Re: kern/44206: reproducable (for me) NFS panic

[Reinoud Zandijk <reinoud%NetBSD.org@localhost>]

The following reply was made to PR kern/44206; it has been noted by GNATS.

From: Reinoud Zandijk <reinoud%NetBSD.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/44206: reproducable (for me) NFS panic
Date: Mon, 13 Dec 2010 22:08:50 +0100

 I've got a new trace when running a NetBSD kernel with root on NFS. It seems
 only to be triggered at writing?
 
 Note that it can only trigger on NFSv3
 
 -----
 luiaard# mail
 panic: kernel diagnostic assertion "mb->m_next != NULL" failed: file
 "../../../../nfs/nfs_vnops.c", line 1377
 entering kgdb
 fatal breakpoint trap in supervisor mode
 
 (gdb) where
 #0  0xc0217ef4 in breakpoint ()
 #1  0xc048dc1e in kgdb_connect (verbose=0)
     at ../../../../arch/i386/i386/kgdb_machdep.c:228
 #2  0xc048dc72 in kgdb_panic () at
     ../../../../arch/i386/i386/kgdb_machdep.c:245
 #3  0xc0617048 in panic (
         fmt=0xc0a60574 "kernel %sassertion \"%s\" failed: file \"%s\", line
        %d") at ../../../../kern/subr_prf.c:274
 #4  0xc07672f0 in kern_assert (t=0xc09b793b "diagnostic ", 
         f=0xc0a17161 "../../../../nfs/nfs_vnops.c", l=1377, 
        e=0xc0a17201 "mb->m_next != NULL")
         at ../../../../../../lib/libkern/kern_assert.c:50
 #5  0xc04fe6a0 in nfs_writerpc (vp=0xc719f8f4,
        uiop=0xc6e1acc0, iomode=0xc6e1ace4, 
        pageprotected=true, stalewriteverfp=0xc6e1aceb)
        at ../../../../nfs/nfs_vnops.c:1377
 #6  0xc04e86cd in nfs_doio (bp=0xc0f55e70)
        at ../../../../nfs/nfs_bio.c:1068
 #7  0xc04ee981 in nfssvc_iod (arg=0xc6e23540)
        at ../../../../nfs/nfs_iod.c:158
 #8  0xc0100321 in lwp_trampoline ()
 
 bj = {vmobjlock = {u = {mtxa_owner = 0}}, pgops = 0xc09a4b08, memq = {
   tqh_first = 0xc0e27740, tqh_last = 0xc0e2f554}, uo_npages = 160, uo_refs = 
2, 
   rb_tree = {rbt_root = 0xc0e27620, rbt_ops = 0xc09a4a3c, rbt_minmax =
        {0xc0e27740, 0xc0e2f540}}},
         v_cv = {cv_opaque = {0x0, 0xc719f91c, 0xc0a28ca5}}, 
   v_size = 655360, v_writesize = 655360, v_iflag = 16384,
   v_vflag = 0, v_uflag = 0, 
   v_numoutput = 6, v_writecount = 1, v_holdcnt = 1, v_synclist_slot = 18, 
   v_mount = 0xc6e1f204, v_op = 0xc61ed00c, v_freelist = {tqe_next = 0x0, 
     tqe_prev = 0x0}, v_freelisthd = 0x0, v_mntvnodes = {tqe_next = 0xc719f848, 
     tqe_prev = 0xc719fa14}, v_cleanblkhd = {lh_first = 0x0}, v_dirtyblkhd = {
     lh_first = 0x0}, v_synclist = {tqe_next = 0x0, tqe_prev = 0xc613ed34}, 
   v_dnclist = {lh_first = 0x0}, v_nclist = {lh_first = 0x0}, v_un = {
     vu_mountedhere = 0x0, vu_socket = 0x0, vu_specnode = 0x0,
     vu_fifoinfo = 0x0, 
     vu_ractx = 0x0}, v_type = VREG, v_tag = VT_NFS, v_lock = {rw_owner = 0}, 
   v_data = 0xc719e140, v_klist = {slh_first = 0x0}}
 
 (gdb) print *mb
 Cannot access memory at address 0xffffff84
 (gdb) print ctx.nwc_mbufcount
 $2 = 1
 (???)
 
 (gdb) print *vp
 $4 = {v_obj = {vmobjlock = {u = {mtxa_owner = 0}}, pgops = 0xc09a4b08, memq = {
   tqh_first = 0xc0e27740, tqh_last = 0xc0e2f554}, uo_npages = 160, uo_refs = 
2, 
   rb_tree = {rbt_root = 0xc0e27620, rbt_ops = 0xc09a4a3c, rbt_minmax =
        {0xc0e27740, 0xc0e2f540}}},
         v_cv = {cv_opaque = {0x0, 0xc719f91c, 0xc0a28ca5}}, 
   v_size = 655360, v_writesize = 655360, v_iflag = 16384,
   v_vflag = 0, v_uflag = 0, 
   v_numoutput = 6, v_writecount = 1, v_holdcnt = 1, v_synclist_slot = 18, 
   v_mount = 0xc6e1f204, v_op = 0xc61ed00c, v_freelist = {tqe_next = 0x0, 
     tqe_prev = 0x0}, v_freelisthd = 0x0, v_mntvnodes = {tqe_next = 0xc719f848, 
     tqe_prev = 0xc719fa14}, v_cleanblkhd = {lh_first = 0x0}, v_dirtyblkhd = {
     lh_first = 0x0}, v_synclist = {tqe_next = 0x0, tqe_prev = 0xc613ed34}, 
   v_dnclist = {lh_first = 0x0}, v_nclist = {lh_first = 0x0}, v_un = {
     vu_mountedhere = 0x0, vu_socket = 0x0, vu_specnode = 0x0,
     vu_fifoinfo = 0x0, 
     vu_ractx = 0x0}, v_type = VREG, v_tag = VT_NFS, v_lock = {rw_owner = 0}, 
   v_data = 0xc719e140, v_klist = {slh_first = 0x0}}
 
 ------