From nobody@FreeBSD.org  Wed Sep 20 15:34:21 2006
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3DDC516A587
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 20 Sep 2006 15:34:21 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F1D9743D7B
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 20 Sep 2006 15:34:20 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k8KFYKkS024078
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 20 Sep 2006 15:34:20 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id k8KFYKoE024077;
	Wed, 20 Sep 2006 15:34:20 GMT
	(envelope-from nobody)
Message-Id: <200609201534.k8KFYKoE024077@www.freebsd.org>
Date: Wed, 20 Sep 2006 15:34:20 GMT
From: Daniel Rudy <dcrudy@pacbell.net>
To: freebsd-gnats-submit@FreeBSD.org
Subject: panic: nfssvc_nfsd(): debug.mpsafenet=1 && Giant
X-Send-Pr-Version: www-2.3

>Number:         103432
>Category:       kern
>Synopsis:       panic: nfssvc_nfsd(): debug.mpsafenet=1 && Giant
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 20 15:40:17 GMT 2006
>Closed-Date:    Sun Mar 02 06:04:11 UTC 2008
>Last-Modified:  Sun Mar 02 06:04:11 UTC 2008
>Originator:     Daniel Rudy
>Release:        6.1-RELEASE-p7
>Organization:
>Environment:
>Description:
This computer is configured as a NFS server and it also has IPSEC enabled.  When a NFS client accesses this server, the server imediately panics with the following error "panic: nfssvc_nfsd(): debug.mpsafenet=1 && Giant" and reboots hanging the client.  On a release 6.0 machine, debug.mpsafe is forced to 0 because IPSEC requires Giant.
>How-To-Repeat:
On a 6.1 system, enable IPSEC and NFS then try to access the server remotely.
>Fix:
Can't.  The OID for debug.mpsafenet is readonly.

>Release-Note:
>Audit-Trail:

From: Daniel Rudy <dcrudy@pacbell.net>
To: bug-followup@FreeBSD.org,  dcrudy@pacbell.net
Cc:  
Subject: Re: kern/103432: panic: nfssvc_nfsd(): debug.mpsafenet=1 &amp;&amp;
 Giant
Date: Wed, 20 Sep 2006 08:49:40 -0700

 Forgot to submit my environment information:
 
 strata:/usr/src/sys 1036 ### ->uname -a
 FreeBSD strata.xxxxxxxx.org 6.1-RELEASE-p7 FreeBSD 6.1-RELEASE-p7 #12:
 Tue Sep 19 17:22:53 PDT 2006     root
 @strata:/usr/obj/usr/src/sys/STRATA  i386
 strata:/usr/src/sys 1037 ### ->
 -- 
 Daniel Rudy

From: Daniel Rudy <dcrudy@pacbell.net>
To: bug-followup@FreeBSD.org,  dcrudy@pacbell.net
Cc:  
Subject: Re: kern/103432: panic: nfssvc_nfsd(): debug.mpsafenet=1 &amp;&amp;
 Giant
Date: Wed, 20 Sep 2006 08:55:28 -0700

 Correction.
 
 I just checked the config file for STRATA and it turns out that IPSEC is
 *NOT* enabled in that kernel.
 
 -- 
 Daniel Rudy

From: Kris Kennaway <kris@obsecurity.org>
To: Daniel Rudy <dcrudy@pacbell.net>
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: kern/103432: panic: nfssvc_nfsd(): debug.mpsafenet=1 && Giant
Date: Wed, 20 Sep 2006 14:15:09 -0400

 --J2SCkAp4GZ/dPZZf
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 
 On Wed, Sep 20, 2006 at 03:34:20PM +0000, Daniel Rudy wrote:
 
 > This computer is configured as a NFS server and it also has IPSEC enabled.  When a NFS client accesses this server, the server imediately panics with the following error "panic: nfssvc_nfsd(): debug.mpsafenet=1 && Giant" and reboots hanging the client.  On a release 6.0 machine, debug.mpsafe is forced to 0 because IPSEC requires Giant.
 > >How-To-Repeat:
 
 This may have been fixed after 6.1-RELEASE, but it's impossible to say
 without a traceback.  Please follow the directions in the chapter on
 kernel debugging in the developers handbook and report back.
 
 > On a 6.1 system, enable IPSEC and NFS then try to access the server remotely.
 > >Fix:
 > Can't.  The OID for debug.mpsafenet is readonly.
 
 It's a tunable, you can set it in /boot/loader.conf at boot time.
 
 Kris
 
 --J2SCkAp4GZ/dPZZf
 Content-Type: application/pgp-signature
 Content-Disposition: inline
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.5 (FreeBSD)
 
 iD8DBQFFEYUtWry0BWjoQKURArdMAJ91mPvWFrNEUAB3J90uX2RkLga81QCeOakw
 /oHcANBZ61JG3mcroiuv10w=
 =jald
 -----END PGP SIGNATURE-----
 
 --J2SCkAp4GZ/dPZZf--
State-Changed-From-To: open->feedback 
State-Changed-By: kmacy 
State-Changed-When: Sat Nov 17 06:42:18 UTC 2007 
State-Changed-Why:  

Does this still happen on RELENG_7? Most of this codepath is gone there. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=103432 

From: Daniel Rudy <dcrudy@pacbell.net>
To: bug-followup@FreeBSD.org, dcrudy@pacbell.net
Cc:  
Subject: Re: kern/103432: panic: nfssvc_nfsd(): debug.mpsafenet=1 &amp;&amp;
 Giant
Date: Fri, 14 Dec 2007 22:41:43 -0800

 I don't know if it's fixed in RELENG_7 yet or not.  I don't plan on
 upgrading to 7 until it's final release.
 
 -- 
 Daniel Rudy

From: Robert Watson <rwatson@FreeBSD.org>
To: Daniel Rudy <dcrudy@pacbell.net>
Cc: freebsd-gnats-submit@FreeBSD.org, freebsd-bugs@FreeBSD.org
Subject: Re: kern/103432: panic: nfssvc_nfsd(): debug.mpsafenet=1 && Giant
Date: Tue, 25 Dec 2007 14:23:11 +0000 (GMT)

 It would be very helpful to have a stack trace on this one.
 
 There's a reasonable chance that this bug is gone in 7.x as we now have an 
 entirely MPSAFE IPSEC implementation, and the debug.mpssafenet compat code has 
 been entirely removed.  However, it would be very helpful to know.  You should 
 be able to compile and use a 7.x kernel with a 6.x userspace, which would give 
 you a lower-risk way to determine this.  Make sure to do a 7.x buildworld 
 before 7.x buildkernel, but only to a 7.x installkernel, not 7.x 
 installworld/mergemaster.
 
 Robert N M Watson
 Computer Laboratory
 University of Cambridge
State-Changed-From-To: feedback->closed 
State-Changed-By: linimon 
State-Changed-When: Sun Mar 2 06:03:13 UTC 2008 
State-Changed-Why:  
Feedback timeout (> 2 months). 

We really need the requested information to make any progress. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=103432 
>Unformatted:
