From owner-freebsd-current@FreeBSD.ORG  Tue Feb  3 03:06:20 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 63E4716A4CE
	for <freebsd-current@FreeBSD.org>;
	Tue,  3 Feb 2004 03:06:20 -0800 (PST)
Received: from gw.catspoiler.org (217-ip-163.nccn.net [209.79.217.163])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3377A43D2D
	for <freebsd-current@FreeBSD.org>;
	Tue,  3 Feb 2004 03:06:19 -0800 (PST)
	(envelope-from truckman@FreeBSD.org)
Received: from FreeBSD.org (mousie.catspoiler.org [192.168.101.2])
	by gw.catspoiler.org (8.12.9p2/8.12.9) with ESMTP id i13B6A7E002768;
	Tue, 3 Feb 2004 03:06:13 -0800 (PST)
	(envelope-from truckman@FreeBSD.org)
Message-Id: <200402031106.i13B6A7E002768@gw.catspoiler.org>
Date: Tue, 3 Feb 2004 03:06:09 -0800 (PST)
From: Don Lewis <truckman@FreeBSD.org>
To: frode@nordahl.net
In-Reply-To: <E0D094EB-562D-11D8-95DC-000A95A9A574@nordahl.net>
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
cc: bsder@allcaps.org
cc: freebsd-current@FreeBSD.org
Subject: Re: rpc.lockd(8) seg faults on 5.2-RELEASE
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Feb 2004 11:06:20 -0000

On  3 Feb, Frode Nordahl wrote:
> Hello,
> 
> Got a better backtrace now:
> (gdb) bt
> #0  0x280b51bc in bcmp () from /lib/libc.so.5
> #1  0x08073080 in ?? ()
> #2  0x0804ed3b in unlock_nfslock (fl=0xbfbfe0a0, 
> released_lock=0xbfbfe04c,
>      left_lock=0xbfbfe054, right_lock=0xbfbfe050) at lockd_lock.c:976
> #3  0x0804f778 in unlock_partialfilelock (fl=0xbfbfe0a0) at 
> lockd_lock.c:1477
> #4  0x0804fd6d in do_unlock (fl=0xbfbfe0a0) at lockd_lock.c:1788
> #5  0x08050181 in unlock (lock=0xbfbfe568, flags=2) at lockd_lock.c:1967
> #6  0x0804d338 in nlm4_unlock_4_svc (arg=0xbfbfe560, rqstp=0xbfbfeab0)
>      at lock_proc.c:1120
> #7  0x0804b449 in nlm_prog_4 (rqstp=0xbfbfeab0, transp=0x8073080)
>      at nlm_prot_svc.c:436
> #8  0x280f67d8 in svc_getreq_common () from /lib/libc.so.5
> #9  0x280f65af in svc_getreqset () from /lib/libc.so.5
> #10 0x280b5ea4 in svc_run () from /lib/libc.so.5
> #11 0x0804b97c in main (argc=1, argv=0xbfbfed10) at lockd.c:212
> #12 0x08049962 in _start ()
> (gdb) frame 2
> #2  0x0804ed3b in unlock_nfslock (fl=0xbfbfe0a0, 
> released_lock=0xbfbfe04c,
>      left_lock=0xbfbfe054, right_lock=0xbfbfe050) at lockd_lock.c:976
> 976             mfl = get_lock_matching_unlock(fl);
> (gdb)
> 
> bcmp call in get_lock_matching_unlock():
>                  if (bcmp(&fl->filehandle, &ifl->filehandle, 
> sizeof(fhandle_t)))
>                          continue;
> 
> Since it dies on bcmp, it seems like a null lock gets into the list for 
> some reason.

Probably not a NULL pointer because &ifl->filehandle will be the same
value as (char *)ifl+offsetof(struct file_lock, filehandle), and
LIST_FOREACH() will bail out when ifl is NULL.  It would be interesting
to walk the lock list starting at nfslocklist_head and following the
nfslocklist links so see if any of the link values look bogus.