From nobody@FreeBSD.org  Thu Mar 30 11:06:32 2006
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id BFA5F16A423
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 30 Mar 2006 11:06:32 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8F60643D46
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 30 Mar 2006 11:06:32 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k2UB6VGC019684
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 30 Mar 2006 11:06:31 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id k2UB6VTC019683;
	Thu, 30 Mar 2006 11:06:31 GMT
	(envelope-from nobody)
Message-Id: <200603301106.k2UB6VTC019683@www.freebsd.org>
Date: Thu, 30 Mar 2006 11:06:31 GMT
From: Tomas Olsson <tol@stacken.kth.se>
To: freebsd-gnats-submit@FreeBSD.org
Subject: panic after mtx_destroy() on locked spinlock
X-Send-Pr-Version: www-2.3

>Number:         95103
>Category:       kern
>Synopsis:       panic after mtx_destroy() on locked spinlock
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    jhb
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Mar 30 11:10:14 GMT 2006
>Closed-Date:    Tue Jan 15 20:29:42 UTC 2008
>Last-Modified:  Tue Jan 15 20:29:42 UTC 2008
>Originator:     Tomas Olsson
>Release:        5.5-BETA4
>Organization:
Stacken Computer Club
>Environment:
FreeBSD lab04.lab.it.su.se 5.5-BETA4 FreeBSD 5.5-BETA4 #0: Mon Mar 13 23:12:57 UTC 2006     root@perseus.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
MUTEX(9) man page, under mtx_destroy() says:
    It is permissible to have a single hold count on a mutex when it is destroyed.

This does not seem to be the case when the mutex is a MTX_SPIN lock. I get a panic very soon after I call mtx_destroy() during kld unload unless the lock is released. Page fault in user mode seems to be a common panic "cause" for this.

With a MTX_DEF it appears to work according to docs.
>How-To-Repeat:
{
struct mtx lock;
mtx_init(&lock, "foo", NULL, MTX_SPIN);
mtx_lock_spin(&lock);
mtx_destroy(&lock);
}
(tried during kld unload)
>Fix:

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->jhb 
Responsible-Changed-By: rwatson 
Responsible-Changed-When: Mon Apr 3 09:35:33 UTC 2006 
Responsible-Changed-Why:  
Assign to jhb, who tends to his flock of kernel locking primitives. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=95103 

From: John Baldwin <jhb@freebsd.org>
To: bug-followup@freebsd.org, tol@stacken.kth.se
Cc: Scott Long <scottl@samsco.org>
Subject: Re: kern/95103: panic after mtx_destroy() on locked spinlock
Date: Mon, 3 Apr 2006 11:55:20 -0400

 This is a bug and was fixed in HEAD in revision 1.163 of kern_mutex.c.
 It still neesd to be MFC'd to 6.x though.  For 5.5 I think you can
 basically do the same thing except use 'critical_exit()' in place of
 'spinlock_exit()'
 
 -- 
 John Baldwin <jhb@FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
 "Power Users Use the Power to Serve"  =  http://www.FreeBSD.org
State-Changed-From-To: open->closed 
State-Changed-By: jhb 
State-Changed-When: Tue Jan 15 20:29:31 UTC 2008 
State-Changed-Why:  
Fix was MFC'd a while back. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=95103 
>Unformatted:
