Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL

The following reply was made to PR kern/60504; it has been noted by GNATS.

From: Shinichi Doyashiki <[email protected]>
To: [email protected]
Cc: 
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
 lfs_sp == NULL
Date: Sun, 09 Aug 2026 13:35:55 +0900

 I reverted `sysctl vfs.lfs.debug.freelist` and `vfs.lfs.debug.log.avail` to 0 and attempted
 to reproduce the issue to verify the provided WIP patch;
 however, the result was a kernel panic caused by a kernel lock spin-out.
 
 [ 3368.3280741] cpu0[11 lfscwq]: kernel lock spinout
 [ 3368.3280741] cpu3[1619 lfs_writer]: hogging kernel lock
 [ 3368.3380740] ipi_msg_cpu_handler() at netbsd:ipi_msg_cpu_handler+0x5c
 [ 3368.3380740] ipi_cpu_handler() at netbsd:ipi_cpu_handler+0x87
 [ 3368.3480734] x86_ipi_handler() at netbsd:x86_ipi_handler+0x76
 [ 3368.3580732] Xresume_lapic_ipi() at netbsd:Xresume_lapic_ipi+0x18
 [ 3368.3580732] --- interrupt ---
 [ 3368.3680732] uvm_map_findspace() at netbsd:uvm_map_findspace+0xf37
 [ 3368.3680732] uvm_map_prepare() at netbsd:uvm_map_prepare+0x205
 [ 3368.3780773] uvm_map() at netbsd:uvm_map+0x13d
 [ 3368.3780773] uvm_pagermapin() at netbsd:uvm_pagermapin+0x91
 [ 3368.3880756] lfs_gop_write() at netbsd:lfs_gop_write+0x274
 [ 3368.3980729] genfs_do_putpages() at netbsd:genfs_do_putpages+0x66d
 [ 3368.3980729] lfs_putpages() at netbsd:lfs_putpages+0x977
 [ 3368.4080728] VOP_PUTPAGES() at netbsd:VOP_PUTPAGES+0x6b
 [ 3368.4180727] lfs_writefile() at netbsd:lfs_writefile+0x10b
 [ 3368.4180727] lfs_writevnodes() at netbsd:lfs_writevnodes+0xe3
 [ 3368.4280726] lfs_segwrite() at netbsd:lfs_segwrite+0x727
 [ 3368.4380725] lfs_flush_fs() at netbsd:lfs_flush_fs+0x7c
 [ 3368.4380725] lfs_writerd() at netbsd:lfs_writerd+0x5df
 [ 3373.0080308] panic: cpu0: softints stuck for 16 seconds
 [ 3373.0080308] cpu0: Begin traceback...
 [ 3373.0080308] vpanic() at netbsd:vpanic+0x171
 [ 3373.0080308] panic() at netbsd:panic+0x3c
 [ 3373.0080308] heartbeat() at netbsd:heartbeat+0x310
 [ 3373.0080308] hardclock() at netbsd:hardclock+0x89
 [ 3373.0080308] Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
 [ 3373.0080308] --- interrupt ---
 [ 3373.0080308] _kernel_lock() at netbsd:_kernel_lock+0x13e
 [ 3373.0080308] intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x16
 [ 3373.0080308] Xhandle_ioapic_edge17() at netbsd:Xhandle_ioapic_edge17+0x75
 [ 3373.0080308] --- interrupt ---
 [ 3373.0080308] _kernel_lock() at netbsd:_kernel_lock+0x13e
 [ 3373.0080308] wqinput_work() at netbsd:wqinput_work+0x8d
 [ 3373.0080308] workqueue_worker() at netbsd:workqueue_worker+0xf3
 [ 3373.0080308] cpu0: End traceback...
 [ 3373.0080308] fatal breakpoint trap in supervisor mode
 [ 3373.0080308] trap type 1 code 0 rip 0xffffffff8023541d cs 0x8 rflags 0x202 cr2 0xffffdb893daaf000 ilevel 0x7 rsp 0xffffdb8946c02b28
 [ 3373.0080308] curlwp 0xffffb732f83c5000 pid 0.219 lowest kstack 0xffffdb8946bfe2c0
 Stopped in pid 0.219 (system) at        netbsd:breakpoint+0x5:  leave
 breakpoint() at netbsd:breakpoint+0x5
 vpanic() at netbsd:vpanic+0x171
 panic() at netbsd:panic+0x3c
 heartbeat() at netbsd:heartbeat+0x310
 hardclock() at netbsd:hardclock+0x89
 Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
 --- interrupt ---
 _kernel_lock() at netbsd:_kernel_lock+0x13e
 intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x16
 Xhandle_ioapic_edge17() at netbsd:Xhandle_ioapic_edge17+0x75
 --- interrupt ---
 _kernel_lock() at netbsd:_kernel_lock+0x13e
 wqinput_work() at netbsd:wqinput_work+0x8d
 workqueue_worker() at netbsd:workqueue_worker+0xf3
 ds          0
 es          180
 fs          2ad8
 gs          2b28
 rdi         7
 rsi         3f8
 rbp         ffffdb8946c02b28
 rbx         ffffffff81211968    ostype+0xefda0
 rdx         1
 rcx         ffffffffffffff
 rax         84000000a000000
 r8          74000000a000000
 r9          700000000000000
 r10         0
 r11         ffffffff8116467d    ostype+0x42ab5
 r12         ffffdb8946c02b70
 r13         104
 r14         0
 r15         ffffffff8143cf00    cpu_info_primary
 rip         ffffffff8023541d    breakpoint+0x5
 cs          8
 rflags      202
 rsp         ffffdb8946c02b28
 ss          10
 netbsd:breakpoint+0x5:  leave