Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 28 Oct 2005 10:22:49 -0700 (PDT)
From:      Mohan Srinivasan <mohan_srinivasan@yahoo.com>
To:        Xin LI <delphij@frontfree.net>, freebsd-current@FreeBSD.org
Subject:   Re: [RELENG_6] NFS panic on locking against myself
Message-ID:  <20051028172249.66549.qmail@web31806.mail.mud.yahoo.com>
In-Reply-To: <20051028165314.GA89706@frontfree.net>

next in thread | previous in thread | raw e-mail | index | archive | help
I saw this once too. The following change should fix this.

@@ -965,7 +969,7 @@
 nfsmout:
        if (error) {
                if (newvp != NULLVP) {
-                       vrele(newvp);
+                       vput(newvp);
                        *vpp = NULLVP;
                }
                if ((cnp->cn_nameiop == CREATE || cnp->cn_nameiop == RENAME) &&

Will check it into current soon.

mohan

--- Xin LI <delphij@frontfree.net> wrote:

> Hi,
> 
> On a production CVS server of ours we got panics when there is some wrong
> data was injected to the NFS TCP connection.  This may indicate some error
> in our error handling code of NFS client.
> 
> However, the issue happens only when the gateway between the CVS server and
> the NFS server is heavily loaded, therefore reproducing the issue is somewhat
> hard.  I have enabled DEBUG_VFS_LOCK to see if I can catch something.
> 
> The backtrace goes here:
> 
> GNU gdb 6.1.1 [FreeBSD]
> Copyright 2004 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and you are
> welcome to change it and/or distribute copies of it under certain conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for details.
> This GDB was configured as "i386-marcel-freebsd".
> 
> Unread portion of the kernel message buffer:
> <3>impossible packet length (745074944) from nfs server
> 10.88.15.238:/data0/vhost/wiki/vol/APPLE/matrixdata/docroot
> panic: lockmgr: locking against myself
> KDB: enter: panic
> Dumping 1022 MB (2 chunks)
>   chunk 0: 1MB (159 pages) ... ok
>   chunk 1: 1022MB (261600 pages) 1006 990 974 958 942 926 910 894 878 862 846 830 814 798 782
> 766 750 734 718 702 686 670 654 638 622 606 590 574 558 542 526 510 494 478 462 446 430 414 398
> 382 366 350 334 318 302 286 270 254 238 222 206 190 174 158 142 126 110 94 78 62 46 30 14
> 
> #0  doadump () at pcpu.h:165
> 	in pcpu.h
> (kgdb) bt full
> #0  doadump () at pcpu.h:165
> No locals.
> #1  0xc047f373 in db_fncall (dummy1=-1066385920, dummy2=0, dummy3=-1067193049, 
>     dummy4=0xe775d7a0 "Ì×uç\224ÔcÀ¸×uç¼×uç\220\a") at /usr/src/sys/ddb/db_command.c:492
> 	fn_addr = -1068348316
> 	args = {1, 0, 544593784, -1067199340, -1066463456, -1066463680, 0, -411707512, 2, -1066737952}
> 	nargs = 0
> 	retval = 0
> 	t = 0
> #2  0xc047f178 in db_command (last_cmdp=0xc06dc4c4, cmd_table=0x0, aux_cmd_tablep=0xc06a83f4, 
>     aux_cmd_tablep_end=0xc06a8410) at /usr/src/sys/ddb/db_command.c:350
> 	cmd = (struct command *) 0xc06ae080
> 	t = 0
> 	modif =
>
"Ì×uç\224ÔcÀ¸×uç¼×uç\220\a\000\000\220\a\000\000Ï\a\000\000\000\000\000\000\000>pÀ\r\000\000\000\000>pÀ\000>pÀ\r\000\000\000\001\000\000\000ø×uçOÎcÀø×uçhÎcÀ@\016oÀ`rnÀx\000\000\000ÀÍmÀ\000\000\000\000\030Øuçð\021HÀ\000$iÀà\016HÀ\000\000\000\000ÀÍmÀ\222\006H?
> 	addr = -1066385920
> 	count = -1067193049
> 	have_addr = 0
> 	result = 0
> #3  0xc047f240 in db_command_loop () at /usr/src/sys/ddb/db_command.c:458
> No locals.
> #4  0xc0480e4d in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:221
> 	jb = {{_jb = {-411707304, -411707324, -411707252, -1006365520, 0, -1069019674, -1068274507,
> -1066851157, 
>       -1066845781, -1066851596, -411707248, -1068273655}}}
> 	prev_jb = (void *) 0x0
> 	bkpt = 0
> #5  0xc053e2af in kdb_trap (type=3, code=0, tf=0xe775d8e0) at /usr/src/sys/kern/subr_kdb.c:473
> 	handled = -411707168
> #6  0xc0659578 in trap (frame=
>       {tf_fs = -411762680, tf_es = -1068302296, tf_ds = -1066860504, tf_edi = 1, tf_esi =
> -1066857605, tf_ebp = -411707104, tf_isp = -411707124, tf_ebx = -411707060, tf_edx = 0, tf_ecx =
> -1061072896, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1068244941, tf_cs = 32, tf_eflags
> = 658, tf_esp = -411707072, tf_ss = -1068346465})
>     at /usr/src/sys/i386/i386/trap.c:591
> 	td = (struct thread *) 0xc40414b0
> 	p = (struct proc *) 0xc4044418
> 	sticks = 17104896
> 	i = 0
> 	ucode = 0
> 	type = 3
> 	code = 0
> 	eva = 0
> #7  0xc06498aa in calltrap () at /usr/src/sys/i386/i386/exception.s:139
> No locals.
> #8  0xc053e033 in kdb_enter (msg=0x12 <Address 0x12 out of bounds>) at cpufunc.h:60
> No locals.
> #9  0xc052539f in panic (fmt=0xc0690b7b "lockmgr: locking against myself") at
> /usr/src/sys/kern/kern_shutdown.c:539
> 	td = (struct thread *) 0xc40414b0
> 	bootopt = 256
> 	newpanic = 1
> 	ap = 0xe775d94c "°\024\004?
> 	buf = "lockmgr: locking against myself", '\0' <repeats 224 times>
> #10 0xc0518966 in lockmgr (lkp=0xc2d109e8, flags=8194, interlkp=0x80, td=0xc40414b0) at
> /usr/src/sys/kern/kern_lock.c:330
> 	error = 0
> 	thr = (struct thread *) 0xc40414b0
> 	extflags = 128
> 	lockflags = 18
> #11 0xc0573246 in vop_stdlock (ap=0x0) at /usr/src/sys/kern/vfs_default.c:258
> 	vp = (struct vnode *) 0xc0c15000
> #12 0xc0669583 in VOP_LOCK_APV (vop=0xc06c2c60, a=0xe775d9b0) at vnode_if.c:1642
> 	rc = -1066652576
> #13 0xc0587e78 in vn_lock (vp=0xc2d10990, flags=8194, td=0xc40414b0) at vnode_if.h:844
> 	error = 18
> #14 0xc057be9a in vrele (vp=0xc2d10990) at /usr/src/sys/kern/vfs_subr.c:2050
> 	td = (struct thread *) 0xc40414b0
> #15 0xc05cbe2c in nfs_lookup (ap=0x12) at /usr/src/sys/nfsclient/nfs_vnops.c:893
> 	cnp = (struct componentname *) 0xe775dc90
> 	dvp = (struct vnode *) 0xc43ab110
> 	vpp = (struct vnode **) 0xe775dc7c
> 	flags = 16814096
> 	newvp = (struct vnode *) 0xc2d10990
> 	bpos = 0xc511d150 "h"
> 	dpos = 0xc44e0ab0 ""
> 	mreq = (struct mbuf *) 0xc511d100
> 	mrep = (struct mbuf *) 0x0
> 	md = (struct mbuf *) 0xc44e0a00
> 	mb = (struct mbuf *) 0xc511d100
> 	len = 72
> 	fhp = (nfsfh_t *) 0xc44e0a38
> 	np = (struct nfsnode *) 0xc44ee564
> 	error = 72
> 	attrflag = 0
> 	fhsize = 28
> 	v3 = 512
> 	td = (struct thread *) 0xc40414b0
> #16 0xc06689a7 in VOP_LOOKUP_APV (vop=0xc06c8820, a=0xe775db3c) at vnode_if.c:99
> 	rc = -1066629088
> #17 0xc0575389 in lookup (ndp=0xe775dc68) at vnode_if.h:56
> 	cp = 0xc2a2805b ""
> 	dp = (struct vnode *) 0xc43ab110
> 	tdp = (struct vnode *) 0xc2290bb0
> 	mp = (struct mount *) 0xc2a2805b
> 	docache = 0
> 	wantparent = 16
> 	rdonly = 0
> 	trailing_slash = 0
> 	error = 0
> 	dpunlocked = 0
> 	cnp = (struct componentname *) 0xe775dc90
> 	td = (struct thread *) 0xc40414b0
> 	vfslocked = 1
> 	tvfslocked = 1
