kern/61122: rpc.lockd coredumps with SIGNAL 11

[fabbri]

The following reply was made to PR kern/61122; it has been noted by GNATS.

From: fabbri <fabbri at isilon.com>
To: freebsd-gnats-submit at FreeBSD.org,
	ohartman at mail.physik.uni-mainz.de
Cc:  
Subject: Re: kern/61122: rpc.lockd coredumps with SIGNAL 11
Date: Fri, 13 Feb 2004 11:26:44 -0800

 I have a patch for at least one cause of this.  
 
 Description:
 
 One of the pair of processes implemening nfs locking was crashing with
 a seg-fault when it handled locks which were contended over a long
 period.
 
 - In the case where it processed the last element in the list,
   retry_blockingfilelocklist() would dereference a null pointer trying
   to LIST_INSERT_BEFORE(null, ..). 
 
 - Rework the list iteration to keep track of the previous element so
   we can correctly do a O(1) reinsertion in a LIST. 
 
 Patch:
 
 
 Index: lockd_lock.c
 ===================================================================
 RCS file: /usr/local/ncvs/atera/src/usr.sbin/rpc.lockd/lockd_lock.c,v
 retrieving revision 1.1.1.1
 diff -u -p -r1.1.1.1 lockd_lock.c
 --- lockd_lock.c	9 Mar 2002 02:35:14 -0000	1.1.1.1
 +++ lockd_lock.c	13 Feb 2004 19:20:12 -0000
 @@ -1226,11 +1226,12 @@ void
  retry_blockingfilelocklist(void)
  {
  	/* Retry all locks in the blocked list */
 -	struct file_lock *ifl, *nfl; /* Iterator */
 +	struct file_lock *ifl, *nfl, *pfl; /* Iterator */
  	enum partialfilelock_status pflstatus;
  
  	debuglog("Entering retry_blockingfilelocklist\n");
  
 +	pfl = NULL;
  	ifl = LIST_FIRST(&blockedlocklist_head);
  	debuglog("Iterator choice %p\n",ifl);
  
 @@ -1260,9 +1261,14 @@ retry_blockingfilelocklist(void)
  		} else {
  			/* Reinsert lock back into same place in blocked list */
  			debuglog("Replacing blocked lock\n");
 -			LIST_INSERT_BEFORE(nfl, ifl, nfslocklist);
 +			if (pfl != NULL) 
 +				LIST_INSERT_AFTER(pfl, ifl, nfslocklist);
 +			else
 +				LIST_INSERT_HEAD(&blockedlocklist_head, ifl, 
 +				    nfslocklist);
  		}
  
 +		pfl = ifl;
  		/* Valid increment behavior regardless of state of ifl */
  		ifl = nfl;
  	}
 -- 
 << Aaron Fabbri  o  Developer, Filesystems Team  o  isilon.com >>