Bug 27776

Summary: rpc.lockd panic with FreeBSD-5.0
Product: Base System Reporter: Jean-Luc.Richier <Jean-Luc.Richier>
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff
none
patch_nfs_lock.c none

Description Jean-Luc.Richier 2001-05-30 18:50:00 UTC
On a FreeBSD 5-0, source dated may 2001, kernel compiled with witness
option, activating rpc.lockd causes a panic (witness violation on
holding locks when syscall returns)

Fix: The problem is in nfslockdans in nfs/nfs_lock.c
This function call pfind which return a pointer to a locked proc.
But ther is no calls to PROC_UNLOCK done.
A patch is:
p->p_nlminfo->retcode = ansp->la_errno;
        p->p_nlminfo->set_getlk_pid = ansp->la_set_getlk_pid;
--- 261,270 ----
            ((ansp->la_msg_ident.msg_seq != -1) &&
              (timevalcmp(&p->p_nlminfo->pid_start,
                        &ansp->la_msg_ident.pid_start, !=) ||
!              p->p_nlminfo->msg_seq != ansp->la_msg_ident.msg_seq))) {
                return (EPIPE);
+               PROC_UNLOCK(p);
+       }

        p->p_nlminfo->retcode = ansp->la_errno;
        p->p_nlminfo->set_getlk_pid = ansp->la_set_getlk_pid;
***************


(void)wakeup((void *)p->p_nlminfo);

+       PROC_UNLOCK(p);
        return (0);
  }--fm6L0UCm01KQHkwZUwZW5GxJAjRuj31SI225AHpVUClf0ktK
Content-Type: text/plain; name="file.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="file.diff"

*** /usr/src/P50/sys/nfs/nfs_lock.c.DIST        Sat May 26 01:36:46 2001
--- /usr/src/P50/sys/nfs/nfs_lock.c     Wed May 30 11:58:06 2001
***************
*** 128,134 ****
        /*
         * XXX  -- I think this is wrong for anything other AF_INET.
         */
!       msg.lm_addr = *(VFSTONFS(vp->v_mount)->nm_nam);
        msg.lm_fh_len = NFS_ISV3(vp) ? VTONFS(vp)->n_fhsize : NFSX_V2FH;
        bcopy(VTONFS(vp)->n_fhp, msg.lm_fh, msg.lm_fh_len);
        msg.lm_nfsv3 = NFS_ISV3(vp);
--- 128,135 ----
        /*
         * XXX  -- I think this is wrong for anything other AF_INET.
         */
!       bcopy(VFSTONFS(vp->v_mount)->nm_nam, &msg.lm_addr,
!               min(sizeof msg.lm_addr, VFSTONFS(vp->v_mount)->nm_nam->sa_len));        msg.lm_fh_len = NFS_ISV3(vp) ? VTONFS(vp)->n_fhsize : NFSX_V2FH;
        bcopy(VTONFS(vp)->n_fhp, msg.lm_fh, msg.lm_fh_len);
        msg.lm_nfsv3 = NFS_ISV3(vp);
***************
*** 260,267 ****
            ((ansp->la_msg_ident.msg_seq != -1) &&
              (timevalcmp(&p->p_nlminfo->pid_start,
                        &ansp->la_msg_ident.pid_start, !=) ||
!              p->p_nlminfo->msg_seq != ansp->la_msg_ident.msg_seq)))
                return (EPIPE);
How-To-Repeat: make a kernel with WITNESS option, current file nfs/nfs_lock.c
(I checked with files dated 18 may 2001 or 26 may), start rpc.statd and
rpc.lockd, and make some locks on nfs shared files
The system will panic with witness error:
system call nfssvc returning with mutex(s) held
Comment 1 Jean-Luc.Richier 2001-05-30 19:03:00 UTC
About the, proposed patch, I see I made a mistake as my diff contains
a diff which is not for the bug, but for an attempt to prot to IPv6
The correct patch is simpler, cf the attached file




--
Jean-Luc RICHIER (Jean-Luc.Richier@Imag.Fr  richier@imag.fr)
Laboratoire Logiciels, Systemes et Reseaux (LSR-IMAG)
IMAG-CAMPUS, BP 72, F-38402 St Martin d'Heres Cedex
Tel : +33 4 76 82 72 32 Fax : +33 4 76 82 72 87
Comment 2 Jake Burkholder freebsd_committer freebsd_triage 2001-06-01 02:31:07 UTC
State Changed
From-To: open->closed

Committed, thanks!
Comment 3 peter 2001-06-01 17:08:38 UTC
Jean-Luc.Richier@imag.fr wrote:
[...]
>             ((ansp->la_msg_ident.msg_seq != -1) &&
>               (timevalcmp(&p->p_nlminfo->pid_start,
>                         &ansp->la_msg_ident.pid_start, !=) ||
> !              p->p_nlminfo->msg_seq != ansp->la_msg_ident.msg_seq))) {
>                 return (EPIPE);
> +               PROC_UNLOCK(p);
> +       }

I'm not sure that this section is going to work too well...

Cheers,
-Peter
--
Peter Wemm - peter@FreeBSD.org; peter@yahoo-inc.com; peter@netplex.com.au
"All of this is for nothing if we don't go to the stars" - JMS/B5