> #18 0xc0574cca in namei (ndp=0xe775dc68) at /usr/src/sys/kern/vfs_lookup.c:203
> 	fdp = (struct filedesc *) 0xc2ba2000
> 	cp = 0xc2ba2000 "d ºÂ?ºÂ ÂiÂPe\035ÂPe\035Â\024"
> 	dp = (struct vnode *) 0xc21d6550
> 	aiov = {iov_base = 0xc0582a7b, iov_len = 8194}
> 	auio = {uio_iov = 0xe775dbb4, uio_iovcnt = 128, uio_offset = -4322306996204929024, uio_resid =
> 0, 
>   uio_segflg = 3228314720, uio_rw = 3883260924, uio_td = 0x4}
> 	error = -1038260912
> 	linklen = -1038260912
> 	cnp = (struct componentname *) 0xe775dc90
> 	td = (struct thread *) 0xc40414b0
> 	p = (struct proc *) 0x0
> 	vfslocked = 0
> #19 0xc0583d90 in kern_rename (td=0xc40414b0, from=0x12 <Address 0x12 out of bounds>, 
>     to=0x12 <Address 0x12 out of bounds>, pathseg=UIO_USERSPACE) at
> /usr/src/sys/kern/vfs_syscalls.c:3188
> 	mp = (struct mount *) 0x0
> 	tvp = (struct vnode *) 0x2002
> 	fvp = (struct vnode *) 0x0
> 	tdvp = (struct vnode *) 0x0
> 	fromnd = {ni_dirp = 0x82435dc <Address 0x82435dc out of bounds>, ni_segflg = UIO_USERSPACE,
> ni_startdir = 0x0, 
>   ni_rootdir = 0xc21d6550, ni_topdir = 0xc21d6550, ni_vp = 0x0, ni_dvp = 0xc43ab110, ni_pathlen
> = 1, 
>   ni_next = 0xc2a2805b "", ni_loopcnt = 0, ni_cnd = {cn_nameiop = 2, cn_flags = 16814096,
> cn_thread = 0xc40414b0, 
>     cn_cred = 0xc2757680, cn_lkflags = 2, 
>     cn_pnbuf = 0xc2a28000
> "/usr/local/share/docroot/bkup/cvs/mailtech/FooApp1/myapp10/stuff/nconf/#cvs.cvsup-2172.6595", 
>     cn_nameptr = 0xc2a28047 "#cvs.cvsup-2172.6595", cn_namelen = 20, cn_consume = 0}}
> 	tond = {ni_dirp = 0xc057c1f2 "\203Ä\004d\213\025", ni_segflg = 3268479376, ni_startdir =
> 0xc2d10990, 
>   ni_rootdir = 0xe775dc48, ni_topdir = 0xc057bf36, ni_vp = 0xc2d10990, ni_dvp = 0xc06d7940,
> ni_pathlen = 3268479376, 
>   ni_next = 0x0, ni_loopcnt = 3288601776, ni_cnd = {cn_nameiop = 1, cn_flags = 0, cn_thread =
> 0xe775dcc4, 
>     cn_cred = 0xc0582b05, cn_lkflags = -1026487920, cn_pnbuf = 0xc40414b0 "\030D\004Äà\004N?, 
>     cn_nameptr = 0xc2d10990 "\001", cn_namelen = 493, cn_consume = -411706264}}
> 	tvfslocked = -411706372
> 	fvfslocked = -1067018852
> 	error = -1006353384
> #20 0xc0583d49 in rename (td=0xc40414b0, uap=0x12) at /usr/src/sys/kern/vfs_syscalls.c:3167
> No locals.
> #21 0xc0659dcb in syscall (frame=
>       {tf_fs = 1858994235, tf_es = -1078001605, tf_ds = 136249403, tf_edi = 1859007112, tf_esi =
> -1077940604, tf_ebp = 136256060, tf_isp = -411706012, tf_ebx = 3, tf_edx = 32768, tf_ecx = 0,
> tf_eax = 128, tf_trapno = 22, tf_err = 2, tf_eip = 1859694163, tf_cs = 51, tf_eflags = 530,
> tf_esp = 136255664, tf_ss = 59}) at /usr/src/sys/i386/i386/trap.c:976
> 	params = 0x81f18b4 <Address 0x81f18b4 out of bounds>
> 	callp = (struct sysent *) 0xc06b74c0
> 	td = (struct thread *) 0xc40414b0
> 	p = (struct proc *) 0xc4044418
> 	orig_tf_eflags = 530
> 	sticks = 688
> 	error = 0
> 	narg = 2
> 	args = {136590812, 136590216, 80, 0, 0, 0, 688, -1006353384}
> 	code = 128
> #22 0xc06498ff in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
> No locals.
> #23 0x00000033 in ?? ()
> No symbol table info available.
> (kgdb) 
> 
> Cheers,
> -- 
> Xin LI <delphij frontfree net>	http://www.delphij.net/
> See complete headers for GPG key and other information.
> 
> 




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051028172249.66549.qmail>