kern/55735: union fs on top of nfs causes kernel panic

[bernd.sieker%posteo.net@localhost]

>Number:         55735
>Category:       kern
>Synopsis:       union fs on top of nfs causes kernel panic
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Oct 19 13:00:01 +0000 2020
>Originator:     bernd.sieker%posteo.net@localhost
>Release:        NetBSD 9.1
>Organization:
	
>Environment:
System: NetBSD bor.bersie.loc 9.1 NetBSD 9.1 (BOR) #8: Fri Oct 16 18:32:47 CEST 2020 bernd%bor.bersie.loc@localhost:/usr/src/sys/arch/amd64/compile/BOR amd64
Architecture: x86_64
Machine: amd64
>Description:
A custom-built 9.1 kernel, including zfs (module), union and nfs file systems occasionally panics when a union filesystem is mounted on top of an nfs-mounted filesystem.

The machine is a PowerEdge T110 server with a 4-core Intel Xeon X3430 at 2.4 GHz, with 4 GB ECC RAM.

It also uses zfs, so I cannot rule that out as a contributing factor, but crashes have only happened (4 times so far within a few days) when the union filesystem was mounted, and shows union- and nfs-related syscalls.

Here is an excerpt from fstab:

  niob:/usr/source               /usr/source             nfs     rw
  /usr/source/pkgsrc             /usr/pkgsrc             union   rw,-b

The zfs module is loaded from /etc/modules.conf along with the solaris module, and one raidz1 zpool is created on three disks.

A typical traceback from the crashdump follows:

[ 13176.105223] uvm_fault(0xffffa01f0e5faa10, 0x0, 1) -> e
[ 13176.105223] fatal page fault in supervisor mode
[ 13176.105223] trap type 6 code 0 rip 0xffffffff8055e9da cs 0x8 rflags 0x10246 cr2 0x56 ilevel 0 rsp 0xffffa300684aa670
[ 13176.105223] curlwp 0xffffa01ff342c2c0 pid 1180.1 lowest kstack 0xffffa300684a82c0
[ 13176.105223] panic: trap
[ 13176.105223] cpu1: Begin traceback...
[ 13176.105223] vpanic() at netbsd:vpanic+0x143
[ 13176.105223] snprintf() at netbsd:snprintf
[ 13176.105223] startlwp() at netbsd:startlwp
[ 13176.105223] alltraps() at netbsd:alltraps+0xbb
[ 13176.105223] nfs_request() at netbsd:nfs_request+0x18d
[ 13176.115228] nfs_getattr() at netbsd:nfs_getattr+0x16e
[ 13176.115228] VOP_GETATTR() at netbsd:VOP_GETATTR+0x53
[ 13176.115228] union_loadvnode() at netbsd:union_loadvnode+0x161
[ 13176.115228] vcache_get() at netbsd:vcache_get+0x1d6
[ 13176.115228] union_allocvp() at netbsd:union_allocvp+0x218
[ 13176.115228] union_root() at netbsd:union_root+0x52
[ 13176.115228] VFS_ROOT() at netbsd:VFS_ROOT+0x1c
[ 13176.115228] lookup_once() at netbsd:lookup_once+0x262
[ 13176.115228] namei_tryemulroot() at netbsd:namei_tryemulroot+0x32e
[ 13176.115228] namei() at netbsd:namei+0x41
[ 13176.125231] fd_nameiat.isra.2() at netbsd:fd_nameiat.isra.2+0x54
[ 13176.125231] do_sys_statat() at netbsd:do_sys_statat+0x77
[ 13176.125231] sys___stat50() at netbsd:sys___stat50+0x28
[ 13176.125231] syscall() at netbsd:syscall+0x13f
[ 13176.125231] --- syscall (number 439) ---
[ 13176.125231] 70bdb056231a:
[ 13176.125231] cpu1: End traceback...


>How-To-Repeat:
Use a union-mount on an nfs-mounted filesystem and use it. Sometimes it will panic, but the exact circumstances are not known. In some cases it happened when calling "df -h", but not always.
>Fix:
Unknown