From owner-freebsd-fs@FreeBSD.ORG Fri Oct 2 22:23:29 2009 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A73C4106566B; Fri, 2 Oct 2009 22:23:29 +0000 (UTC) (envelope-from gleb.kurtsou@gmail.com) Received: from mail-fx0-f222.google.com (mail-fx0-f222.google.com [209.85.220.222]) by mx1.freebsd.org (Postfix) with ESMTP id D65C38FC17; Fri, 2 Oct 2009 22:23:28 +0000 (UTC) Received: by fxm22 with SMTP id 22so1596087fxm.36 for ; Fri, 02 Oct 2009 15:23:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:references:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=x4kj5pMZQPuXvxrL7R63qHWQ90ECRPaP0WX/RjCexis=; b=D4F5txsikM6YlXDkPejDquH3ydl62wim6Q+r0o+VQ9G3T7g9CLaycrrRYcEfeoM0IE lx3zfdjN7fIjW6OTCEo+IGHWDzogD6yjwB06X4GLfcYEfugBvNXhBA563P2G3NQna7Hu iiFQLLDJrJy97+N2FN9T92aDEYGG9YmED5xj4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; b=Jn68+QGN3Up4lIrWhHN9KI0m4QmunGA6pBNSCH6a+VeNr8ta8F0FTo5HPOP2XzWYO0 o+Or2DNveLIe3z2kTQDVy9F91g/vemWcRlU6fa74REW5ehNtmxg9EDycZ3zgKodxSv7n dBuqYQhy44ZTsi1xYusbdH/sIRLhZ4XgJLHyo= Received: by 10.86.169.25 with SMTP id r25mr2868479fge.17.1254522207831; Fri, 02 Oct 2009 15:23:27 -0700 (PDT) Received: from localhost (lan-78-157-90-54.vln.skynet.lt [78.157.90.54]) by mx.google.com with ESMTPS id d4sm318372fga.2.2009.10.02.15.23.26 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 02 Oct 2009 15:23:27 -0700 (PDT) Date: Sat, 3 Oct 2009 01:23:06 +0300 From: Gleb Kurtsou To: bug-followup@FreeBSD.org, delphij@FreeBSD.org, gprspb@mail.ru Message-ID: <20091002222306.GA1729@tops> References: <200908121810.n7CIA8Qv058688@freefall.freebsd.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="5vNYLRcllDrimb99" Content-Disposition: inline In-Reply-To: <200908121810.n7CIA8Qv058688@freefall.freebsd.org> User-Agent: Mutt/1.5.20 (2009-06-14) Cc: freebsd-fs@FreeBSD.org Subject: Re: kern/122038: [tmpfs] [panic] tmpfs: panic: tmpfs_alloc_vp: type 0xc7d2fab0 0 X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2009 22:23:29 -0000 --5vNYLRcllDrimb99 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Could you test following patch. I think it should fix the issue, but it seems locking for tn_parent field is missing in some places. It needs a closer look and more thorough testing. --5vNYLRcllDrimb99 Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment; filename="tmpfs-rmparent.patch.txt" diff --git a/sys/fs/tmpfs/tmpfs_subr.c b/sys/fs/tmpfs/tmpfs_subr.c index dad634e..2d28058 100644 --- a/sys/fs/tmpfs/tmpfs_subr.c +++ b/sys/fs/tmpfs/tmpfs_subr.c @@ -375,6 +375,7 @@ loop: vp->v_op = &tmpfs_fifoop_entries; break; case VDIR: + MPASS(node->tn_dir.tn_parent != NULL); if (node->tn_dir.tn_parent == node) vp->v_vflag |= VV_ROOT; break; @@ -653,6 +654,9 @@ tmpfs_dir_getdotdotdent(struct tmpfs_node *node, struct uio *uio) TMPFS_VALIDATE_DIR(node); MPASS(uio->uio_offset == TMPFS_DIRCOOKIE_DOTDOT); + if (node->tn_dir.tn_parent == NULL) + return ENOENT; + dent.d_fileno = node->tn_dir.tn_parent->tn_id; dent.d_type = DT_DIR; dent.d_namlen = 2; diff --git a/sys/fs/tmpfs/tmpfs_vnops.c b/sys/fs/tmpfs/tmpfs_vnops.c index db8ceea..7caac14 100644 --- a/sys/fs/tmpfs/tmpfs_vnops.c +++ b/sys/fs/tmpfs/tmpfs_vnops.c @@ -88,6 +88,10 @@ tmpfs_lookup(struct vop_cachedlookup_args *v) if (cnp->cn_flags & ISDOTDOT) { int ltype = 0; + if (dnode->tn_dir.tn_parent == NULL) { + error = ENOENT; + goto out; + } ltype = VOP_ISLOCKED(dvp); vhold(dvp); VOP_UNLOCK(dvp, 0); @@ -98,6 +102,10 @@ tmpfs_lookup(struct vop_cachedlookup_args *v) vn_lock(dvp, ltype | LK_RETRY); vdrop(dvp); } else if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') { + if (dnode->tn_dir.tn_parent == NULL) { + error = ENOENT; + goto out; + } VREF(dvp); *vpp = dvp; error = 0; @@ -959,7 +967,8 @@ tmpfs_rename(struct vop_rename_args *v) * with stale nodes. */ n = tdnode; while (n != n->tn_dir.tn_parent) { - if (n == fnode) { + MPASS(n->tn_dir.tn_parent != NULL); + if (n == fnode || n->tn_dir.tn_parent == NULL) { error = EINVAL; if (newname != NULL) free(newname, M_TMPFSNAME); @@ -1112,6 +1121,7 @@ tmpfs_rmdir(struct vop_rmdir_args *v) node->tn_dir.tn_parent->tn_links--; node->tn_dir.tn_parent->tn_status |= TMPFS_NODE_ACCESSED | \ TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED; + node->tn_dir.tn_parent = NULL; cache_purge(dvp); cache_purge(vp); --5vNYLRcllDrimb99--