);
+    error = vflush(mp, 0, flags);
+    error = vflush(mp, 0, flags);
     if (error)
         kprintf("ntfs_unmount: vflush failed(sysnodes): %d\n",error);

On Feb 9, 2010, at 6:21 PM, Matthew Dillon wrote:

:I had a ntfs read-only mount and copied a few files off of it.
After that I
:tried unmounting it, which resulted in the panic mentioned in the
subject. The
:core is available at leaf:~rumko/crash/vnode/*.6 and the kernel was
from about
:31st Jan.

Ok, try this patch. It looks like NTFS accesses auxillary vnodes
while flushing other vnodes, so a single vflush scan won't catch
them
all. I don't even know if multiple vflushes will catch them all
but lets try it and find out.

-Matt

diff --git a/sys/vfs/ntfs/ntfs_vfsops.c b/sys/vfs/ntfs/ntfs_vfsops.c
index d3d80d2..2a8c1a5 100644
--- a/sys/vfs/ntfs/ntfs_vfsops.c
+++ b/sys/vfs/ntfs/ntfs_vfsops.c
@ -633,6 +633,8 @ ntfs_unmount(struct mount *mp, int mntflags)

dprintf(("ntfs_unmount: vflushing...\n"));
error = vflush(mp, 0, flags | SKIPSYSTEM);
+ error = vflush(mp, 0, flags | SKIPSYSTEM);
+ error = vflush(mp, 0, flags | SKIPSYSTEM);
if (error) {
kprintf("ntfs_unmount: vflush failed: %d\n",error);
return (error);
@ -649,6 +651,8 @ ntfs_unmount(struct mount *mp, int mntflags)

/* vflush system vnodes */
error = vflush(mp, 0, flags);
+ error = vflush(mp, 0, flags);
+ error = vflush(mp, 0, flags);
if (error)
kprintf("ntfs_unmount: vflush failed(sysnodes): %d\n",error);

Hi,

I tried your patch, but it didn't solve the problem. I'm using a
x86_64 kernel from Jan 30th on xen.

(gdb) bt
#0 Debugger (msg=<value optimized out>)
at /usr/src/sys/platform/pc64/x86_64/db_interface.c:360
#1 0xffffffff8036aa0d in panic (fmt=0xffffffff8064bb8e "unmount:
dangling vnode")
at /usr/src/sys/kern/kern_shutdown.c:742
#2 0xffffffff803d3762 in dounmount (mp=0xffffffff91f64260, flags=0)
at /usr/src/sys/kern/vfs_syscalls.c:783
#3 0xffffffff803d38d0 in sys_unmount (uap=0xffffffffb2f07b48)
at /usr/src/sys/kern/vfs_syscalls.c:618
#4 0xffffffff805c40fa in syscall2 (frame=0xffffffffb2f07bf8)
at /usr/src/sys/platform/pc64/x86_64/trap.c:1189
#5 0xffffffff805bcce3 in Xfast_syscall ()
at /usr/src/sys/platform/pc64/x86_64/exception.S:304
#6 0x00007ffffffffa8f in ?? ()
Reply contains invalid hex digit 84

Here's the info I have regarding the ntfs partition I'm testing with:
vm11 /usr/src/sys/vfs/ntfs/
$ df | grep ad2
/dev/ad2 51200 6196 45004
12% /mnt
vm1 /usr/src/sys/vfs/ntfs/
$ mount | grep ad2
/dev/ad2 on /mnt (ntfs, local)
vm1 /usr/src/sys/vfs/ntfs/
$ du /mnt/
0 /mnt/$Extend
352 /mnt/boot/common
16 /mnt/boot/ficl/i386
16 /mnt/boot/ficl/ia64
81 /mnt/boot/ficl/softwords
16 /mnt/boot/ficl/sparc64
545 /mnt/boot/ficl
112 /mnt/boot/forth
1025 /mnt/boot
3221 /mnt/

Tim

If someone could get me a small sample image of a NTFS filesystem
that exhibits the problem tracking this down will be easier.

-Matt

:
:Hi Matt,
:
:Grab from...
:
:Just vnconfig and mount_ntfs it. I've put some dummy data in there.
:
:Cheers,
:Antonio Huete

No luck.  I couldn't get it to crash.

Hmm.  Rumko, this is a bit drastic but here's a patch that
    will add serious debugging output to the console.  I kept
    the old patch too.  Please run this and upload a core from
    it when it crashes.  I may be able to figure out where the
    vnodes are being allocated from by looking at the backtrace.

-Matt

diff --git a/sys/vfs/ntfs/ntfs_vfsops.c b/sys/vfs/ntfs/ntfs_vfsops.c
index d3d80d2..a57ec3c 100644
--- a/sys/vfs/ntfs/ntfs_vfsops.c
+++ b/sys/vfs/ntfs/ntfs_vfsops.c
@ -633,12 +633,14 @ ntfs_unmount(struct mount *mp, int mntflags)

dprintf(("ntfs_unmount: vflushing...\n"));
     error = vflush(mp, 0, flags | SKIPSYSTEM);
+    error = vflush(mp, 0, flags | SKIPSYSTEM);
+    error = vflush(mp, 0, flags | SKIPSYSTEM);
     if (error) {
         kprintf("ntfs_unmount: vflush failed: %d\n",error);
         return (error);
     }

- /* Check if only system vnodes are rest /
+ / Check if only system vnodes are left */
for(i=0;i<NTFS_SYSNODESNUM;i++)
if((ntmp->ntm_sysvn[i]) &&
(ntmp->ntm_sysvn[i]->v_sysref.refcnt > 1)) return (EBUSY);
@ -649,6 +651,8 @ ntfs_unmount(struct mount *mp, int mntflags)

/* vflush system vnodes */
     error = vflush(mp, 0, flags);
+    error = vflush(mp, 0, flags);
+    error = vflush(mp, 0, flags);
     if (error)
         kprintf("ntfs_unmount: vflush failed(sysnodes): %d\n",error);

@ -894,6 +898,8 @ ntfs_vgetex(struct mount *mp, ino_t ino, u_int32_t attrtype, char *attrname,
}

error = getnewvnode(VT_NTFS, ntmp->ntm_mountp, &vp, VLKTIMEOUT, 0);
+    kprintf("NTFS: getnewvnode %p\n", vp);
+    print_backtrace();
     if(error) {
         ntfs_frele(fp);
         ntfs_ntput(ip);

All fixed now. Thanks to Tim getting me a nice NTFS image
exhibiting the problem.

It turns out that NTFS used vnode->v_type = VNON for special
    internal extent vnodes.  VNON vnodes are ignored by vflush()
    and thus get left dangling.

-Matt