From owner-freebsd-stable@FreeBSD.ORG Fri Sep 16 08:05:36 2005 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0D7E016A41F for ; Fri, 16 Sep 2005 08:05:36 +0000 (GMT) (envelope-from PeterJeremy@optushome.com.au) Received: from mail03.syd.optusnet.com.au (mail03.syd.optusnet.com.au [211.29.132.184]) by mx1.FreeBSD.org (Postfix) with ESMTP id BDD7643D48 for ; Fri, 16 Sep 2005 08:05:34 +0000 (GMT) (envelope-from PeterJeremy@optushome.com.au) Received: from cirb503493.alcatel.com.au (c220-239-19-236.belrs4.nsw.optusnet.com.au [220.239.19.236]) by mail03.syd.optusnet.com.au (8.12.11/8.12.11) with ESMTP id j8G85H5f021288 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO); Fri, 16 Sep 2005 18:05:19 +1000 Received: from cirb503493.alcatel.com.au (localhost.alcatel.com.au [127.0.0.1]) by cirb503493.alcatel.com.au (8.12.10/8.12.10) with ESMTP id j8G85HSR046667; Fri, 16 Sep 2005 18:05:17 +1000 (EST) (envelope-from pjeremy@cirb503493.alcatel.com.au) Received: (from pjeremy@localhost) by cirb503493.alcatel.com.au (8.12.10/8.12.9/Submit) id j8G85GwV046666; Fri, 16 Sep 2005 18:05:16 +1000 (EST) (envelope-from pjeremy) Date: Fri, 16 Sep 2005 18:05:16 +1000 From: Peter Jeremy To: Damian Gerow Message-ID: <20050916080516.GE40237@cirb503493.alcatel.com.au> References: <20050916012432.GA31590@afflictions.org> <20050916013825.GA93015@xor.obsecurity.org> <20050916035838.GA32336@afflictions.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050916035838.GA32336@afflictions.org> User-Agent: Mutt/1.4.2.1i Cc: freebsd-stable@freebsd.org Subject: Re: NFS directory copies cause crash X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Sep 2005 08:05:36 -0000 On Thu, 2005-Sep-15 23:58:39 -0400, Damian Gerow wrote: >Thus spake Kris Kennaway (kris@obsecurity.org) [15/09/05 21:39]: >: > Is this something known and being worked on, or should I try to gather some >: > debugging information? >: >: The latter..at least a DDB traceback to begin with so we can tell if >: it's a known issue or not. > >This is what I've got: > > Fatal trap 18: integer divide fault while in kernel mode > instruction pointer = 0x8:0xc063c94d ... > #4 0xc06c2722 in trap (frame= > {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = -1048248320, tf_esi = 0, tf_ebp = -738105568, tf_isp = -738105648, tf_ebx = 0, tf_edx = 0, tf_ecx = 0, tf_eax = 183205888, tf_trapno = 18, tf_err = 0, tf_eip = -1067202227, tf_cs = 8, tf_eflags = 66182, tf_esp = 38, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:622 ... > #19 0xc063c94d in ffs_dirpref (pip=0xc1b193d4) at libkern.h:56 > #20 0xc063c42a in ffs_valloc (pvp=0xc1e38d68, mode=16877, cred=0xc1e08d80, vpp=0xd40167a0) at /usr/src/sys/ufs/ffs/ffs_alloc.c:863 Frame #19 is the real problem. This is where inline functions are a real nuisance. libkern.h:56 is min() and there are two invocations of min() from ffs_dirpref() which could potentially have a divide-by-zero. As a first step to tracking down what has gone wrong, within kgdb: print *(struct inode *)0xc1b193d4 print *((struct inode *)0xc1b193d4)->i_fs disas ffs_dirpref The disassembly is about 280 lines and someone will need to map 0xc063c94d to the source line within ffs_dirpref() to locate which divide is failing. -- Peter Jeremy