kern/141086: panic("nfs: bioread, not dir") on FreeBSD 7.2-STABLE

[Weongyo Jeong]

>Number:         141086
>Category:       kern
>Synopsis:       panic("nfs: bioread, not dir") on FreeBSD 7.2-STABLE
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Dec 01 22:10:00 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Weongyo Jeong
>Release:        7.2-STABLE
>Organization:
>Environment:
FreeBSD weongyo 7.2-STABLE FreeBSD 7.2-STABLE #0: Mon Jul 20 12:24:04 PDT 2009     root at me:/usr/obj/usr/src/sys/GENERIC  amd64
>Description:
During using NFS I encountered a panic as follows:

weongyo# kgdb /boot/kernel/kernel /var/crash/vmcore.0
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:
panic: nfs: bioread, not dir
cpuid = 3
Uptime: 12d21h3m33s
Physical memory: 3952 MB
Dumping 1722 MB: 1707

Fatal trap 1: privileged instruction fault while in kernel mode
cpuid = 2; apic id = 02
instruction pointer     = 0x8:0xffffff0004d5e60e
stack pointer           = 0x10:0xffffff80000b7b50
frame pointer           = 0x10:0x0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 29 (irq18: re0 atapci*)
trap number             = 1
 1691 1675 1659 1643 1627 1611 1595 1579 1563 1547 1531 1515 1499 1483 1467 1451
 1435 1419 1403 1387 1371 1355 1339 1323 1307 1291 1275 1259 1243 1227 1211 1195
 1179 1163 1147 1131 1115 1099 1083 1067 1051 1035 1019 1003 987 971 955 939 923
 907 891 875 (CTRL-C to abort)  859 843 (CTRL-C to abort)  827 (CTRL-C to abort)
  811 (CTRL-C to abort)  795 779 763 747 731 715 699 683 667 651 635 (CTRL-C to 
abort)  619 603 587 571 555 539 523 507 491 475 459 (CTRL-C to abort)  443 427 (
CTRL-C to abort)  411 395 379 363 347 331 315 299 283 267 251 235 219 203 187 17
1 155 139 123 107 91 75 59 43 27 11

