From owner-freebsd-stable@FreeBSD.ORG  Wed Jun 11 13:57:24 2003
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1F1F637B401
	for <stable@freebsd.org>; Wed, 11 Jun 2003 13:57:24 -0700 (PDT)
Received: from salmon.maths.tcd.ie (salmon.maths.tcd.ie [134.226.81.11])
	by mx1.FreeBSD.org (Postfix) with SMTP id E650743F93
	for <stable@freebsd.org>; Wed, 11 Jun 2003 13:57:22 -0700 (PDT)
	(envelope-from iedowse@maths.tcd.ie)
Received: from walton.maths.tcd.ie by salmon.maths.tcd.ie with SMTP
          id <aa90746@salmon>; 11 Jun 2003 21:57:22 +0100 (BST)
To: Martin Blapp <mb@imp.ch>
In-Reply-To: Your message of "Wed, 11 Jun 2003 22:30:51 +0200."
             <20030611222442.S97484@cvs.imp.ch> 
Date: Wed, 11 Jun 2003 21:57:21 +0100
From: Ian Dowse <iedowse@maths.tcd.ie>
Message-ID: <200306112157.aa90746@salmon.maths.tcd.ie>
cc: stable@freebsd.org
Subject: Re: nfs panic with umount -f 
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Jun 2003 20:57:24 -0000

In message <20030611222442.S97484@cvs.imp.ch>, Martin Blapp writes:
>
>Hi Ian and others,
>
>umount(8) -f does crash here on several just updated 4.8STABLE
>boxes for nfs volumes. Server is an IRIX server. All clients are FreeBSD.

Something like this should fix it I think - the code is assuming
that a directory vnode it saved has not been vgone'd in the meantime,
so it can blow up when it tries to use it as ans NFS node. This can
happen during umount -f if the directory vnode gets cleaned before
the vnode of the sillyrename file.

Ian

Index: nfs_vnops.c
===================================================================
RCS file: /FreeBSD/FreeBSD-CVS/src/sys/nfs/Attic/nfs_vnops.c,v
retrieving revision 1.150.2.5
diff -u -r1.150.2.5 nfs_vnops.c
--- nfs_vnops.c	20 Dec 2001 19:56:28 -0000	1.150.2.5
+++ nfs_vnops.c	11 Jun 2003 20:53:56 -0000
@@ -1558,6 +1558,9 @@
 	register struct sillyrename *sp;
 {
 
+	/* Make sure the directory vnode has not been vgone'd. */
+	if (sp->s_dvp->v_type == VBAD)
+		return (0);
 	return (nfs_removerpc(sp->s_dvp, sp->s_name, sp->s_namlen, sp->s_cred,
 		(struct proc *)0));
 }