kern/46722: rump_nfs dies and crashes the kernel

[cheusov%tut.by@localhost]

>Number:         46722
>Category:       kern
>Synopsis:       rump_nfs dies and crashes the kernel
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 19 11:25:00 +0000 2012
>Originator:     Aleksey Cheusov
>Release:        NetBSD 6.0_BETA2
>Organization:
>Environment:
System: NetBSD work.imb.invention.com 6.0_BETA2 NetBSD 6.0_BETA2 (GENERIC) #11: 
Sat Jun 16 17:12:51 FET 2012 
cheusov%work.imb.invention.com@localhost:/srv/obj-current/sys/arch/i386/compile/GENERIC
 i386
Architecture: i386
Machine: i386
>Description:
I tried to use rump_nfs(8) instead of kernel space implementation
and found it just doesn't work. rump_nfs(8) initially succeeds but quickly
crashes like the following.
-------------------------------------------------
#0  0xbb9fab97 in _lwp_kill () from /usr/lib/libc.so.12
#1  0xbb9fab4f in raise (s=6) at /srv/src_netbsd6/lib/libc/gen/raise.c:48
#2  0xbb9fa433 in abort () at /srv/src_netbsd6/lib/libc/stdlib/abort.c:74
#3  0xbba654e9 in rumpuser_exit (rv=-1)
    at /srv/src_netbsd6/lib/librumpuser/rumpuser.c:541
#4  0xbbafb40f in cpu_reboot (howto=4, bootstr=0x0)
    at /srv/src_netbsd6/lib/librump/../../sys/rump/librump/rumpkern/rump.c:558
#5  0xbbacd3a0 in vpanic (fmt=0xbbb98f0d "no such socket", ap=0xbfbfdd74 "")
    at /srv/src_netbsd6/lib/librump/../../sys/rump/../kern/subr_prf.c:308
#6  0xbbacd3c5 in panic (fmt=0xbbb98f0d "no such socket")
    at /srv/src_netbsd6/lib/librump/../../sys/rump/../kern/subr_prf.c:205
#7  0xbbb983ea in removesock (so=0xb935de44)
    at /srv/src_netbsd6/sys/rump/net/lib/libsockin/sockin.c:158
#8  0xbbb98e65 in sockin_usrreq (so=0xb935de44, req=7, m=0x0, nam=0x0,
control=0x0,
    l=0x0) at /srv/src_netbsd6/sys/rump/net/lib/libsockin/sockin.c:473
#9  0xbbbab2bc in soshutdown (so=0xb935de44, how=2)
    at 
/srv/src_netbsd6/lib/librumpnet/../../sys/rump/../kern/uipc_socket.c:1610
#10 0xbbbdc980 in nfs_disconnect (nmp=0xb9357c40)
    at 
/srv/src_netbsd6/sys/rump/fs/lib/libnfs/../../../../nfs/nfs_socket.c:396
#11 0xbbbdd891 in nfs_reconnect (rep=0xb935c038)
    at 
/srv/src_netbsd6/sys/rump/fs/lib/libnfs/../../../../nfs/nfs_socket.c:362
#12 0xbbbd395f in nfs_receive (l=0xb9350900, mp=0xbfbfe114, aname=0xbfbfe110,
    rep=0xb935c038)
    at 
/srv/src_netbsd6/sys/rump/fs/lib/libnfs/../../../../nfs/nfs_clntsocket.c:157
#13 nfs_reply (lwp=0xb9350900, myrep=0xb935c038)
    at 
/srv/src_netbsd6/sys/rump/fs/lib/libnfs/../../../../nfs/nfs_clntsocket.c:352
#14 nfs_request (np=0xb9358e9c, mrest=0xb9356800, procnum=1, lwp=0xb9350900,
    cred=0xbb7a4c00, mrp=0xbfbfe1e4, mdp=0xbfbfe1e0, dposp=0xbfbfe1e8,
rexmitp=0x0)
    at 
/srv/src_netbsd6/sys/rump/fs/lib/libnfs/../../../../nfs/nfs_clntsocket.c:688
#15 0xbbbc0836 in nfs_getattr (v=0xbfbfe220)
    at /srv/src_netbsd6/sys/rump/fs/lib/libnfs/../../../../nfs/nfs_vnops.c:582
#16 0xbbac2a53 in VOP_GETATTR (vp=0xb9338580, vap=0xb800e080, cred=0xbb7a4c00)
    at /srv/src_netbsd6/lib/librump/../../sys/rump/../kern/vnode_if.c:330
#17 0xbbb46fdb in RUMP_VOP_GETATTR (vp=0xb9338580, vap=0xb800e080,
cred=0xbb7a4c00)
    at 
/srv/src_netbsd6/lib/librumpvfs/../../sys/rump/librump/rumpvfs/rumpvnode_if.c:160
#18 0xbbb93718 in p2k_node_getattr (pu=0xbb70d800, opc=0xb8006040,
vap=0xb800e080,
    pcr=0xb800e02c) at /srv/src_netbsd6/lib/libp2k/p2k.c:911
#19 0xbba52ffc in dispatch (pcc=0xbba5b780)
    at /srv/src_netbsd6/lib/libpuffs/dispatcher.c:458
#20 0xbba5405e in puffs__ml_dispatch (pu=0xbb70d800, pb=0xb8001100)
    at /srv/src_netbsd6/lib/libpuffs/dispatcher.c:64
#21 0xbba52804 in puffs__fsframe_gotframe (pu=0xbb70d800, pb=0xb8001100)
    at /srv/src_netbsd6/lib/libpuffs/requests.c:238
#22 0xbba56815 in puffs__framev_input (pu=0xbb70d800,
fctrl=0xbb70dc84, fio=0xb80040c0)
    at /srv/src_netbsd6/lib/libpuffs/framebuf.c:701
#23 0xbba58b28 in puffs__theloop (pcc=<optimized out>)
    at /srv/src_netbsd6/lib/libpuffs/puffs.c:903
#24 0xbba56ed9 in puffs_cc_continue (pcc=0xbba5b780)
    at /srv/src_netbsd6/lib/libpuffs/callcontext.c:136
#25 0xbba58f3d in puffs_mainloop (pu=0xbb70d800)
    at /srv/src_netbsd6/lib/libpuffs/puffs.c:1021
#26 0xbbb94cad in p2k_mainloop (p2m=0xbb760000) at
/srv/src_netbsd6/lib/libp2k/p2k.c:512
#27 0xbbb94d6e in p2k_run_fs (vfsname=0x804abda "nfs",
    devpath=0xbfbfe9bc "syn-proc7:/shared/syntagma7",
    mountpath=0xbfbfe5bc "/shared/syntagma7", mntflags=0,
arg=0xbfbfe570, alen=72,
    puffs_flags=8) at /srv/src_netbsd6/lib/libp2k/p2k.c:538
#28 0x0804a687 in main (argc=9, argv=0xbfbfee34)
    at /srv/src_netbsd6/usr.sbin/puffs/rump_nfs/rump_nfs.c:56
-------------------------------------------------

