NetBSD Problem Report #10312

Received: (qmail 21274 invoked from network); 7 Jun 2000 21:56:47 -0000
Message-Id: <200006072156.e57LujP00848@cactus.emsi.priv.at>
Date: Wed, 7 Jun 2000 23:56:45 +0200 (CEST)
From: "Martin J. Laubach" <mjl@emsi.priv.at>
Reply-To: mjl@emsi.priv.at
To: gnats-bugs@gnats.netbsd.org
Subject: too much vrele in the msdosfs_rename(), system panics.
X-Send-Pr-Version: 3.95

>Number:         10312
>Category:       kern
>Synopsis:       too much vrele in the msdosfs_rename(), system panics.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    jdolecek
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 07 21:57:00 +0000 2000
>Closed-Date:    Sun Jul 30 19:39:13 +0000 2000
>Last-Modified:  Sun Jul 30 19:39:13 +0000 2000
>Originator:     Martin J. Laubach
>Release:        1.4ZA
>Organization:
>Environment:
System: NetBSD cactus.emsi.priv.at 1.4Z NetBSD 1.4Z (CACTUS) #0: Wed May 31 22:18:54 CEST 2000 mjl@asparagus:/home/temp/devel/cvs/src/sys/arch/i386/compile/CACTUS i386

>Description:
  This PR comes from OpenBSD PR/1249. I have verified that the problem
described also affects NetBSD. Could someone familiar with the msdosfs
check the include patch please?

  Originally submitted by gluk@ptci.ru (Grigoriy Orlov)

>How-To-Repeat:

compile kernel with option DIAGNOSTIC, reboot.

mount -t msdos /dev/wd0i /mnt
mkdir /mnt/a
mkdir /mnt/a/b
mv /mnt/a /mnt/a/b
vrele: bad ref count: type VDIR ....
ddb>

>Fix:

  [Note: this patch is for openbsd, need probably some adjusting
   for NetBSD]

Index: msdosfs_vnops.c
===================================================================
RCS file: /cvs/src/sys/msdosfs/msdosfs_vnops.c,v
retrieving revision 1.21
diff -u -r1.21 msdosfs_vnops.c
--- msdosfs_vnops.c	1999/02/26 03:28:13	1.21
+++ msdosfs_vnops.c	2000/05/26 22:21:22
@@ -1060,7 +1060,7 @@
 	vrele(fdvp);
 	if (doingdirectory && newparent) {
 		if (error)	/* write access check above */
-			goto bad;
+			goto bad1;
 		if (xp != NULL)
 			vput(tvp);
 		/*
@@ -1086,19 +1086,19 @@
 		if (xp->de_Attributes & ATTR_DIRECTORY) {
 			if (!dosdirempty(xp)) {
 				error = ENOTEMPTY;
-				goto bad;
+				goto bad1;
 			}
 			if (!doingdirectory) {
 				error = ENOTDIR;
-				goto bad;
+				goto bad1;
 			}
 			cache_purge(tdvp);
 		} else if (doingdirectory) {
 			error = EISDIR;
-			goto bad;
+			goto bad1;
 		}
 		if ((error = removede(dp, xp)) != 0)
-			goto bad;
+			goto bad1;
 		vput(tvp);
 		xp = NULL;
 	}
@@ -1109,7 +1109,7 @@
 	 * file/directory.
 	 */
 	if ((error = uniqdosname(VTODE(tdvp), tcnp, toname)) != 0)
-		goto abortit;
+		goto bad1;

 	/*
 	 * Since from wasn't locked at various places above,
@@ -1150,7 +1150,6 @@
 		if (doingdirectory)
 			panic("rename: lost dir entry");
 		vrele(ap->a_fvp);
-		VOP_UNLOCK(fvp, 0, p);
 		if (newparent)
 			VOP_UNLOCK(fdvp, 0, p);
 		xp = NULL;
@@ -1175,7 +1174,6 @@
 			bcopy(oldname, ip->de_Name, 11);
 			if (newparent)
 				VOP_UNLOCK(fdvp, 0, p);
-			VOP_UNLOCK(fvp, 0, p);
 			goto bad;
 		}
 		ip->de_refcnt++;
@@ -1184,7 +1182,6 @@
 			/* XXX should really panic here, fs is corrupt */
 			if (newparent)
 				VOP_UNLOCK(fdvp, 0, p);
-			VOP_UNLOCK(fvp, 0, p);
 			goto bad;
 		}
 		if (!doingdirectory) {
@@ -1194,7 +1191,6 @@
 				/* XXX should really panic here, fs is corrupt */
 				if (newparent)
 					VOP_UNLOCK(fdvp, 0, p);
-				VOP_UNLOCK(fvp, 0, p);
 				goto bad;
 			}
 			if (ip->de_dirclust != MSDOSFSROOT)
@@ -1221,26 +1217,25 @@
 		if (error) {
 			/* XXX should really panic here, fs is corrupt */
 			brelse(bp);
-			VOP_UNLOCK(fvp, 0, p);
 			goto bad;
 		}
 		dotdotp = (struct direntry *)bp->b_data + 1;
 		putushort(dotdotp->deStartCluster, dp->de_StartCluster);
 		if ((error = bwrite(bp)) != 0) {
 			/* XXX should really panic here, fs is corrupt */
-			VOP_UNLOCK(fvp, 0, p);
 			goto bad;
 		}
 	}

-	VOP_UNLOCK(fvp, 0, p);
 bad:
+	VOP_UNLOCK(fvp, 0, p);
+	vrele(fdvp);
+bad1:
 	if (xp)
 		vput(tvp);
 	vput(tdvp);
 out:
 	ip->de_flag &= ~DE_RENAME;
-	vrele(fdvp);
 	vrele(fvp);
 	return (error);

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: kern-bug-people->jdolecek 
Responsible-Changed-By: jdolecek 
Responsible-Changed-When: Wed Jun 7 16:39:19 PDT 2000 
Responsible-Changed-Why:  
I'll take care of this. 
State-Changed-From-To: open->analyzed 
State-Changed-By: jdolecek 
State-Changed-When: Sun Jul 16 05:09:46 PDT 2000 
State-Changed-Why:  
I'm able to repeat the problem easily (also on -current), working on fix. 
State-Changed-From-To: analyzed->feedback 
State-Changed-By: jdolecek 
State-Changed-When: Tue Jul 25 15:22:31 PDT 2000 
State-Changed-Why:  
I've committed slighly different fix for this problem to -current. 
It's rev. 1.100 of syssrc/sys/msdosfs/msdosfs_vnops.c. Would you 
mind testing the change and letting me know if it's okay now ? 
State-Changed-From-To: feedback->closed 
State-Changed-By: jdolecek 
State-Changed-When: Sun Jul 30 12:38:19 PDT 2000 
State-Changed-Why:  
Fixed (at least the test case DTRT now), thanks! 
>Unformatted:

Home	PR Database Search