[kernel] PANIC: cache destroy: still has partial slabs

[diver]

This is hrev46170 gcc2 hybrid.

I used Installer to clone Haiku installation to another disk and unmounted the disk by dragging it into the Trash. The panic was continuable.

PANIC: cache destroy: still has partial slabs
Welcome to Kernel Debugging Land...
Thread 236 "mount_server" running on CPU 0
stack trace for thread 236 "mount_server"
    kernel stack: 0x8112a000 to 0x8112e000
      user stack: 0x6090c000 to 0x6190c000
frame               caller     <image>:function + offset
 0 8112dc48 (+  32) 8012de12   <kernel_x86> arch_debug_stack_trace + 0x12
 1 8112dc68 (+  16) 8009278b   <kernel_x86> stack_trace_trampoline(NULL) + 0x0b
 2 8112dc78 (+  12) 80120f72   <kernel_x86> arch_debug_call_with_fault_handler + 0x1b
 3 8112dc84 (+  48) 8009425e   <kernel_x86> debug_call_with_fault_handler + 0x5e
 4 8112dcb4 (+  64) 800929ab   <kernel_x86> kernel_debugger_loop(0x801639d7 "PANIC: ", 0x8016dec0 "cache destroy: still has partial slabs", 0x8112dd60 "", int32: 0) + 0x21b
 5 8112dcf4 (+  48) 80092d0f   <kernel_x86> kernel_debugger_internal(0x801639d7 "PANIC: ", 0x8016dec0 "cache destroy: still has partial slabs", 0x8112dd60 "", int32: 0) + 0x53
 6 8112dd24 (+  48) 800945ea   <kernel_x86> panic + 0x36
 7 8112dd54 (+  48) 800fe3a1   <kernel_x86> delete_object_cache_internal(ObjectCache*: 0x80e21028) + 0x79
 8 8112dd84 (+  64) 800ff47b   <kernel_x86> delete_object_cache + 0x27f
 9 8112ddc4 (+  64) 800463b7   <kernel_x86> _._11block_cache + 0x43
10 8112de04 (+  48) 80049d0a   <kernel_x86> block_cache_delete + 0x156
11 8112de34 (+  64) 817e143f   <bfs> Volume<0x82dee400>::Unmount(0x1) + 0xeb
12 8112de74 (+  48) 817e285c   <bfs> bfs_unmount(fs_volume*: 0x84272138) + 0x24
13 8112dea4 (+  96) 800e3bb4   <kernel_x86> fs_unmount(0x80f0c838 "/Haiku1", int32: -1, uint32: 0x0 (0), false) + 0x570
14 8112df04 (+  64) 800e5776   <kernel_x86> _user_unmount + 0x7a
15 8112df44 (+ 100) 80123c10   <kernel_x86> handle_syscall + 0xcd
user iframe at 0x8112dfa8 (end = 0x8112e000)
 eax 0x5f          ebx 0x13e9bdc      ecx 0x6190b434  edx 0x62106114
 esi 0x6190b4e4    edi 0x6190b538     ebp 0x6190b460  esp 0x8112dfdc
 eip 0x62106114 eflags 0x3202    user esp 0x6190b434
 vector: 0x63, error code: 0x0
16 8112dfa8 (+   0) 62106114   <commpage> commpage_syscall + 0x04
17 6190b460 (+ 160) 010c56cb   <libbe.so> BPartition<0x6190b538>::Unmount(uint32: 0x0 (0)) + 0x87
18 6190b500 (+  80) 00bd528d   <_APP_> AutoMounter<0x6190baac>::_UnmountAndEjectVolume(BPartition*: 0x6190b538, BPath&: 0x6190b5e4, 0x6190b600 "Haiku") + 0x85
19 6190b550 (+ 496) 00bd5739   <_APP_> AutoMounter<0x6190baac>::_UnmountAndEjectVolume(BMessage*: 0x38a8f00) + 0x251
20 6190b740 (+ 144) 00bd3f2d   <_APP_> AutoMounter<0x6190baac>::MessageReceived(BMessage*: 0x38a8f00) + 0x151
21 6190b7d0 (+  48) 00f7a5b3   <libbe.so> BLooper<0x6190baac>::DispatchMessage(BMessage*: 0x38a8f00, BHandler*: 0x6190baac) + 0x5b
22 6190b800 (+ 496) 00f70fed   <libbe.so> BApplication<0x6190baac>::DispatchMessage(BMessage*: 0x38a8f00, BHandler*: 0x6190baac) + 0x405
23 6190b9f0 (+  64) 00f7bf21   <libbe.so> BLooper<0x6190baac>::task_looper(0x6190baac) + 0x211
24 6190ba30 (+  64) 00f6fa4d   <libbe.so> BApplication<0x6190baac>::Run(0x0) + 0x75
25 6190ba70 (+ 512) 00bd6313   <_APP_> main + 0x2f
26 6190bc70 (+  48) 00bd39cb   <_APP_> _start + 0x5b
27 6190bca0 (+  48) 0088257e   </boot/system/runtime_loader@0x00873000> <unknown> + 0xf57e
28 6190bcd0 (+   0) 62106250   <commpage> commpage_thread_exit + 0x00