Reading symbols from /boot/kernel/snd_hda.ko...Reading symbols from /boot/kernel
/snd_hda.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/snd_hda.ko
Reading symbols from /boot/kernel/sound.ko...Reading symbols from /boot/kernel/s
ound.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/sound.ko
Reading symbols from /boot/modules/vboxdrv.ko...done.
Loaded symbols for /boot/modules/vboxdrv.ko
Reading symbols from /boot/modules/vboxnetflt.ko...done.
Loaded symbols for /boot/modules/vboxnetflt.ko
Reading symbols from /boot/kernel/netgraph.ko...Reading symbols from /boot/kerne
l/netgraph.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/netgraph.ko
Reading symbols from /boot/kernel/linprocfs.ko...Reading symbols from /boot/kern
el/linprocfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linprocfs.ko
Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/l
inux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
#0  doadump () at pcpu.h:195
195     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0x0000000000000004 in ?? ()
#2  0xffffffff80519f09 in boot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:418
#3  0xffffffff8051a312 in panic (fmt=0x104 <Address 0x104 out of bounds>)
    at /usr/src/sys/kern/kern_shutdown.c:574
#4  0xffffffff806aa45b in nfs_bioread (vp=0xffffff01117dbdc8, 
    uio=0xffffff8075b38ac0, ioflag=4, cred=0xffffff0004a5d700)
    at /usr/src/sys/nfsclient/nfs_bio.c:399
#5  0xffffffff805a1cf4 in kern_readlink (td=0xffffff002e35aab0, path=Variable "p
ath" is not available.
)
    at vnode_if.h:773
#6  0xffffffff807dab97 in syscall (frame=0xffffff8075b38c80)
    at /usr/src/sys/amd64/amd64/trap.c:899
#7  0xffffffff807c54bb in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:339
#8  0x0000000803a9f3cc in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) f 4
#4  0xffffffff806aa45b in nfs_bioread (vp=0xffffff01117dbdc8, 
    uio=0xffffff8075b38ac0, ioflag=4, cred=0xffffff0004a5d700)
    at /usr/src/sys/nfsclient/nfs_bio.c:399
399                                     panic("nfs: bioread, not dir");
(kgdb) list
394             mtx_lock(&np->n_mtx);
395             if (np->n_flag & NMODIFIED) {
396                     mtx_unlock(&np->n_mtx);
397                     if (vp->v_type != VREG) {
398                             if (vp->v_type != VDIR)
399                                     panic("nfs: bioread, not dir");
400                             (nmp->nm_rpcops->nr_invaldir)(vp);
401                             error = nfs_vinvalbuf(vp, V_SAVE, td, 1);
402                             if (error)
403                                     goto out;
(kgdb) p vp->v_type
$1 = VLNK
(kgdb) p *vp
$3 = {
  v_type = VLNK, 
  v_tag = 0xffffffff808cc78f "nfs", 
  v_op = 0xffffffff80acbcc0, 
  v_data = 0xffffff001750c298, 
  v_mount = 0xffffff0004a4fa80, 
  v_nmntvnodes = {
    tqe_next = 0xffffff01261fd7e0, 
    tqe_prev = 0xffffff01253a0220
  }, 
  v_un = {
    vu_mount = 0x0, 
    vu_socket = 0x0, 
    vu_cdev = 0x0, 
    vu_fifoinfo = 0x0, 
    vu_yield = 0
  }, 
  v_hashlist = {
    le_next = 0xffffff012653dbd0, 
    le_prev = 0xffffff80003a2dc0
  }, 
  v_hash = 567141703, 
  v_cache_src = {
    lh_first = 0x0
  }, 
  v_cache_dst = {
    tqh_first = 0xffffff004ff59618, 
    tqh_last = 0xffffff004ff59638
  }, 
  v_cache_dd = 0x0, 
  v_cstart = 0, 
  v_lasta = 0, 
  v_lastw = 0, 
  v_clen = 0, 
  v_lock = {
    lk_object = {
      lo_name = 0xffffffff808cc78f "nfs", 
      lo_type = 0xffffffff808cc78f "nfs", 
      lo_flags = 70844416, 
      lo_witness_data = {
        lod_list = {
          stqe_next = 0x0
        }, 
        lod_witness = 0x0
      }
    }, 
    lk_interlock = 0xffffffff80b31f60, 
    lk_flags = 262208, 
    lk_sharecount = 0, 
    lk_waitcount = 0, 
    lk_exclusivecount = 1, 
    lk_prio = 80, 
    lk_timo = 51, 
    lk_lockholder = 0xffffff002e35aab0, 
    lk_newlock = 0x0
  }, 
  v_interlock = {
    lock_object = {
      lo_name = 0xffffffff808b783a "vnode interlock", 
      lo_type = 0xffffffff808b783a "vnode interlock", 
      lo_flags = 16973824, 
      lo_witness_data = {
        lod_list = {
          stqe_next = 0x0
        }, 
        lod_witness = 0x0
      }
    }, 
    mtx_lock = 4, 
    mtx_recurse = 0
  }, 
  v_vnlock = 0xffffff01117dbe60, 
  v_holdcnt = 2, 
  v_usecount = 1, 
  v_iflag = 0, 
  v_vflag = 0, 
  v_writecount = 0, 
  v_freelist = {
    tqe_next = 0x0, 
    tqe_prev = 0x0
  }, 
  v_bufobj = {
    bo_mtx = 0xffffff01117dbeb0, 
    bo_clean = {
      bv_hd = {
        tqh_first = 0x0, 
        tqh_last = 0xffffff01117dbf20
      }, 
      bv_root = 0x0, 
      bv_cnt = 0
    }, 
    bo_dirty = {
      bv_hd = {
        tqh_first = 0x0, 
        tqh_last = 0xffffff01117dbf40
      }, 
      bv_root = 0x0, 
      bv_cnt = 0
    }, 
    bo_numoutput = 0, 
    bo_flag = 0, 
    bo_ops = 0xffffffff80acc040, 
    bo_bsize = 32768, 
    bo_object = 0xffffff009f58a360, 
    bo_synclist = {
      le_next = 0x0, 
      le_prev = 0xffffff000497e048
    }, 
    bo_private = 0xffffff01117dbdc8, 
    __bo_vnode = 0xffffff01117dbdc8
  }, 
  v_pollinfo = 0x0, 
  v_label = 0x0, 
  v_lockf = 0x0
}

>How-To-Repeat:
don't know how to repeat this problem that it's my first time to encounter this problem.

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: