Re: kern/42455: tstile hang with nfs

["Christoph Egger" <Christoph_Egger%gmx.de@localhost>]

The following reply was made to PR kern/42455; it has been noted by GNATS.

From: "Christoph Egger" <Christoph_Egger%gmx.de@localhost>
To: gnats-bugs%NetBSD.org@localhost, netbsd-bugs%netbsd.org@localhost, 
gnats-admin%netbsd.org@localhost,
 kern-bug-people%netbsd.org@localhost, rmind%netbsd.org@localhost
Cc: 
Subject: Re: kern/42455: tstile hang with nfs
Date: Mon, 25 Oct 2010 18:39:22 +0200

 >  >  next=0x0 => mb is not a chained mbuf.
 >  >  
 >  >  nwc.mbuf_count is initialized with 1
 >  >  and nwc.mbuf_count is decreased by one right before it enters
 >  >  the while loop with 'cv_wait' so ctxt.nwc_mbuf_count must have
 >  >  been 2 before it entered the loop.
 >  >  
 >  >  There is only one way to increase nwc.mbuf_count: it must run
 >  >  the path where MEXTADD() is used which chains an mbuf to 'mb'.
 >  
 >  I added some more debug lines and figured out that the macro
 >  nfsm_wcc_data() drops the mbuf chain w/o decreasing
 >  ctxt.nwc_mbufcount.
 
 The nfsm_wcc_data() macro calls the nfsm_postop_attr() macro.
 The nfsm_postop_attr() macro calls nfsm_loadattrcache() function.
 The nfsm_loadattrcache() function calls nfsm_disct() function.
 
 nfsm_disct() is the function in error which drops the mbuf chain.
 
 nfs_subs.c:968 is the line in error:
 
            do {
                     m2 = m_get(M_WAIT, MT_DATA);
                     MCLAIM(m2, m1->m_owner);
                     if (left >= MINCLSIZE) {
                             MCLGET(m2, M_WAIT);
                     }
                     m2->m_next = *nextp; <-- BUG happens here!!
                     *nextp = m2;
                     nextp = &m2->m_next;
 
 
 Christoph