[diver]

Still here in hrev47372.

[luroh]

Here in hrev47896, gcc2. I have encountered these continuable KDLs a few times before when unmounting a disk, running Haiku in VirtualBox. From mount to unmount and subsequent kernel panic:

bfs: mounted "Data" (root node at 524288, device = /dev/disk/scsi/0/1/0/raw)
slab memory manager: created area 0xd3801000 (15518)
bfs: bfs_read_link:1531: Invalid Argument
bfs: bfs_read_link:1531: Invalid Argument
slab memory manager: created area 0xd4001000 (17326)
slab memory manager: created area 0xd4801000 (17329)
slab memory manager: created area 0xd5001000 (17335)
slab memory manager: created area 0xd5801000 (17340)
slab memory manager: created area 0xd6001000 (17343)
slab memory manager: created area 0xd6801000 (17348)
slab memory manager: created area 0xd7001000 (17351)
slab memory manager: created area 0xd7801000 (17356)
slab memory manager: created area 0xd8001000 (17361)
slab memory manager: created area 0xd8801000 (17364)
slab memory manager: created area 0xd9001000 (17369)
slab memory manager: created area 0xd9801000 (17377)
slab memory manager: created area 0xda001000 (17381)
slab memory manager: created area 0xda801000 (17386)
slab memory manager: created area 0xdb001000 (17389)
slab memory manager: created area 0xdb801000 (17394)
slab memory manager: created area 0xdc001000 (17397)
slab memory manager: created area 0xdc801000 (17402)
slab memory manager: created area 0xdd001000 (17407)
slab memory manager: created area 0xdd801000 (17412)
slab memory manager: created area 0xde001000 (17415)
slab memory manager: created area 0xdf001000 (17420)
slab memory manager: created area 0xdf801000 (17425)
slab memory manager: created area 0xe0001000 (17428)
slab memory manager: created area 0xe0801000 (17433)
slab memory manager: created area 0xe1001000 (17438)
slab memory manager: created area 0xe1801000 (17441)
bfs: bfs_read_link:1531: Invalid Argument
slab memory manager: created area 0xe2001000 (17472)
bfs: bfs_read_link:1531: Invalid Argument
Last message repeated 4 times.
Last message repeated 2 times.
slab memory manager: created area 0xe2801000 (23676)
slab memory manager: created area 0xe3001000 (23684)
bfs: bfs_read_link:1531: Invalid Argument
slab memory manager: created area 0xe3801000 (23743)
bfs: bfs_read_link:1531: Invalid Argument
PANIC: cache destroy: still has partial slabs
Welcome to Kernel Debugging Land...
Thread 252 "mount_server" running on CPU 0
stack trace for thread 252 "mount_server"
    kernel stack: 0x8149f000 to 0x814a3000
      user stack: 0x72065000 to 0x73065000
frame               caller     <image>:function + offset
 0 814a2c38 (+  32) 8013e20a   <kernel_x86> arch_debug_stack_trace + 0x12
 1 814a2c58 (+  16) 800a03bb   <kernel_x86> stack_trace_trampoline(NULL) + 0x0b
 2 814a2c68 (+  12) 801302a6   <kernel_x86> arch_debug_call_with_fault_handler + 0x1b
 3 814a2c74 (+  48) 800a1e8b   <kernel_x86> debug_call_with_fault_handler + 0x5f