Then mount_nfs(8) crashes the kernel

-------------------------------------------------
#0  0xc05ba748 in maybe_dump (howto=260) at
/srv/src_netbsd6/sys/arch/i386/i386/machdep.c:878
878                     dumpsys();
#0  0xc05ba748 in maybe_dump (howto=260) at
/srv/src_netbsd6/sys/arch/i386/i386/machdep.c:878
#1  cpu_reboot (howto=260, bootstr=0x0) at
/srv/src_netbsd6/sys/arch/i386/i386/machdep.c:899
#2  0xc07a4eba in vpanic (fmt=0xc0bf5287 "trap", ap=0xf4245a14
"\264Z$\364\264Z$\364st\213\300\b") at
/srv/src_netbsd6/sys/kern/subr_pr     f.c:308
#3  0xc07a4f5f in panic (fmt=0xc0bf5287 "trap") at
/srv/src_netbsd6/sys/kern/subr_prf.c:205
#4  0xc07f8bd0 in trap (frame=0xf4245ab4) at
/srv/src_netbsd6/sys/arch/i386/i386/trap.c:396
#5  0xc010d08f in ?? ()
#6  0xc0570acf in layerfs_statvfs (mp=0xc3ee1000, sbp=0xc3de9000) at
/srv/src_netbsd6/sys/miscfs/genfs/layer_vfsops.c:160
#7  0xc08b7476 in VFS_STATVFS (mp=0xc3ee1000, a=0xc3de9000) at
/srv/src_netbsd6/sys/kern/vfs_subr.c:1036
#8  0xc08b9828 in dostatvfs (mp=0xc3ee1000, sp=0xc3de9000,
l=0xc3ea92c0, flags=1, root=0) at
/srv/src_netbsd6/sys/kern/vfs_syscalls.c:1     030
#9  0xc08b9b3f in do_sys_getvfsstat (l=0xc3ea92c0, sfsp=0xbb918518,
bufsize=211660, flags=1, copyfn=0xc01008f0, entry_sz=2228, retval=0
 xf4245d1c) at /srv/src_netbsd6/sys/kern/vfs_syscalls.c:1184
#10 0xc08b9cf3 in sys_getvfsstat (l=0xc3ea92c0, uap=0xf4245cf4,
retval=0xf4245d1c) at /srv/src_netbsd6/sys/kern/vfs_syscalls.c:1236
#11 0xc07c072d in sy_call (rval=0xf4245d1c, uap=0xf4245cf4,
l=0xc3ea92c0, sy=0xc0c83810) at
/srv/src_netbsd6/sys/sys/syscallvar.h:61
#12 syscall (frame=0xf4245d48) at
/srv/src_netbsd6/sys/arch/x86/x86/syscall.c:179
-------------------------------------------------

>How-To-Repeat:
See above
>Fix: