Re: kern/42455: tstile hang with nfs

["Christoph Egger" <Christoph_Egger%gmx.de@localhost>]

The following reply was made to PR kern/42455; it has been noted by GNATS.

From: "Christoph Egger" <Christoph_Egger%gmx.de@localhost>
To: gnats-bugs%NetBSD.org@localhost, netbsd-bugs%netbsd.org@localhost, 
gnats-admin%netbsd.org@localhost,
 kern-bug-people%netbsd.org@localhost, rmind%netbsd.org@localhost, 
ad%netbsd.org@localhost, yamt%netbsd.org@localhost,
 enami%netbsd.org@localhost
Cc: 
Subject: Re: kern/42455: tstile hang with nfs
Date: Tue, 26 Oct 2010 11:01:58 +0200

 >  >  
 >  >  I added some more debug lines and figured out that the macro
 >  >  nfsm_wcc_data() drops the mbuf chain w/o decreasing
 >  >  ctxt.nwc_mbufcount.
 >  
 >  The nfsm_wcc_data() macro calls the nfsm_postop_attr() macro.
 >  The nfsm_postop_attr() macro calls nfsm_loadattrcache() function.
 >  The nfsm_loadattrcache() function calls nfsm_disct() function.
 >  
 >  nfsm_disct() is the function in error which drops the mbuf chain.
 >  
 >  nfs_subs.c:968 is the line in error:
 >  
 >             do {
 >                      m2 = m_get(M_WAIT, MT_DATA);
 >                      MCLAIM(m2, m1->m_owner);
 >                      if (left >= MINCLSIZE) {
 >                              MCLGET(m2, M_WAIT);
 >                      }
 >                      m2->m_next = *nextp; <-- BUG happens here!!
 >                      *nextp = m2;
 >                      nextp = &m2->m_next;
 >  
 
 This is the code path from entering nfsm_disct() till when
 the bug happens:
 
 897:    m1 = *mdp;
 903:    while (left == 0) {
 921:    if ((m1->m_flags & M_EXT) != 0) {
 922:            if (havebuf && M_TRAILINGSPACE(havebuf) >= siz &&
 923:                nfsm_aligned(mtod(havebuf, char *) + havebuf->m_len)) {
 959:                    struct mbuf **nextp = &m1->m_next;
 961:                    m1->m_len -= left;
 962:                    do {
 963:                            m2 = m_get(M_WAIT, MT_DATA);
 964:                            MCLAIM(m2, m1->m_owner);
 965:                            if (left >= MINCLSIZE) {
 968:                            m2->m_next = *nextp;
 
 
 Christoph