nfs panic with umount -f

Wed Jun 11 13:30:56 PDT 2003

Hi Ian and others,

umount(8) -f does crash here on several just updated 4.8STABLE
boxes for nfs volumes. Server is an IRIX server. All clients are FreeBSD.

Here is a backtrace:
#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
#1  0xc021f1c0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:316
#2  0xc021f60d in panic (fmt=0xc03bd664 "from debugger")
    at /usr/src/sys/kern/kern_shutdown.c:595
#3  0xc014d0e9 in db_panic (addr=-1070787306, have_addr=0, count=1,
    modif=0xe84b7b7c "") at /usr/src/sys/ddb/db_command.c:435
#4  0xc014d087 in db_command (last_cmdp=0xc042de64, cmd_table=0xc042dca4,
    aux_cmd_tablep=0xc04715d8) at /usr/src/sys/ddb/db_command.c:333
#5  0xc014d14e in db_command_loop () at /usr/src/sys/ddb/db_command.c:457
#6  0xc014f31f in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_trap.c:71
#7  0xc0389ad4 in kdb_trap (type=12, code=0, regs=0xe84b7cd0)
    at /usr/src/sys/i386/i386/db_interface.c:158
#8  0xc039a95c in trap_fatal (frame=0xe84b7cd0, eva=332)
    at /usr/src/sys/i386/i386/trap.c:969
#9  0xc039a61d in trap_pfault (frame=0xe84b7cd0, usermode=0, eva=332)
    at /usr/src/sys/i386/i386/trap.c:867
#10 0xc039a183 in trap (frame={tf_fs = 16, tf_es = 16, tf_ds = 16,
      tf_edi = -397705812, tf_esi = -401115872, tf_ebp = -397705916,
      tf_isp = -397705988, tf_ebx = -1034232512, tf_edx = -398025600,
      tf_ecx = 6, tf_eax = 0, tf_trapno = 12, tf_err = 0,
      tf_eip = -1070787306, tf_cs = 8, tf_eflags = 66194,
      tf_esp = -1034232512, tf_ss = -401115872})
    at /usr/src/sys/i386/i386/trap.c:466
#11 0xc02d1516 in nfs_removerpc (dvp=0xe8469c80,
    name=0xc25add4c ".nfsA01554.4", namelen=12, cred=0xc25c4100, proc=0x0)
    at /usr/src/sys/nfs/nfs_vnops.c:1582
#12 0xc02d14fc in nfs_removeit (sp=0xc25add40)
    at /usr/src/sys/nfs/nfs_vnops.c:1561
#13 0xc02a4793 in nfs_inactive (ap=0xe84b7dac)
    at /usr/src/sys/nfs/nfs_node.c:231
#14 0xc024ec8a in vclean (vp=0xe84671c0, flags=8, p=0xe8177520)
    at vnode_if.h:886
#15 0xc024ee14 in vgonel (vp=0xe84671c0, p=0xe8177520)
    at /usr/src/sys/kern/vfs_subr.c:2049
#16 0xc024eae6 in vflush (mp=0xc23a7400, rootrefs=1, flags=2)
    at /usr/src/sys/kern/vfs_subr.c:1786
#17 0xc02c7b60 in nfs_unmount (mp=0xc23a7400, mntflags=524288, p=0xe8177520)
    at /usr/src/sys/nfs/nfs_vfsops.c:1010
#18 0xc025079a in dounmount (mp=0xc23a7400, flags=524288, p=0xe8177520)
    at /usr/src/sys/kern/vfs_syscalls.c:516
#19 0xc0250692 in unmount (p=0xe8177520, uap=0xe84b7f80)
    at /usr/src/sys/kern/vfs_syscalls.c:470
#20 0xc039abf9 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47,
      tf_edi = 134669512, tf_esi = 134751552, tf_ebp = -1077937216,
      tf_isp = -397705260, tf_ebx = 1, tf_edx = 134701424, tf_ecx = 0,
      tf_eax = 22, tf_trapno = 12, tf_err = 2, tf_eip = 134523456, tf_cs = 31,
    at /usr/src/sys/i386/i386/trap.c:1175
#21 0xc038a9d5 in Xint0x80_syscall ()
#22 0x804849b in ?? ()
#23 0x804813e in ?? ()

(kgdb) list
1577            register caddr_t cp;
1578            register int32_t t1, t2;
1579            caddr_t bpos, dpos, cp2;
1580            int error = 0, wccflag = NFSV3_WCCRATTR;
1581            struct mbuf *mreq, *mrep, *md, *mb, *mb2;
1582            int v3 = NFS_ISV3(dvp);
1583
1584            nfsstats.rpccnt[NFSPROC_REMOVE]++;
1585            nfsm_reqhead(dvp, NFSPROC_REMOVE,
1586                    NFSX_FH(v3) + NFSX_UNSIGNED + nfsm_rndup(namelen));

(kgdb) p *proc
Cannot access memory at address 0x0.

(kgdb) p *dvp
$3 = {v_flag = 0, v_usecount = 9, v_writecount = 0, v_holdcnt = 0,
  v_id = 4278, v_mount = 0x0, v_op = 0xc223e700, v_freelist = {tqe_next = 0x0,
    tqe_prev = 0xe80bc75c}, v_nmntvnodes = {tqe_next = 0xe8468b40,
    tqe_prev = 0xc23a7418}, v_cleanblkhd = {tqh_first = 0x0,
    tqh_last = 0xe8469cac}, v_dirtyblkhd = {tqh_first = 0x0,
    tqh_last = 0xe8469cb4}, v_synclist = {le_next = 0x0, le_prev = 0x0},
  v_numoutput = 0, v_type = VBAD, v_un = {vu_mountedhere = 0x0,
    vu_socket = 0x0, vu_spec = {vu_specinfo = 0x0, vu_specnext = {
        sle_next = 0x0}}, vu_fifoinfo = 0x0}, v_lease = 0x0, v_lastw = 0,
  v_cstart = 0, v_lasta = 0, v_clen = 0, v_object = 0x0, v_interlock = {
    lock_data = 0}, v_vnlock = 0x0, v_tag = VT_NON, v_data = 0x0,
  v_cache_src = {lh_first = 0x0}, v_cache_dst = {tqh_first = 0x0,
    tqh_last = 0xe8469d00}, v_dd = 0xe8469c80, v_ddid = 0, v_pollinfo = {
    vpi_lock = {lock_data = 0}, vpi_selinfo = {si_pid = 0, si_note = {
        slh_first = 0x0}, si_flags = 0}, vpi_events = 0, vpi_revents = 0},
  v_vxproc = 0x0}

(kgdb) p nfsstats.rpccnt
$1 = {0, 1, 69, 2755, 1372, 2, 210, 57, 37, 0, 1, 0, 21, 0, 28, 4, 33, 0, 72,
  1, 0, 38, 0, 0, 0, 0}

(kgdb) p *cred
$10 = {cr_ref = 1, cr_uid = 1001, cr_ngroups = 2, cr_groups = {100, 100,
    0 <repeats 14 times>}, cr_uidinfo = 0xc2411440}

Martin

Martin Blapp, <mb at imp.ch> <mbr at FreeBSD.org>
------------------------------------------------------------------
ImproWare AG, UNIXSP & ISP, Zurlindenstrasse 29, 4133 Pratteln, CH
Phone: +41 61 826 93 00 Fax: +41 61 826 93 01
PGP: <finger -l mbr at freebsd.org>
PGP Fingerprint: B434 53FC C87C FE7B 0A18 B84C 8686 EF22 D300 551E
------------------------------------------------------------------