NetBSD Problem Report #58760

From martin@duskware.de  Sat Oct 19 16:18:12 2024
Return-Path: <martin@duskware.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id C91821A923E
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 19 Oct 2024 16:18:12 +0000 (UTC)
From: martin@NetBSD.org
Reply-To: martin@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: running fdisk(8) on a vnd(4) backed by NFS crashes the kernel
X-Send-Pr-Version: 3.95

>Number:         58760
>Category:       kern
>Synopsis:       running fdisk(8) on a vnd(4) backed by NFS crashes the kernel
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 19 16:20:00 +0000 2024
>Last-Modified:  Sat Oct 19 22:10:00 +0000 2024
>Originator:     Martin Husemann
>Release:        NetBSD 10.99.12
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD unpluged.duskware.de 10.99.12 NetBSD 10.99.12 (UNPLUGED) #600: Mon Oct 14 12:03:10 CEST 2024 martin@seven-days-to-the-wolves.aprisoft.de:/work/src/sys/arch/evbarm/compile/UNPLUGED evbarm
Architecture: earmv5
Machine: evbarm
>Description:

In a directory that is NFS mounted do:

> cd $something/on/nfs
> dd if=/dev/zero of=blah.img count=128
128+0 records in
128+0 records out
65536 bytes transferred in 0.126 secs (520126 bytes/sec)
> fdisk -0 -u -f -s 12/32/96 -F ./blah.img
> fdisk blah.img
Disk: blah.img
NetBSD disklabel disk geometry:
cylinders: 1, heads: 255, sectors/track: 63 (16065 sectors/cylinder)
total sectors: 128, bytes/sector: 512

BIOS disk geometry:
cylinders: 1, heads: 255, sectors/track: 63 (16065 sectors/cylinder)
total sectors: 128

Partitions aligned to 16065 sector boundaries, offset 63

Partition table:
0: Primary DOS with 32 bit FAT - LBA (sysid 12)
    start 32, size 96 (0 MB, Cyls 0/0/33-0/2/2)
        PBR is not bootable: All bytes are identical (0x00)
1: <UNUSED>
2: <UNUSED>
3: <UNUSED>
No active partition.
Drive serial number: 0 (0x00000000)
> su
# vnconfig -c vnd0 blah.img
# fdisk vnd0

... and notice the kernel crash like this:

[ 685.0814275] panic: nfs physio/async
[ 685.0814275] cpu0: Begin traceback...
[ 685.0814275] 0xd4d2fe74: netbsd:db_panic+0x14
[ 685.0814275] 0xd4d2fe94: netbsd:vpanic+0x14c
[ 685.0814275] 0xd4d2feac: netbsd:panic+0x24
[ 685.0814275] 0xd4d2fed4: netbsd:nfs_strategy+0x60
[ 685.0814275] 0xd4d2fefc: netbsd:VOP_STRATEGY+0x68
[ 685.0814275] 0xd4d2ffac: netbsd:vndthread+0x7d0



>How-To-Repeat:
s/a

>Fix:
n/a

>Audit-Trail:
From: mlelstv@serpens.de (Michael van Elst)
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/58760: running fdisk(8) on a vnd(4) backed by NFS crashes the kernel
Date: Sat, 19 Oct 2024 22:04:50 -0000 (UTC)

 martin@NetBSD.org writes:

 >[ 685.0814275] panic: nfs physio/async
 >[ 685.0814275] cpu0: Begin traceback...
 >[ 685.0814275] 0xd4d2fe74: netbsd:db_panic+0x14
 >[ 685.0814275] 0xd4d2fe94: netbsd:vpanic+0x14c
 >[ 685.0814275] 0xd4d2feac: netbsd:panic+0x24
 >[ 685.0814275] 0xd4d2fed4: netbsd:nfs_strategy+0x60
 >[ 685.0814275] 0xd4d2fefc: netbsd:VOP_STRATEGY+0x68
 >[ 685.0814275] 0xd4d2ffac: netbsd:vndthread+0x7d0


 fdisk uses physio, so the original buffer is marked B_PHYS.
 vnd creates a nestiobuf which inherits B_PHYS but is also
 marked with B_ASYNC as it doesn't finish the I/O request
 itself.

 NFS panics if B_PHYS and B_ASYNC are set.

 nfs_vnops.c 1.32 (merge with 4.4lite2) introduced the panic
 for B_PHYS alone, nfs_vnops.c 1.33 refined this to require
 B_ASYNC as well.

Home	PR Database Search