From owner-freebsd-bugs@FreeBSD.ORG Mon Aug 21 13:00:44 2006 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 27EDD16A4DA for ; Mon, 21 Aug 2006 13:00:44 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id CDBF443D55 for ; Mon, 21 Aug 2006 13:00:43 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k7LD0hOd023282 for ; Mon, 21 Aug 2006 13:00:43 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k7LD0hSm023278; Mon, 21 Aug 2006 13:00:43 GMT (envelope-from gnats) Date: Mon, 21 Aug 2006 13:00:43 GMT Message-Id: <200608211300.k7LD0hSm023278@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Tor Egge Cc: Subject: Re: kern/100365: snapshots on busy filesystem fail X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Tor Egge List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Aug 2006 13:00:44 -0000 The following reply was made to PR kern/100365; it has been noted by GNATS. From: Tor Egge To: sjr@comcast.net Cc: FreeBSD-gnats-submit@freebsd.org Subject: Re: kern/100365: snapshots on busy filesystem fail Date: Mon, 21 Aug 2006 12:57:32 +0000 (UTC) It looks like snapshots don't work well on amd64. Making a snapshot while 'make world' is running in the background and mounting it multiple times shows that it isn't stable: # rm -f /usr/.snap/snapshot # mksnap_ffs /usr /usr/.snap/snapshot # mdconfig -a -t vnode -f /usr/.snap/snapshot -u 0 -o readonly # mount -r /dev/md0 /mnt # ls -lisdtT /mnt/src/make.world 1860701 11792 -rw-r--r-- 1 root bin 12050746 Aug 19 23:21:33 2006 /mnt/src/make.world # umount /mnt # mount -r /dev/md0 /mnt # ls -lisdtT /mnt/src/make.world 1860701 12528 -rw-r--r-- 1 root bin 12801326 Aug 19 23:23:03 2006 /mnt/src/make.world The check at the start of ffs_copyonwrite() for whether the write is to a snapshot file or not is faulty when the write is a metadata update. In that case, the vnode associated with the buffer doesn't have an inode, but instead a devfs_dirent structure. Memory beyond the end of the related devfs_dirent structure is incorrectly interpreted as ufs inode flags for those metadata updates. On RELENG_6/amd64, what is interpreted as i_flags is really the start of the device name in the dirent structure following the devfs_dirent structure, content typically 0x73306164 (da0s), triggering the failure. On HEAD/i386, what is interpreted as i_flags is beyond the end of both the devfs_dirent structure and the following dirent structure, content typically zero, not triggering the failure. - Tor Egge