kern/59912: running rm -rf on LFS hangs the rm process forever on prelock state

To: kern-bug-people%netbsd.org@localhost,gnats-admin%netbsd.org@localhost,netbsd-bugs%netbsd.org@localhost
Subject: kern/59912: running rm -rf on LFS hangs the rm process forever on prelock state
From: "Shinichi Doyashiki via gnats" <gnats-admin%NetBSD.org@localhost>
Date: Mon, 12 Jan 2026 09:15:00 +0000 (UTC)

>Number:         59912
>Category:       kern
>Synopsis:       running rm -rf on LFS hangs the rm process forever on prelock state
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 12 09:15:00 +0000 2026
>Originator:     Shinichi Doyashiki
>Release:        NetBSD 11.99.4 as of 2026-01-12 (JST)
>Organization:
	at home
>Environment:
System: NetBSD kanade.hq.csel.org 11.99.4 NetBSD 11.99.4 (KANADE_12) #3: Mon Jan 12 04:25:44 JST 2026 clare%kanade.hq.csel.org@localhost:/work/current/src/sys/arch/amd64/compile/KANADE_12 amd64
Architecture: x86_64
Machine: amd64
>Description:
	running rm -rf on filled LFS filesystem can hang
	the rm process forever on prelock state.

	the rm process:
(gdb) kvm proc 0xffff99f0031fc800
0xffffffff80960c23 in mi_switch (l=l@entry=0xffff99f0031fc800)
    at ../../../../kern/kern_synch.c:811
811                     prevlwp = cpu_switchto(l, newl, returning);
(gdb) bt
#0  0xffffffff80960c23 in mi_switch (l=l@entry=0xffff99f0031fc800)
    at ../../../../kern/kern_synch.c:811
#1  0xffffffff8095d263 in sleepq_block (timo=timo@entry=0,
    catch_p=catch_p@entry=false,
    syncobj=syncobj@entry=0xffffffff80da3480 <cv_syncobj>,
    nlocks=nlocks@entry=1) at ../../../../kern/kern_sleepq.c:392
#2  0xffffffff80914f91 in cv_wait (cv=0xffff99f15f73b228,
    mtx=0xffffffff810c80d8 <lfs_lock>) at ../../../../kern/kern_condvar.c:182
#3  0xffffffff808a897f in lfs_prelock (fs=fs@entry=0xffff99f15f73b000,
    flags=flags@entry=0) at ../../../../ufs/lfs/lfs_subr.c:683
#4  0xffffffff808a89d1 in lfs_fraglock_enter (fs=fs@entry=0xffff99f15f73b000,
    enter_exit=enter_exit@entry=0) at ../../../../ufs/lfs/lfs_subr.c:284
#5  0xffffffff80889b8c in lfs_orphan (fs=0xffff99f15f73b000,
    vp=vp@entry=0xffff99f24b358d00) at ../../../../ufs/lfs/lfs_alloc.c:968
#6  0xffffffff808b6298 in lfs_remove (v=0xffffa7094ab3be98)
    at ../../../../ufs/lfs/lfs_vnops.c:1056
#7  0xffffffff80a24af8 in VOP_REMOVE (dvp=0xffff99f306611a80,
    vp=0xffff99f24b358d00, cnp=cnp@entry=0xffffa7094ab3bf50)
    at ../../../../kern/vnode_if.c:1218
#8  0xffffffff80a0ad5d in do_sys_unlinkat (l=<optimized out>,
    fdat=<optimized out>, arg=<optimized out>, flags=<optimized out>,
    seg=<optimized out>) at ../../../../kern/vfs_syscalls.c:2963
#9  0xffffffff80526a0b in sy_call (sy=0xffffffff81059e90 <sysent+240>,
    l=0xffff99f0031fc800, uap=0xffffa7094ab3c000, rval=0xffffa7094ab3bfb0)
    at ../../../../sys/syscallvar.h:65
#10 sy_invoke (sy=0xffffffff81059e90 <sysent+240>, l=0xffff99f0031fc800,
    uap=0xffffa7094ab3c000, rval=0xffffa7094ab3bfb0, code=10)
    at ../../../../sys/syscallvar.h:94
#11 syscall (frame=0xffffa7094ab3c000)
    at ../../../../arch/x86/x86/syscall.c:137
#12 0xffffffff8021025d in handle_syscall ()
(gdb)

