Date: Mon, 8 Feb 99 22:41:12 +0000 (GMT) From: dwmalone@maths.tcd.ie To: FreeBSD-gnats-submit@FreeBSD.ORG Subject: kern/9970: NFS cross device links cause vrele: negative ref cnt Message-ID: <9902082241.aa09104@walton.maths.tcd.ie>
next in thread | raw e-mail | index | archive | help
>Number: 9970
>Category: kern
>Synopsis: NFS cross device links cause vrele: negative ref cnt
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Feb 8 14:50:00 PST 1999
>Closed-Date:
>Last-Modified:
>Originator: David Malone
>Release: FreeBSD 2.2.7-STABLE i386
>Organization:
School of Mathematics, Trinity College, Dublin.
>Environment:
FreeBSD-3.0 or FreeBSD-4.0.
>Description:
The vrele: negative reference count problem that we have been seeing is
caused by attempting a cross device link to a directory on an nfs
filesystem. The machine may not panic for a while until the last real
reference is gone.
This is quite dramatic as anyone with write access to a nfs filesystem
can kill the machine!
This problem was introduced in version 1.108 of nfs_vnops.c.
In version 1.84 some of the vrele, etc were removed when there
was a change in filesystem behavior. The fact that the man page
for VOP_LINK(9) still says that you should release the directory
obviously doesn't help.
>How-To-Repeat:
cd /tmp
touch hello
ln hello /nfs/filesystem (Repeat until *BOOM*)
>Fix:
The following seems to fix the problem, but the VOP_* man pages
should also be updated by someone who understands the changes
about the time of 1.84.
--- nfs_vnops.c.orig Mon Feb 8 22:09:51 1999
+++ nfs_vnops.c Mon Feb 8 22:11:48 1999
@@ -1686,7 +1686,6 @@
if (vp->v_mount != tdvp->v_mount) {
VOP_ABORTOP(tdvp, cnp);
- vput(tdvp);
return (EXDEV);
}
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?9902082241.aa09104>