mtx_lock() of destroyed mutex on NFS

[Bjoern A. Zeeb]

On 19. Oct 2011, at 16:00 , Rick Macklem wrote:

> Bjoern A. Zeeb wrote:
>> Hi,
>> 
>> as a result of a make buildkernel && make installkernel && reboot all
>> on NFS I got this with a HEAD SVN source at r226465. I cannot dump
>> unfortunately and it seems I just killed the obj tree for this kernel
>> though it should be very close.
>> 
>> Oct 18 10:03:22 lion3 reboot: rebooted by test
>> Oct 18 10:03:22 panic: mtx_lock() of destroyed mutex @
>> /zoo/bz/HEAD.svn/sys/kern/uipc_socket.c:1022
>> cpuid = 2
>> ...
>> 
> This seems to have been caused by a premature soclose(), which in
> turn implies a premature call to it from clnt_dg_destroy(). The only
> race I can see is that the socket buffer lock is used to protect
> checking for so_upcall being set (which it then uses to decide if
> a new cs_XXX structure is needed), but this lock isn't held when
> it decides to throw it away and close the socket.
> 
> You could try the attached patch, which I've tested minimally.
> (I think it fixes this race.)

Great, will do.  I couldn't reproduce it every time but I have hit
it again the last 24 hours.

Thanks a lot!

/bz

-- 
Bjoern A. Zeeb                                 You have to have visions!
         Stop bit received. Insert coin for new address family.