From owner-freebsd-hackers Fri Aug 23 13:20:20 2002 Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id ED09237B400 for ; Fri, 23 Aug 2002 13:20:17 -0700 (PDT) Received: from mail03.svc.cra.dublin.eircom.net (mail03.svc.cra.dublin.eircom.net [159.134.118.19]) by mx1.FreeBSD.org (Postfix) with SMTP id 0E2C043E3B for ; Fri, 23 Aug 2002 13:20:17 -0700 (PDT) (envelope-from pmedwards@eircom.net) Received: (qmail 47223 messnum 524461 invoked from network[159.134.237.90/chester.eircom.net]); 23 Aug 2002 20:20:15 -0000 Received: from chester.eircom.net (HELO webmail.eircom.net) (159.134.237.90) by mail03.svc.cra.dublin.eircom.net (qp 47223) with SMTP; 23 Aug 2002 20:20:15 -0000 From: "Peter Edwards" To: "Peter Edwards" , gallatin@cs.duke.edu Cc: hackers@freebsd.org Subject: Re: Vinum crash Date: Fri, 23 Aug 2002 21:20:02 +0100 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit X-Originating-IP: 212.2.171.128 X-Mailer: Eircom Net CRC Webmail (http://www.eircom.net/) Organization: Eircom Net (http://www.eircom.net/) Message-Id: <20020823202017.0E2C043E3B@mx1.FreeBSD.org> Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG "Peter Edwards" wrote: Urgh. Forget it, I was seeing references to rq that weren't there. > Hi, > > Ok, I'm up to my neck in code I've never seen and making wild > guesses, but: > > In vinumrequest.c:launch_requests(), isn't it possible that the > final BUF_STRATEGY() from line 431 completes before we get back to the top of the outer "for" loop and that complete_rqe gets called for the > last buffer (we don't have splbio()), bringing the refcount of the > entire request down to zero, then freeing the request. You then get to the top of the loop, and rq will have been freed, but you looking at its contents. Ok, maybe not likely but... > > I suppose you could just hold one more reference to the request while doing launch_requests() and check after all theB UF_STRATEGYs are done when you decrement the active count and find it's zero, then do the "request-finished" processing as done by complete_rqe > > Just a thought... > -- > Peter Edwards. > -- Peter Edwards. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message