Date: Fri, 16 Sep 2005 18:05:16 +1000 From: Peter Jeremy <PeterJeremy@optushome.com.au> To: Damian Gerow <dgerow@afflictions.org> Cc: freebsd-stable@freebsd.org Subject: Re: NFS directory copies cause crash Message-ID: <20050916080516.GE40237@cirb503493.alcatel.com.au> In-Reply-To: <20050916035838.GA32336@afflictions.org> References: <20050916012432.GA31590@afflictions.org> <20050916013825.GA93015@xor.obsecurity.org> <20050916035838.GA32336@afflictions.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 2005-Sep-15 23:58:39 -0400, Damian Gerow wrote:
>Thus spake Kris Kennaway (kris@obsecurity.org) [15/09/05 21:39]:
>: > Is this something known and being worked on, or should I try to gather some
>: > debugging information?
>:
>: The latter..at least a DDB traceback to begin with so we can tell if
>: it's a known issue or not.
>
>This is what I've got:
>
> Fatal trap 18: integer divide fault while in kernel mode
> instruction pointer = 0x8:0xc063c94d
...
> #4 0xc06c2722 in trap (frame=
> {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = -1048248320, tf_esi = 0, tf_ebp = -738105568, tf_isp = -738105648, tf_ebx = 0, tf_edx = 0, tf_ecx = 0, tf_eax = 183205888, tf_trapno = 18, tf_err = 0, tf_eip = -1067202227, tf_cs = 8, tf_eflags = 66182, tf_esp = 38, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:622
...
> #19 0xc063c94d in ffs_dirpref (pip=0xc1b193d4) at libkern.h:56
> #20 0xc063c42a in ffs_valloc (pvp=0xc1e38d68, mode=16877, cred=0xc1e08d80, vpp=0xd40167a0) at /usr/src/sys/ufs/ffs/ffs_alloc.c:863
Frame #19 is the real problem. This is where inline functions are a
real nuisance. libkern.h:56 is min() and there are two invocations of
min() from ffs_dirpref() which could potentially have a divide-by-zero.
As a first step to tracking down what has gone wrong, within kgdb:
print *(struct inode *)0xc1b193d4
print *((struct inode *)0xc1b193d4)->i_fs
disas ffs_dirpref
The disassembly is about 280 lines and someone will need to map 0xc063c94d
to the source line within ffs_dirpref() to locate which divide is failing.
--
Peter Jeremy
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050916080516.GE40237>