Bug 214344 - null pointer dereference: renameat() -> tmpfs_rename() -> turnstile_broadcast
Summary: null pointer dereference: renameat() -> tmpfs_rename() -> turnstile_broadcast
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Mateusz Guzik
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-11-09 06:45 UTC by Peter Wemm
Modified: 2020-07-10 05:08 UTC (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Wemm freebsd_committer freebsd_triage 2016-11-09 06:45:51 UTC
From the console log:

fault virtual address   = 0x20^M
fault code              = supervisor read data, page not present^M
...
[ thread pid 15852 tid 101888 ]^M
Stopped at      turnstile_broadcast+0x9c:       movq    0x20(%rbx,%rax,1),%rcx^M
db> where^M
Tracing pid 15852 tid 101888 td 0xfffff801418fc000^M
turnstile_broadcast() at turnstile_broadcast+0x9c/frame 0xfffffe1835ad14a0^M
__mtx_unlock_sleep() at __mtx_unlock_sleep+0x60/frame 0xfffffe1835ad14d0^M
cache_zap_locked_vnode_kl2() at cache_zap_locked_vnode_kl2+0x387/frame 0xfffffe1835ad1530^M
cache_purge() at cache_purge+0x176/frame 0xfffffe1835ad15a0^M
tmpfs_rename() at tmpfs_rename+0xeff/frame 0xfffffe1835ad1690^M
VOP_RENAME_APV() at VOP_RENAME_APV+0x97/frame 0xfffffe1835ad16c0^M
kern_renameat() at kern_renameat+0x4a8/frame 0xfffffe1835ad1920^M
amd64_syscall() at amd64_syscall+0x51e/frame 0xfffffe1835ad1ab0^M
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe1835ad1ab0^M
--- syscall (501, FreeBSD ELF64, sys_renameat), rip = 0x6fc42a, rsp = 0x7fffffffbd98, rbp = 0x7fffffffc740 ---^M
...
Locked vnodes^M
vnode 0xfffff80b9f074938: tag tmpfs, type VREG^M
    usecount 1, writecount 0, refcount 1 mountedhere 0^M
    flags (VI_ACTIVE)^M
    v_object 0xfffff812c9dc0a50 ref 1 pages 10 cleanbuf 0 dirtybuf 0^M
    lock type tmpfs: EXCL by thread 0xfffff801323ba500 (pid 94836, pkg-static, tid 101212)^M
tag VT_TMPFS, tmpfs_node 0xfffff8152c481570, flags 0x0, links 1^M
        mode 0600, owner 0, group 0, size 40960, status 0x2^M
^M
vnode 0xfffff80bc52d83b0: tag tmpfs, type VDIR^M
    usecount 4, writecount 0, refcount 6 mountedhere 0^M
    flags (VI_ACTIVE)^M
    lock type tmpfs: EXCL by thread 0xfffff801418fc000 (pid 15852, pkg-static, tid 101888)^M
tag VT_TMPFS, tmpfs_node 0xfffff814ef18e658, flags 0x0, links 2^M
        mode 0755, owner 0, group 0, size 2048, status 0x0^M
^M

I do have an alltrace but do not have a savecore.
Comment 1 Peter Wemm freebsd_committer freebsd_triage 2016-11-09 06:47:05 UTC
Kernel revision: 12.0-CURRENT #0 r308208: Wed Nov  2 09:55:11 UTC 2016
Load is a ports exp run.
Comment 2 Conrad Meyer freebsd_committer 2017-01-13 05:44:10 UTC
(There have been several changes in namecache since this bug was filed, including a bugfix: r308665.  The stack didn't look completely identical to Don Lewis', though, so I am leaving it open.)
Comment 3 Mateusz Guzik freebsd_committer 2020-07-10 05:08:46 UTC
This most likely got fixed, nothing reproduces the problem to the best of my knowledge and there are no more reports.