9.1-stable crashes while copying data from a NFS mounted directory

[Christian Gusenbauer]

On Thursday 24 January 2013 19:07:23 Konstantin Belousov wrote:
> On Thu, Jan 24, 2013 at 08:03:59PM +0200, Konstantin Belousov wrote:
> > On Thu, Jan 24, 2013 at 06:05:57PM +0100, Christian Gusenbauer wrote:
> > > Hi!
> > > 
> > > I'm using 9.1 stable svn revision 245605 and I get the panic below if I
> > > execute the following commands (as single user):
> > > 
> > > # swapon -a
> > > # dumpon /dev/ada0s3b
> > > # mount -u /
> > > # ifconfig age0 inet 192.168.2.2 mtu 6144 up
> > > # mount -t nfs -o rsize=32768 data:/multimedia /mnt
> > > # cp /mnt/Movies/test/a.m2ts /tmp
> > > 
> > > then the system panics almost immediately. I'll attach the stack trace.
> > > 
> > > Note, that I'm using jumbo frames (6144 byte) on a 1Gbit network, maybe
> > > that's the cause for the panic, because the bcopy (see stack frame
> > > #15) fails.
> > > 
> > > Any clues?
> > 
> > I tried a similar operation with the nfs mount of rsize=32768 and mtu
> > 6144, but the machine runs HEAD and em instead of age. I was unable to
> > reproduce the panic on the copy of the 5GB file from nfs mount.
> > 
> > Show the output of "p *(struct uio *)0xffffff81b2da95a0" in kgdb.

(kgdb) p *(struct uio *)0xffffff81b2da95a0
$1 = {uio_iov = 0xffffff81b2da95d0, uio_iovcnt = 1, uio_offset = 5964, 
uio_resid = 26804, 
  uio_segflg = UIO_SYSSPACE, uio_rw = UIO_READ, uio_td = 0xfffffe0005f28000}

> 
> And the output of "p *(struct buf *)0xffffff816fabca20".

(kgdb) p *(struct buf *)0xffffff816fabca20
$2 = {b_bufobj = 0xfffffe0005ca2120, b_bcount = 32768, b_caller1 = 0x0, 
  b_data = 0xffffff8171418000 "ø\017", b_error = 0, b_iocmd = 1 '\001', 
  b_ioflags = 0 '\0', b_iooffset = 0, b_resid = 0, b_iodone = 0, b_blkno = 0, 
  b_offset = 0, b_bobufs = {tqe_next = 0x0, tqe_prev = 0xfffffe0005ca2140}, 
b_left = 0x0, 
  b_right = 0x0, b_vflags = 0, b_freelist = {tqe_next = 0x0, 
    tqe_prev = 0xffffffff80926900}, b_qindex = 0, b_flags = 536870912, 
  b_xflags = 2 '\002', b_lock = {lock_object = {lo_name = 0xffffffff8061d778 
"bufwait", 
      lo_flags = 91422720, lo_data = 0, lo_witness = 0x0}, 
    lk_lock = 18446741874786074624, lk_exslpfail = 0, lk_timo = 0, lk_pri = 
96}, 
  b_bufsize = 32768, b_runningbufspace = 0, b_kvabase = 0xffffff8171418000 
"ø\017", 
  b_kvasize = 32768, b_lblkno = 0, b_vp = 0xfffffe0005ca2000, b_dirtyoff = 0, 
  b_dirtyend = 0, b_rcred = 0x0, b_wcred = 0x0, b_saveaddr = 
0xffffff8171418000, 
  b_pager = {pg_reqpage = 0}, b_cluster = {cluster_head = {tqh_first = 0x0, 
      tqh_last = 0x0}, cluster_entry = {tqe_next = 0x0, tqe_prev = 0x0}}, 
b_pages = {
    0xfffffe01f1786708, 0xfffffe01f1785880, 0xfffffe01f17858f8, 
0xfffffe01f1785970, 
    0xfffffe01f17859e8, 0xfffffe01f1785a60, 0xfffffe01f1785ad8, 
0xfffffe01f1785b50, 
    0x0 <repeats 24 times>}, b_npages = 8, b_dep = {lh_first = 0x0}, 
b_fsprivate1 = 0x0, 
  b_fsprivate2 = 0x0, b_fsprivate3 = 0x0, b_pin_count = 0}