>Number:         776
>Category:       kern
>Synopsis:       panic: vnode_pager_uncache: vnode not locked
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Feb  2 19:05:03 1995
>Originator:     der Mouse
>Organization:
	As little as I can get away with
>Release:        NetBSD/sparc 1.0 (probably present in -current too)
>Environment:
	SPARC IPC, but it doesn't look as though it matters
>Description:
	Layering nullfs over nfs can provoke this panic, it seems.  The
	check in vnode_pager_uncache in -current looks identical,
	though, so I assume the bug is still there.  If something else
	interacts to prevent it, please feel free to ignore this.
>How-To-Repeat:
	Build a kernel with DEBUG (and NFS support).  Make an NFS mount
	which provides an executable.  Make a nullfs mount (-t null)
	that mounts this NFS mount point somewhere else.  Run the
	executable via the latter mount.  Try to unmount the nullfs
	mount and watch the fireworks.

	This seems to work for me:

	# mkdir /tmp/foo /tmp/bar /tmp/baz
	# cp /bin/date /tmp/foo
	# echo /tmp 127.0.0.1 >> /etc/exports
	# mountd
	# nfsd -tun 4
	# mount -t nfs -o ro,-c,-i localhost:/tmp /tmp/bar
	# mount -t null /tmp/bar/foo /tmp/baz
	# /tmp/baz/date
	(normal date output)
	# umount /tmp/baz
	(boom!)
>Fix:
	Turn DEBUG off and rebuild the kernel, since the relevant check
	is compiled in only when DEBUG is enabled.

	(Yes I'm kidding!)

	Seriously, either vnode locking or the check in
	vnode_pager_uncache needs to be redone.  I don't know which,
	and I don't feel competent to perform the fix in either case.

	Unless, of course, -current doesn't suffer from this, in which
	case please ignore this.

					der Mouse

			    mouse@collatz.mcrcim.mcgill.edu
>Audit-Trail:
>Unformatted: