NetBSD Problem Report #44657

From campbell@mumble.net  Tue Mar  1 15:17:21 2011
Return-Path: <campbell@mumble.net>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 2E8C563B8EB
	for <gnats-bugs@gnats.NetBSD.org>; Tue,  1 Mar 2011 15:17:21 +0000 (UTC)
Message-Id: <20110301151719.9970098298@pluto.mumble.net>
Date: Tue,  1 Mar 2011 15:17:19 +0000 (UTC)
From: Taylor R Campbell <campbell+netbsd@mumble.net>
Reply-To: Taylor R Campbell <campbell+netbsd@mumble.net>
To: gnats-bugs@gnats.NetBSD.org
Subject: rmdir of cwd in tmpfs causes kassert in lookup
X-Send-Pr-Version: 3.95

>Number:         44657
>Category:       kern
>Synopsis:       rmdir of cwd in tmpfs causes kassert in lookup
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    rmind
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Mar 01 15:20:00 +0000 2011
>Closed-Date:    Sun May 29 22:44:05 +0000 2011
>Last-Modified:  Sun May 29 22:44:05 +0000 2011
>Originator:     Taylor R Campbell <campbell+netbsd@mumble.net>
>Release:        NetBSD 5.99.47
>Organization:
>Environment:
System: NetBSD oberon.local 5.99.47 NetBSD 5.99.47 (RIAMONODEBUG) #31: Mon Feb 28 05:14:15 UTC 2011 riastradh@smalltalk.local:/home/riastradh/netbsd/current/obj/sys/arch/i386/compile/RIAMONODEBUG i386
Architecture: i386
Machine: i386
>Description:

	If my cwd is in a tmpfs, and I rmdir the cwd, then `cd ..'
	triggers the KASSERT(0) in tmpfs_alloc_vp.

>How-To-Repeat:

	% rump_tmpfs -s10m ~/tmp
	% cd ~/tmp
	% mkdir -p lose/foo
	% cd lose/foo
	% rm -r ~/tmp/lose
	% cd ..
	panic: kernel diagnostic assertion "0" failed: file "/home/riastradh/netbsd/current/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c", line 404
	rump kernel halting...
	halted
	cd: device not configured: ..

>Fix:

	Not sure yet.

>Release-Note:

>Audit-Trail:
From: "Antti Kantee" <pooka@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44657 CVS commit: src/tests/fs/vfs
Date: Tue, 1 Mar 2011 15:33:36 +0000

 Module Name:	src
 Committed By:	pooka
 Date:		Tue Mar  1 15:33:35 UTC 2011

 Modified Files:
 	src/tests/fs/vfs: t_vnops.c

 Log Message:
 xfail dir_rmdirdotdot for tmpfs (PR kern/44657)


 To generate a diff of this commit:
 cvs rdiff -u -r1.18 -r1.19 src/tests/fs/vfs/t_vnops.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Nicolas Joly <njoly@pasteur.fr>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/44657: rmdir of cwd in tmpfs causes kassert in lookup
Date: Thu, 7 Apr 2011 23:53:29 +0200

 On Tue, Mar 01, 2011 at 03:20:00PM +0000, Taylor R Campbell wrote:
 > >Number:         44657
 > >Category:       kern
 > >Synopsis:       rmdir of cwd in tmpfs causes kassert in lookup
 [...]
 > 	If my cwd is in a tmpfs, and I rmdir the cwd, then `cd ..'
 > 	triggers the KASSERT(0) in tmpfs_alloc_vp.

 The corresponding test fails differently with rump compiled with
 RUMP_LOCKDEBUG=yes.

 njoly@petaure [/tmp]> /usr/tests/fs/vfs/t_vnops tmpfs_dir_rmdirdotdot
 expected_signal: PR kern/44657
 panic: lockdebug_lookup: uninitialized lock (lock=0x7f7ff730de68, from=7f7ff5809b44)
 rump kernel halting...
 halted
 zsh: abort (core dumped)  /usr/tests/fs/vfs/t_vnops tmpfs_dir_rmdirdotdot

 (gdb) l *(0x7f7ff5809b44)
 0x7f7ff5809b44 is in tmpfs_alloc_vp (/local/src/NetBSD/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c:353).
 348             struct vnode *vp;
 349
 350             /* If there is already a vnode, then lock it. */
 351             for (;;) {
 352                     mutex_enter(&node->tn_vlock);
 353                     if ((vp = node->tn_vnode) != NULL) {
 354                             mutex_enter(&vp->v_interlock);
 355                             mutex_exit(&node->tn_vlock);
 356                             error = vget(vp, LK_EXCLUSIVE);
 357                             if (error == ENOENT) {

