UFS Panic on 7.1 -> ffs_valloc: dup alloc

[Tom Judge]

Hi,

I had a panic today when someone created a symlink over NFS to a UFS 
file system.

There seem to be 2 open PRs on this already:

kern/122380
kern/133980

Any ideas on a fix?  I have not tried to repeat this crash but I have 
saved a snapshot of the file system so I can test if needed.  I also 
have the core file preserved.

# uname -a
FreeBSD mongo.XXX 7.1-RELEASE-p4 FreeBSD 7.1-RELEASE-p4 #0 @718:817M: 
Tue Nov 24 02:31:49 UTC 2009 
tj at dev-tj-7-1-amd64.XXX:/usr/obj/usr/src/sys/XXXv5  amd64




# kgdb /boot/kernel/kernel vmcore.0
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:
mode = 0100600, inum = 2355296, fs = /usr/home
panic: ffs_valloc: dup alloc
cpuid = 0
Uptime: 5d13h10m53s
Physical memory: 6122 MB
Dumping 510 MB: 495 479 463 447 431 415 399 383 367 351 335 319 303 287 
271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:195
195	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0x0000000000000004 in ?? ()
#2  0xffffffff8048e079 in boot (howto=260) at 
/usr/src/sys/kern/kern_shutdown.c:418
#3  0xffffffff8048e482 in panic (fmt=0x104 <Address 0x104 out of 
bounds>) at /usr/src/sys/kern/kern_shutdown.c:574
#4  0xffffffff80607752 in ffs_valloc (pvp=Variable "pvp" is not available.
) at /usr/src/sys/ufs/ffs/ffs_alloc.c:968
#5  0xffffffff8063104e in ufs_makeinode (mode=41453, 
dvp=0xffffff001d954dc8, vpp=0xffffffffb48e28a8, cnp=0xffffffffb48e28d0) 
at /usr/src/sys/ufs/ufs/ufs_vnops.c:2254
#6  0xffffffff8063153f in ufs_symlink (ap=0xffffffffb48e29a0) at 
/usr/src/sys/ufs/ufs/ufs_vnops.c:1831
#7  0xffffffff80737fe3 in VOP_SYMLINK_APV (vop=Variable "vop" is not 
available.
) at vnode_if.c:1351
#8  0xffffffff805b8f38 in nfsrv_symlink (nfsd=0xffffff0065996100, 
slp=0xffffff00035e6e00, td=0xffffff00041886e0, mrq=0xffffffffb48e2b00) 
at vnode_if.h:712
#9  0xffffffff805bdddd in nfssvc (td=Variable "td" is not available.
) at /usr/src/sys/nfsserver/nfs_syscalls.c:456
#10 0xffffffff806d7fa7 in syscall (frame=0xffffffffb48e2c80) at 
/usr/src/sys/amd64/amd64/trap.c:907
#11 0xffffffff806be06b in Xfast_syscall () at 
/usr/src/sys/amd64/amd64/exception.S:330
#12 0x0000000800687bfc in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) frame 4
#4  0xffffffff80607752 in ffs_valloc (pvp=Variable "pvp" is not available.
) at /usr/src/sys/ufs/ffs/ffs_alloc.c:968
968			panic("ffs_valloc: dup alloc");
(kgdb) list
963		}
964		ip = VTOI(*vpp);
965		if (ip->i_mode) {
966			printf("mode = 0%o, inum = %lu, fs = %s\n",
967			    ip->i_mode, (u_long)ip->i_number, fs->fs_fsmnt);
968			panic("ffs_valloc: dup alloc");
969		}
970		if (DIP(ip, i_blocks) && (fs->fs_flags & FS_UNCLEAN) == 0) {  /* XXX */
971			printf("free inode %s/%lu had %ld blocks\n",
972			    fs->fs_fsmnt, (u_long)ino, (long)DIP(ip, i_blocks));
(kgdb)