	the cleaner:
(gdb) kvm proc 0xffff99f002d69000
0xffffffff80960c23 in mi_switch (l=l@entry=0xffff99f002d69000)
    at ../../../../kern/kern_synch.c:811
811                     prevlwp = cpu_switchto(l, newl, returning);
(gdb) bt
#0  0xffffffff80960c23 in mi_switch (l=l@entry=0xffff99f002d69000)
    at ../../../../kern/kern_synch.c:811
#1  0xffffffff8095d263 in sleepq_block (timo=timo@entry=0,
    catch_p=catch_p@entry=false,
    syncobj=syncobj@entry=0xffffffff80da4940 <sleep_syncobj>,
    nlocks=nlocks@entry=2) at ../../../../kern/kern_sleepq.c:392
#2  0xffffffff809605d7 in mtsleep (ident=ident@entry=0xffff99f15f73b23c,
    priority=priority@entry=529,
    wmesg=wmesg@entry=0xffffffff80e07384 "clean1", timo=timo@entry=0,
    mtx=0xffffffff810c80d8 <lfs_lock>) at ../../../../kern/kern_synch.c:232
#3  0xffffffff808b32a5 in lfs_strategy (v=<optimized out>)
    at ../../../../ufs/lfs/lfs_vnops.c:1533
#4  0xffffffff80a256c2 in VOP_STRATEGY (vp=vp@entry=0xffff99f012474540,
    bp=bp@entry=0xffff99f1a75e0da8) at ../../../../kern/vnode_if.c:1733
#5  0xffffffff809f61ad in bio_doread (vp=0xffff99f012474540,
    blkno=<optimized out>, size=<optimized out>, async=async@entry=0)
    at ../../../../kern/vfs_bio.c:714
#6  0xffffffff809f630d in bread (vp=<optimized out>, blkno=<optimized out>,
    size=<optimized out>, flags=flags@entry=0,
    bpp=bpp@entry=0xffffa70946dedc28) at ../../../../kern/vfs_bio.c:754
#7  0xffffffff808a7bf2 in lfs_auto_segclean (fs=fs@entry=0xffff99f15f73b000)
    at ../../../../ufs/lfs/lfs_subr.c:440
#8  0xffffffff808a8527 in lfs_segunlock (fs=0xffff99f15f73b000)
    at ../../../../ufs/lfs/lfs_subr.c:581
#9  0xffffffff808aa2fb in lfs_markv (fsidp=fsidp@entry=0xffff99f166139118,
    blkiov=blkiov@entry=0xffffa70042d21000, blkcnt=blkcnt@entry=331,
    l=0xffff99f002d69000) at ../../../../ufs/lfs/lfs_syscalls.c:504
#10 0xffffffff808aac84 in lfs_markv (l=l@entry=0xffff99f002d69000,
    fsidp=fsidp@entry=0xffff99f166139118,
    blkiov=blkiov@entry=0xffffa70042d21000, blkcnt=blkcnt@entry=331)
    at ../../../../ufs/lfs/lfs_syscalls.c:541
#11 0xffffffff808b79e3 in lfs_fcntl (v=0xffffa70946dede40)
    at ../../../../ufs/lfs/lfs_vnops.c:2010
#12 lfs_fcntl (v=0xffffa70946dede40) at ../../../../ufs/lfs/lfs_vnops.c:1851
#13 0xffffffff80a2464e in VOP_FCNTL (vp=0xffff99f012474540,
    command=<optimized out>, data=<optimized out>, fflag=<optimized out>,
    cred=<optimized out>) at ../../../../kern/vnode_if.c:972
#14 0xffffffff809ad664 in fcntl_forfs (fd=<optimized out>, fp=<optimized out>,
    cmd=<optimized out>, arg=0x7f7fff42e1a0)
    at ../../../../kern/sys_descrip.c:226
#15 sys_fcntl (l=<optimized out>, uap=<optimized out>, retval=<optimized out>)
    at ../../../../kern/sys_descrip.c:385
#16 0xffffffff80526a0b in sy_call (sy=0xffffffff8105a640 <sysent+2208>,
    l=0xffff99f002d69000, uap=0xffffa70946dee000, rval=0xffffa70946dedfb0)
    at ../../../../sys/syscallvar.h:65
#17 sy_invoke (sy=0xffffffff8105a640 <sysent+2208>, l=0xffff99f002d69000,
    uap=0xffffa70946dee000, rval=0xffffa70946dedfb0, code=92)
    at ../../../../sys/syscallvar.h:94
#18 syscall (frame=0xffffa70946dee000)
    at ../../../../arch/x86/x86/syscall.c:137
#19 0xffffffff8021025d in handle_syscall ()
(gdb)