 4 814a2ca4 (+  64) 800a05cf   <kernel_x86> kernel_debugger_loop([34m0x80181797[0m [36m"PANIC: "[0m, [34m0x80195a00[0m [36m"cache destroy: still has partial slabs"[0m, [34m0x814a2d50[0m [36m""[0m, int32: [34m0[0m) + 0x20f
 5 814a2ce4 (+  48) 800a0973   <kernel_x86> kernel_debugger_internal([34m0x80181797[0m [36m"PANIC: "[0m, [34m0x80195a00[0m [36m"cache destroy: still has partial slabs"[0m, [34m0x814a2d50[0m [36m""[0m, int32: [34m0[0m) + 0x77
 6 814a2d14 (+  48) 800a21fe   <kernel_x86> panic + 0x3a
 7 814a2d44 (+  64) 80109986   <kernel_x86> delete_object_cache_internal(ObjectCache*: [34m0xd2227668[0m) + 0x66
 8 814a2d84 (+  64) 8010a98b   <kernel_x86> delete_object_cache + 0x21b
 9 814a2dc4 (+  64) 8004b783   <kernel_x86> _._11block_cache + 0x43
10 814a2e04 (+  48) 8004f5fb   <kernel_x86> block_cache_delete + 0x143
11 814a2e34 (+  64) 8179238f   <bfs> Volume<[32m0x82dfea00[0m>::Unmount([34m0x0[0m) + 0xeb
12 814a2e74 (+  48) 817936b0   <bfs> bfs_unmount(fs_volume*: [34m0xd257d338[0m) + 0x24
13 814a2ea4 (+  96) 800f06b8   <kernel_x86> fs_unmount([34m0xd24df548[0m [36m"/Data"[0m, int32: [34m-1[0m, uint32: [34m0x0[0m ([34m0[0m), [34mfalse[0m) + 0x570
14 814a2f04 (+  64) 800f21a5   <kernel_x86> _user_unmount + 0x79
15 814a2f44 (+ 100) 80132d8f   <kernel_x86> handle_syscall + 0xdc
user iframe at 0x814a2fa8 (end = 0x814a3000)
 eax 0x61          ebx 0x215a8fc      ecx 0x73063fec  edx 0x603ac114
 esi 0x0           edi 0x730640f0     ebp 0x73064018  esp 0x814a2fdc
 eip 0x603ac114 eflags 0x3202    user esp 0x73063fec
 vector: 0x63, error code: 0x0
16 814a2fa8 (+   0) 603ac114   <commpage> commpage_syscall + 0x04
17 73064018 (+ 160) 00c59c7c   <libbe.so> BPartition<[32m0x730640f0[0m>::Unmount(uint32: [34m0x0[0m ([34m0[0m)) + 0x84
18 730640b8 (+  80) 025842a2   <_APP_> AutoMounter<[32m0x73064674[0m>::_UnmountAndEjectVolume(BPartition*: [34m0x730640f0[0m, BPath&: [34m0x7306419c[0m, [34m0x730641b8[0m [36m"Data"[0m) + 0x8a
19 73064108 (+ 496) 02584737   <_APP_> AutoMounter<[32m0x73064674[0m>::_UnmountAndEjectVolume(BMessage*: [34m0x18231ec0[0m) + 0x24b
20 730642f8 (+ 144) 02582f25   <_APP_> AutoMounter<[32m0x73064674[0m>::MessageReceived(BMessage*: [34m0x18231ec0[0m) + 0x14d
21 73064388 (+  48) 00b085bb   <libbe.so> BLooper<[32m0x73064674[0m>::DispatchMessage(BMessage*: [34m0x18231ec0[0m, BHandler*: [34m0x73064674[0m) + 0x5b
22 730643b8 (+ 512) 00aff51d   <libbe.so> BApplication<[32m0x73064674[0m>::DispatchMessage(BMessage*: [34m0x18231ec0[0m, BHandler*: [34m0x73064674[0m) + 0x409
23 730645b8 (+  64) 00b09e2d   <libbe.so> BLooper<[32m0x73064674[0m>::task_looper([34m0x2[0m) + 0x205
24 730645f8 (+  64) 00afdfaa   <libbe.so> BApplication<[32m0x73064674[0m>::Run([34m0x73063228[0m) + 0x6e
25 73064638 (+ 512) 02585303   <_APP_> main + 0x2f
26 73064838 (+  48) 025829cb   <_APP_> _start + 0x5b
27 73064868 (+  64) 01bbd914   </boot/system/runtime_loader@0x01bac000> <unknown> + 0x11914
28 730648a8 (+   0) 603ac250   <commpage> commpage_thread_exit + 0x00

[luroh]

Still here in hrev48620.

[diver]

Still here in hrev49378.

[axeld]

Duplicate of #12847 which contains more useful information on how to possibly reproduce the issue.