kern/38640: NFS corrupts mbufs?

[martin%duskware.de@localhost]

>Number:         38640
>Category:       kern
>Synopsis:       NFS corrupts mbufs?
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon May 12 16:15:00 +0000 2008
>Originator:     Martin Husemann
>Release:        NetBSD 4.99.62
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD nelly.aprisoft.de 4.99.62 NetBSD 4.99.62 (NELLY.MP) #16: Mon May 
12 16:48:46 CEST 2008 
martin%emmas.aprisoft.de@localhost:/nelly/usr/src/sys/arch/sparc64/compile/NELLY.MP
 sparc64
Architecture: sparc64
Machine: sparc64
>Description:

During a make -j 4 in a kernel compile directory on NFS I got this:

panic: kernel diagnostic assertion "MEXT_ISEMBEDDED(m->m_ext_ref)" failed: file 
"../../../../kern/uipc_mbuf.c", line 1535
Stopped in pid 379.1 (as) at    netbsd:cpu_Debugger+0x4:        nop
db{0}> bt                                                          
__kernassert(11d6920, 11ef390, 5ff, 11ef3d0, 656c000000000000, 2e000000000000) a
t netbsd:__kernassert+0x2c                                                     
m_ext_free(3a2ba30, ffffffffffffffff, 0, 1, 0, 1000000) at netbsd:m_ext_free+0x1
30                                                                             
hme_put(800, df11dd2, 3a2b330, 11ec3d8, 0, 0) at netbsd:hme_put+0x74
hme_start(39f00f0, ecd8778, ffffffffffffffff, ecd8772, 8100, 3fff) at netbsd:hme
_start+0xe4                                                                    
ifq_enqueue(39f00f0, 1, 3a2d540, 2, ecd8772, ffff) at netbsd:ifq_enqueue+0xa8
ether_output(0, 3a2d540, 39cf080, 3a13ba0, 40, 1467400) at netbsd:ether_output+0
x2d4                                                                           
ip_output(0, 39f00f0, 3a2d540, 3a45300, 39cf080, 3a2d620) at netbsd:ip_output+0x
e54                                                                            
udp_output(28, 2078, 3a2d540, 3a11ec0, 3c, 2a) at netbsd:udp_output+0x24c
udp_usrreq(0, 9, 3a02800, 0, 0, 10015740) at netbsd:udp_usrreq+0x314     
udp_usrreq_wrapper(3a0fce0, 9, 3a02800, 3a03600, 0, 10015740) at netbsd:udp_usrr
eq_wrapper+0x20                                                                
sosend(0, 1, 0, 0, 0, 0) at netbsd:sosend+0x4bc
nfs_send(3a0fce0, 3a03600, 3a02800, 105635d0, 10015740, 3a17604) at netbsd:nfs_s
end+0x98                                                                       
nfs_request(1001a370, df81840, 2034, 10015740, d04b440, 146bc00) at netbsd:nfs_r
equest+0x2a8                                                                   
nfs_writerpc(0, ecd9208, 0, ecd9020, ecd9010, df81840) at netbsd:nfs_writerpc+0x
nfs_doio_write(3a1b600, 6000, ecd9260, ecd8881, df81918, 1001a370) at netbsd:nfs
_doio_write+0x2ec                                                              
nfs_doio(3a1b600, 0, 0, 10015740, 10015740, 1) at netbsd:nfs_doio+0x190
VOP_STRATEGY(10419840, 3a1b600, ecd9400, ecd9408, ecd941c, ecd9310) at netbsd:VO
P_STRATEGY+0x38                                                                
genfs_do_io(10419840, 6000, ecd9400, 10000, ecd9408, 6000) at netbsd:genfs_do_io
+0x18c                                                                         
genfs_gop_write(10419840, ecd96e8, 10000, 13, 13, 1454800) at netbsd:genfs_gop_w
rite+0x40                                                                      
genfs_do_putpages(10419840, 0, 7fffffffffffe000, 13, 10015740, 1) at netbsd:genf
s_do_putpages+0x5d0                                                            
VOP_PUTPAGES(10419840, 0, 0, 13, de98000, ffffff) at netbsd:VOP_PUTPAGES+0x40
nfs_flush(10419840, d04b440, 1, 10015740, 0, 1) at netbsd:nfs_flush+0x1c     
nfs_close(ecd9a60, 10002, 11d0400, 146f800, 10015740, 1) at netbsd:nfs_close+0xa
c                                                                              
VOP_CLOSE(10419840, 3, d04b440, 10015740, de98000, badcafe) at netbsd:VOP_CLOSE+
0x3c                                                                           
vn_close(10419840, 3, d04b440, 10015740, de98000, badcafe) at netbsd:vn_close+0x
40                                                                             
closef(f2008c0, 4, 10723e40, 0, 40b3c2cc, 800) at netbsd:closef+0x74
fd_close(4, ecd9dc0, ecd9e00, ffffffffffffaf48, 4023e800, ffffffffffffffff) at n
etbsd:fd_close+0x11c                                                           
syscall_plain(ecd9ed0, 1, 40b3ca04, a, 40b3ca04, 800) at netbsd:syscall_plain+0x
11c                                                                            
?(4, 1, ffffffffffffb0d8, 1, 40a8f620, ffffff) at 0x10092fc
db{0}> mach cpu 1                                          
db{1}> bt        
dofileread(16, f200fc0, 40e56000, 4000, 0, 1) at netbsd:dofileread+0x60
sys_read(0, eefddc0, eefde00, ffffffffffff8008, 32, 40e40001) at netbsd:sys_read
+0x60                                                                          
syscall_plain(eefded0, 3, 40b3c5a4, 10, 40b3c5a4, 800) at netbsd:syscall_plain+0
x11c                                                                           


>How-To-Repeat:
heavy, concurrent NFS traffic on a SMP machine?

>Fix:
n/a