 (gdb) p node
 $2 = (struct tmpfs_node *) 0x7f7ff730ddd0
 (gdb) p *node
 $3 = {tn_entries = {le_next = 0x7f7fdeaddead, le_prev = 0x7f7ff730dc30},
   tn_type = 4147175416, tn_id = 673978772831, tn_status = 0, tn_size = 0,
   tn_uid = 0, tn_gid = 0, tn_mode = 493, tn_flags = 0, tn_links = 0,
   tn_atime = {tv_sec = 1302212249, tv_nsec = 478983999}, tn_mtime = {
     tv_sec = 1302212249, tv_nsec = 478983999}, tn_ctime = {
     tv_sec = 1302212249, tv_nsec = 478983999}, tn_birthtime = {
     tv_sec = 1302212249, tv_nsec = 478983999}, tn_gen = 3823011438,
   tn_lockf = 0x0, tn_vlock = {u = {mtxa_owner = 140187593645568}},
   tn_vnode = 0x0, tn_spec = {tn_dev = {tn_rdev = 140187584749216}, tn_dir = {
       tn_parent = 0x7f7ff730dea0, tn_dir = {tqh_first = 0x0,
         tqh_last = 0x7f7ff730de80}, tn_readdir_lastn = 0,
       tn_readdir_lastp = 0x0}, tn_lnk = {tn_link = 0x7f7ff730dea0 ""},
     tn_reg = {tn_aobj = 0x7f7ff730dea0, tn_aobj_pages = 0}}}

 (gdb) bt
 #0  0x00007f7ff24e97da in _lwp_kill () from /usr/lib/libc.so.12
 #1  0x00007f7ff24e914e in abort ()
     at /local/src/NetBSD/src/lib/libc/stdlib/abort.c:74
 #2  0x00007f7ff3008535 in rumpuser_exit (rv=1)
     at /local/src/NetBSD/src/lib/librumpuser/rumpuser.c:541
 #3  0x00007f7ff347bddc in cpu_reboot (howto=<value optimized out>,
     bootstr=<value optimized out>)
     at /local/src/NetBSD/src/lib/librump/../../sys/rump/librump/rumpkern/rump.c:568
 #4  0x00007f7ff34569fe in panic (
     fmt=0x7f7ff34845a8 "lockdebug_lookup: uninitialized lock (lock=%p, from=%08lx)") at /local/src/NetBSD/src/lib/librump/../../sys/rump/../kern/subr_prf.c:302
 #5  0x00007f7ff3447dcc in lockdebug_wantlock (lock=0x7f7ff730de68,
     where=140187556420420, shared=false, trylock=false)
     at /local/src/NetBSD/src/lib/librump/../../sys/rump/../kern/subr_lockdebug.c:195
 #6  0x00007f7ff3478b8f in mutex_enter (mtx=0x1)
     at /local/src/NetBSD/src/lib/librump/../../sys/rump/librump/rumpkern/locks.c:112
 #7  0x00007f7ff5809b44 in tmpfs_alloc_vp (mp=0x7fee9000, node=0x7f7ff730ddd0,
     vpp=0x7f7fffffc3e0)
     at /local/src/NetBSD/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c:352
 #8  0x00007f7ff5808281 in tmpfs_lookup (v=<value optimized out>)
     at /local/src/NetBSD/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_vnops.c:178
 #9  0x00007f7ff345001e in VOP_LOOKUP (dvp=0x7f7ff7b787e8, vpp=0x6,
     cnp=<value optimized out>)
     at /local/src/NetBSD/src/lib/librump/../../sys/rump/../kern/vnode_if.c:120
 #10 0x00007f7ff3838f82 in do_lookup (state=0x7f7fffffc2e0,
     startdir=<value optimized out>)
     at /local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_lookup.c:945
 #11 0x00007f7ff3839a6b in namei (ndp=<value optimized out>)
     at /local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_lookup.c:1230
 #12 0x00007f7ff382b58f in chdir_lookup (path=<value optimized out>,
     where=<value optimized out>, vpp=0x7f7fffffc468, l=0x7feea600)
     at /local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_syscalls.c:1006
 #13 0x00007f7ff382b62d in sys_chdir (l=0x7f7ff24e97da, uap=0x0,
     retval=<value optimized out>)
     at /local/src/NetBSD/src/lib/librumpvfs/../../sys/rump/../kern/vfs_syscalls.c:923
 #14 0x00007f7ff3474383 in rsys_syscall (num=12, data=0x7f7fffffc4d0,
     dlen=<value optimized out>, retval=0x7f7fffffc4c0)
     at /local/src/NetBSD/src/lib/librump/../../sys/rump/../sys/syscallvar.h:61
 #15 0x00007f7ff3478683 in rump___sysimpl_chdir (path=<value optimized out>)
     at /local/src/NetBSD/src/lib/librump/../../sys/rump/librump/rumpkern/rump_syscalls.c:227
 #16 0x000000000040fd97 in dir_rmdirdotdot (tc=0x63f118, mp=0x42dca9 "/mnt")
     at /local/src/NetBSD/src/tests/fs/vfs/t_vnops.c:180
 #17 0x00000000004165d0 in atfu_tmpfs_dir_rmdirdotdot_body (tc=0x63f118)
     at /local/src/NetBSD/src/tests/fs/vfs/t_vnops.c:773
 #18 0x0000000000429aff in atf_tc_run (tc=0x63f118,
     resfile=<value optimized out>)
     at /local/src/NetBSD/src/external/bsd/atf/dist/atf-c/tc.c:999
 #19 0x00000000004287c3 in atf_tp_main (argc=<value optimized out>,
     argv=0x7f7fffffda30, add_tcs_hook=0x40604e <atfu_tp_add_tcs>)
     at /local/src/NetBSD/src/external/bsd/atf/dist/atf-c/detail/tp_main.c:493
 #20 0x0000000000405ef1 in ___start (argc=2, argv=0x7f7fffffdac8,
     envp=<value optimized out>, cleanup=<value optimized out>,
     obj=<value optimized out>, ps_strings=<value optimized out>)
     at /local/src/NetBSD/src/lib/csu/common/crt0-common.c:129
 #21 0x00007f7ff7ffa000 in ?? ()
 #22 0x0000000000000002 in ?? ()
 #23 0x00007f7ffffffce8 in ?? ()
 #24 0x00007f7ffffffd02 in ?? ()
 #25 0x0000000000000000 in ?? ()

