From owner-freebsd-current  Wed Apr  9 23:22:27 1997
Return-Path: <owner-current>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id XAA18454
          for current-outgoing; Wed, 9 Apr 1997 23:22:27 -0700 (PDT)
Received: from meter.eng.uci.edu (root@meter.eng.uci.edu [128.200.85.3])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id XAA18433;
          Wed, 9 Apr 1997 23:22:21 -0700 (PDT)
Received: from newport.ece.uci.edu by meter.eng.uci.edu (8.8.5) id XAA17951; Wed, 9 Apr 1997 23:22:18 -0700 (PDT)
Received: from localhost by newport.ece.uci.edu (8.8.5) id XAA19967; Wed, 9 Apr 1997 23:22:16 -0700 (PDT)
Message-Id: <199704100622.XAA19967@newport.ece.uci.edu>
To: bugs@freebsd.org
cc: current@freebsd.org
Subject: NFS/mmap freeze in 2.2R
Date: Wed, 09 Apr 1997 23:22:15 -0700
From: Steven Wallace <swallace@ece.uci.edu>
Sender: owner-current@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


I have discovered how to freeze the system over an NFS mounted filesystem.
If you map a file over NFS read/write and shared, write
to the area in memory, and then have another program read that nfs file,
the system will freeze.  The freeze is kindof wierd though.
It appears that the kernel is still running somehow. 
I can change the sysconts vty's but typing and all other processes
are frozen and not running.

The system will get error messages (sometimes) ever 30 seconds when 
it syncs.  They report:

Apr  9 23:05:35 sdw /kernel: vnode_pager_putpages: I/O error 13
Apr  9 23:05:35 sdw /kernel: vnode_pager_putpages: residual I/O 65536 at 496


I have made life easy for you, Mr. VM master, by providing a program
to freeze your system, guaranteed.

Here is the program to freeze your system:


/* Instructions to freeze system:
   cc -O crashme.c -o crashme
   cd /nfs_mounted_dir
   crashme &
   cat nfsfile > /dev/null
   ------------SYSTEM FREEZE-----------------
*/

#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

#include <sys/types.h>
#include <sys/mman.h>
#include <sys/errno.h>

#define RAMSIZE_DEF   0x220000
#define SLEEP 1

static int mapmem(int fd, long start, long size, long offset, int w)
{
  caddr_t  maddr, addr;
  off_t    moffset   = (off_t)offset;
  const    int flags = /* MAP_FIXED |*/ MAP_SHARED;
  const    int prot  = PROT_READ | (w ? PROT_WRITE : 0);


  maddr = (caddr_t)(start);
  addr = (caddr_t)mmap(maddr, (size_t)size, prot, flags, fd, moffset);
  if((int)addr == -1) {
    fprintf(stderr, "mapmem at addr=%6x size=%5x offset=%5x: %s\n",
	    maddr, size, offset, strerror(errno));
  }
  return((int)addr);
}

int
main(int argc, char *argv[])
{
  int fdram;
  int dummy;
  long size = RAMSIZE_DEF;
  char *data;
  char *map;
  
  fdram = open("nfsfile", O_RDWR | O_CREAT, 0666);
  if(fdram < 0) {
    perror("open nfsfile");
    return(fdram);
  }

  if(lseek(fdram, 0, SEEK_END) <= 0) {
    if(lseek(fdram, size - sizeof(dummy), SEEK_SET) < 0)
      perror("lseek ram");
    if(write(fdram, &dummy, sizeof(dummy)) < 0)
      perror("write ram");
  }

  map = (char *)mapmem(fdram, 0, size, 0, 1);
  if((int)map == -1)
    return -1;
  
  data = (char *)malloc(size);
  strcpy(data, "begin of data");
  data[size - 1] = 'Z';

  if(!data) {
    printf("malloc failed\n");
    return -1;
  }

  while(1) {
    sleep(SLEEP);
    memcpy(map, data, size);
    printf("data written to mapped file\n");
  }

}