Subject: kern/21696: another panic from nfsrv_commit()
To: None <email@example.com>
From: Manuel Bouyer <firstname.lastname@example.org>
Date: 05/27/2003 15:34:29
>Synopsis: another panic from nfsrv_commit()
>Arrival-Date: Tue May 27 13:35:00 UTC 2003
>Originator: Manuel Bouyer
>Release: NetBSD 1.6.1_RC1
System: NetBSD disco 1.6.1_RC1 NetBSD 1.6.1_RC1 (DISCO) #1: Tue May 27 12:57:48 MEST 2003 bouyer@disco:/home/src/sys/arch/alpha/compile/DISCO alpha
[submitted as a PR because I'll be AFK for a few days, and won't
be able to get this reviewed and commied]
Some time ago I fixed a bug in NFS commit: when the size of the
region to be commited was 0, a diagnostic check would be triggered:
login: panic: kernel diagnostic assertion "startoff < endoff || endoff == 0" failed: file "/home/src/sys/arch/alpha/compile/DISCO/../../../../miscfs/genfs/genfs_vnops.c", line 1041
I got this panic again, but this time because the offset is past the
end of file. In the request that triggered this, len was 0.
The NFS specs don't say anything about out of file commit requests.
I choose to start from the beggining of file.
Have a machine sending bogus NFS_COMMIT requests. I don't know what
machine caused this; I have Linux, Solaris and NetBSD clients on the
network. I have quotas enabled on the file server; this may be related
to a file being trucated because of quotas, and not being noticed by
the client. However, this file server has been running for months in
The new thing is that all solaris boxes have been upgraded to solaris9
10 days ago ...
The following patch "normalise" such requests to start from the
beggining of the file. Maybe there is a better way of handling it ...
With this patch the panic stopped.
RCS file: /cvsroot/src/sys/nfs/nfs_serv.c,v
retrieving revision 1.74
diff -u -r1.74 nfs_serv.c
--- nfs_serv.c 2003/05/07 13:10:44 1.74
+++ nfs_serv.c 2003/05/27 13:23:05
@@ -3108,6 +3108,8 @@
for_ret = VOP_GETATTR(vp, &bfor, cred, procp);
+ if (off > vp->v_size)
+ off = 0;
end = (cnt > 0) ? off + cnt : vp->v_size;
if (end < off || end > vp->v_size)
end = vp->v_size;