 -- 
 Nicolas Joly

 Projects and Developments in Bioinformatics
 Institut Pasteur, Paris.

From: "Mindaugas Rasiukevicius" <rmind@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44657 CVS commit: src/sys/fs/tmpfs
Date: Sun, 29 May 2011 22:29:08 +0000

 Module Name:	src
 Committed By:	rmind
 Date:		Sun May 29 22:29:07 UTC 2011

 Modified Files:
 	src/sys/fs/tmpfs: tmpfs.h tmpfs_subr.c tmpfs_vfsops.c tmpfs_vnops.c

 Log Message:
 - Rework and document inode reference counting.  Also document inode life
   cycle (destruction part).  Perform link counting in tmpfs_dir_attach()
   and tmpfs_dir_detach(), instead of alloc/free and arbitrary places.
   Fixes PR/44285, PR/44288, PR/44657 and likely PR/42484.

 - Fix the race between the lookup and inode destruction.  Fixes PR/43167
   and its duplicates PR/40088, PR/40757.

 - Improve tmpfs_rename() locking a little, fix kqueue event notifications
   and also fix PR/43617.  Add simplistic tmpfs_parentcheck_p(); to be
   expanded and used for further rename() locking fixes.

 - Cache directory entry "hint" in the tmpfs node, add tmpfs_dir_cached(),
   and thus avoid unnecessary lookup in tmpfs_remove() and tmpfs_rmdir().

 - Set correct _PC_FILESIZEBITS value in tmpfs_pathconf().  Fixes PR/43576.

 - Few minor fixes.


 To generate a diff of this commit:
 cvs rdiff -u -r1.43 -r1.44 src/sys/fs/tmpfs/tmpfs.h
 cvs rdiff -u -r1.70 -r1.71 src/sys/fs/tmpfs/tmpfs_subr.c
 cvs rdiff -u -r1.50 -r1.51 src/sys/fs/tmpfs/tmpfs_vfsops.c
 cvs rdiff -u -r1.84 -r1.85 src/sys/fs/tmpfs/tmpfs_vnops.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Responsible-Changed-From-To: kern-bug-people->rmind
Responsible-Changed-By: rmind@NetBSD.org
Responsible-Changed-When: Sun, 29 May 2011 22:44:05 +0000
Responsible-Changed-Why:


State-Changed-From-To: open->closed
State-Changed-By: rmind@NetBSD.org
State-Changed-When: Sun, 29 May 2011 22:44:05 +0000
State-Changed-Why:
Fixed, thanks.


>Unformatted:

Home	PR Database Search