	ioflush process:
(gdb) kvm proc 0xffff99eff8799c00
0xffffffff80960c23 in mi_switch (l=l@entry=0xffff99eff8799c00)
    at ../../../../kern/kern_synch.c:811
811                     prevlwp = cpu_switchto(l, newl, returning);
(gdb) bt
#0  0xffffffff80960c23 in mi_switch (l=l@entry=0xffff99eff8799c00)
    at ../../../../kern/kern_synch.c:811
#1  0xffffffff8095d263 in sleepq_block (timo=timo@entry=0,
    catch_p=catch_p@entry=false,
    syncobj=syncobj@entry=0xffffffff80da4940 <sleep_syncobj>,
    nlocks=nlocks@entry=1) at ../../../../kern/kern_sleepq.c:392
#2  0xffffffff809605d7 in mtsleep (ident=ident@entry=0xffff99f15f73b244,
    priority=priority@entry=17,
    wmesg=wmesg@entry=0xffffffff80e0718f "lfs_wsync", timo=timo@entry=0,
    mtx=0xffffffff810c80d8 <lfs_lock>) at ../../../../kern/kern_synch.c:232
#3  0xffffffff808a8cc4 in lfs_writer_enter (fs=0xffff99f15f73b000,
    wmesg=0xffffffff80e0718f "lfs_wsync") at ../../../../ufs/lfs/lfs_subr.c:744
#4  0xffffffff808ad591 in lfs_sync (mp=0xffff99f166139000, waitfor=3,
    cred=<optimized out>) at ../../../../ufs/lfs/lfs_vfsops.c:1653
#5  0xffffffff80a08385 in VFS_SYNC (mp=0xffff99f166139000, a=<optimized out>,
    b=<optimized out>) at ../../../../kern/vfs_subr.c:1590
#6  0xffffffff80a084a3 in sched_sync (arg=<optimized out>)
    at ./machine/cpu.h:80
#7  0xffffffff80210327 in lwp_trampoline ()
#8  0x0000000000000000 in ?? ()
(gdb)

>How-To-Repeat:
	0. boot kernel with serial console attached
	1. create 7GiB of LFS and mount it
           (avoid automount at next boot time)
	2. copy src tree into the LFS
	3. umount the LFS; and run fsck_lfs -nf;
	   (at this time, no errors reported)
	4. mount the LFS again
	5. run rm -rf src &; on the LFS

>Fix:
	Sorry, unknown.

Prev by Date: bin/59911: dtrace: process arguments not easily available
Next by Date: Re: port-sparc/59907: sparc install regression
Previous by Thread: bin/59911: dtrace: process arguments not easily available
Next by Thread: Re: kern/59912: running rm -rf on LFS hangs the rm process forever on prelock state
Indexes:

Home | Main Index | Thread Index | Old Index