NFS directory copies cause crash

[Peter Jeremy]

On Thu, 2005-Sep-15 23:58:39 -0400, Damian Gerow wrote:
>Thus spake Kris Kennaway (kris at obsecurity.org) [15/09/05 21:39]:
>: > Is this something known and being worked on, or should I try to gather some
>: > debugging information?
>: 
>: The latter..at least a DDB traceback to begin with so we can tell if
>: it's a known issue or not.
>
>This is what I've got:
>
>    Fatal trap 18: integer divide fault while in kernel mode
>    instruction pointer     = 0x8:0xc063c94d
...
>    #4  0xc06c2722 in trap (frame=
>          {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = -1048248320, tf_esi = 0, tf_ebp = -738105568, tf_isp = -738105648, tf_ebx = 0, tf_edx = 0, tf_ecx = 0, tf_eax = 183205888, tf_trapno = 18, tf_err = 0, tf_eip = -1067202227, tf_cs = 8, tf_eflags = 66182, tf_esp = 38, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:622
...
>    #19 0xc063c94d in ffs_dirpref (pip=0xc1b193d4) at libkern.h:56
>    #20 0xc063c42a in ffs_valloc (pvp=0xc1e38d68, mode=16877, cred=0xc1e08d80, vpp=0xd40167a0) at /usr/src/sys/ufs/ffs/ffs_alloc.c:863

Frame #19 is the real problem.  This is where inline functions are a
real nuisance.  libkern.h:56 is min() and there are two invocations of
min() from ffs_dirpref() which could potentially have a divide-by-zero.

As a first step to tracking down what has gone wrong, within kgdb:
print *(struct inode *)0xc1b193d4
print *((struct inode *)0xc1b193d4)->i_fs
disas ffs_dirpref

The disassembly is about 280 lines and someone will need to map 0xc063c94d
to the source line within ffs_dirpref() to locate which divide is failing.

-- 
Peter Jeremy