[nullfs] [panic] null with unref'ed lowervp

[Gleb Kurtsou]

On (23/11/2009 03:04), Martin Schütte wrote:
> Hello,
> my server recently had the kernel panic "null with unref'ed lowervp" in
> null_subr.c:null_checkvp().
> I am not sure whether I should open a PR for it.
> 
> The system is a SMP machine with SCSI RAID (asr), it runs several jails
> and uses multiple null mounts between partitions, because there is not
> enough disk space (~90% usage).
> 
> uname -a:
> FreeBSD trinity.asta.uni-potsdam.de 7.2-RELEASE
> FreeBSD 7.2-RELEASE #3: Tue May 12 18:53:06 CEST 2009
> root at trinity.asta.uni-potsdam.de:/usr/obj/usr/src/sys/ASTA  i386
> 
> Kernel is compiled with:
> options INVARIANT_SUPPORT
> options INVARIANTS
> options DIAGNOSTIC
In my understanding null_checkvp assumptions doesn't hold in null_lock
and null_unlock. So I'd suggest you running without DIAGNOSTIC or try
attached patch instead.

> Among the few occurances I was not able to observe a pattern or
> reproduce the error (two crashes happened at 8am which is a cronjob
> time, but not one with particulary high load).
> I am also going to add new disks any time now in order to reduce the
> number of null mounts, so I do not expect to see this error again.
> 
> I append three gdb backtraces, in case anyone finds them useful.
> 
> -- 
> Martin Schütte

-------------- next part --------------
diff --git a/sys/fs/nullfs/null_vnops.c b/sys/fs/nullfs/null_vnops.c
index a028b63..4c0679f 100644
--- a/sys/fs/nullfs/null_vnops.c
+++ b/sys/fs/nullfs/null_vnops.c
@@ -553,7 +553,7 @@ null_lock(struct vop_lock1_args *ap)
 	 * lock as ffs has special lock considerations in it's
 	 * vop lock.
 	 */
-	if (nn != NULL && (lvp = NULLVPTOLOWERVP(vp)) != NULL) {
+	if (nn != NULL && (lvp = nn->null_lowervp) != NULL) {
 		VI_LOCK_FLAGS(lvp, MTX_DUPOK);
 		VI_UNLOCK(vp);
 		/*
@@ -622,7 +622,7 @@ null_unlock(struct vop_unlock_args *ap)
 		mtxlkflag = 2;
 	}
 	nn = VTONULL(vp);
-	if (nn != NULL && (lvp = NULLVPTOLOWERVP(vp)) != NULL) {
+	if (nn != NULL && (lvp = nn->null_lowervp) != NULL) {
 		VI_LOCK_FLAGS(lvp, MTX_DUPOK);
 		flags |= LK_INTERLOCK;
 		vholdl(lvp);