From owner-freebsd-bugs  Wed Jun  7 01:36:15 1995
Return-Path: bugs-owner
Received: (from majordom@localhost)
          by freefall.cdrom.com (8.6.10/8.6.6) id BAA08612
          for bugs-outgoing; Wed, 7 Jun 1995 01:36:15 -0700
Received: from utogw.gssm.otsuka.tsukuba.ac.jp (utogw.gssm.otsuka.tsukuba.ac.jp [192.50.17.2])
          by freefall.cdrom.com (8.6.10/8.6.6) with ESMTP id BAA08602
          for <freebsd-bugs@freebsd.org>; Wed, 7 Jun 1995 01:36:08 -0700
From: ohki@gssm.otsuka.tsukuba.ac.jp
Received: from smri01.gssm.otsuka.tsukuba.ac.jp (smri01 [192.50.17.160]) by utogw.gssm.otsuka.tsukuba.ac.jp (8.6.11/8.6.9) with ESMTP id RAA00420; Wed, 7 Jun 1995 17:34:59 +0900
Received: from localhost by smri01.gssm.otsuka.tsukuba.ac.jp (8.6.11/SMI-4.1)
	id RAA01294; Wed, 7 Jun 1995 17:34:52 +0900
Message-Id: <199506070834.RAA01294@smri01.gssm.otsuka.tsukuba.ac.jp>
To: freebsd-bugs@FreeBSD.org
Subject: Re: 2.0.5-ALPHA crashes with 'panic: vm_object_deallocate: ...' 
Cc: ohki@gssm.otsuka.tsukuba.ac.jp
In-reply-to: Your message of "Wed, 07 Jun 1995 13:14:45 JST"
References: <199506070414.NAA00442@smri01.gssm.otsuka.tsukuba.ac.jp> 
Mime-Version: 1.0
Content-Type: text/plain;charset="US-ASCII"
Date: Wed, 07 Jun 1995 17:34:51 +0900
Sender: bugs-owner@FreeBSD.org
Precedence: bulk

I (ohki) writes:
> Dear folks
> 
>  I'm using 2.0.5-ALPHA on the following system.
>	....
>  This machine tends to crash once a day or once an hour,
>  so, I configured to make crash dump.

 I pinpointed the situation more precisely.

 A panic of "vm_object_deallocated: .. " can be reproduced
 in the following context.

 NFS server machine:	2.0.5-ALPHA, exporting /var/mail
 NFS client machine:	Solaris 2.3, importing /var/mail

 When a user on NFS client machine invokes /usr/ucb/mail command,
 NFS server machine crashes with "vm_object_deallocated: .. " panic.

 Here is my question:

	nfsrv_link() in nfs_serv.c, vp->v_vmdata is 
	deallocated by calling vm_object_deallocate().
	Afther this, a call to nfsrv_vrele(vp) will also
	deallocate vp->v_vmdata.
	nfsrv_vrele() does not check the ref_count.
	Is this behavior of nfsrv_vrele() correct?
	I guess  nfsrv_vrele() should check ref_count.