Panic in vfs_cache on i386

[Rick Macklem]

On Tue, 14 Apr 2009, Joe Marcus Clarke wrote:

> I'm seeing this panic on my -CURRENT i386 Tinderbox machine (using
> looped back NFS).  The backtrace does not point to a line number in
> vfs_cache.c, and I can't figure out how atomic_cmpset_int is being
> called, so I'm confused as to exactly what is causing this.  Any clues?
>
Only a clue. but I'd guess it's one of the SDT_PROBE()s. I think they
us sx_xlock() and that uses atomic_cmpset_int(). I don't know anything
about SDT_PROBE(), but I did notice that this one uses cn_nameptr, which
I don't think is always null terminated.

You could try commenting out the SDT_PROBE()s in cache_lookup() and see
if it helps? rick

- around line #440 in vfs_cache.c

 	/* We failed to find an entry */
 	if (ncp == NULL) {
--->		SDT_PROBE(vfs, namecache, lookup, miss, dvp, cnp->cn_nameptr,
 		    NULL, 0, 0);
 		if ((cnp->cn_flags & MAKEENTRY) == 0) {
 			nummisszap++;
 		} else {
 			nummiss++;
 		}
 		nchstats.ncs_miss++;
 		goto unlock;
 	}