From nobody@FreeBSD.org  Mon Apr  6 20:36:45 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 62BBD1065AD5
	for <freebsd-gnats-submit@FreeBSD.org>; Mon,  6 Apr 2009 20:36:45 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 4C0248FC15
	for <freebsd-gnats-submit@FreeBSD.org>; Mon,  6 Apr 2009 20:36:45 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n36KajNh024428
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 6 Apr 2009 20:36:45 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n36KajYN024426;
	Mon, 6 Apr 2009 20:36:45 GMT
	(envelope-from nobody)
Message-Id: <200904062036.n36KajYN024426@www.freebsd.org>
Date: Mon, 6 Apr 2009 20:36:45 GMT
From: John Hickey <jhickey@isi.edu>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Kernel Panic in kern_vfs
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         133439
>Category:       kern
>Synopsis:       [vfs] [panic] Kernel Panic in kern_vfs
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kan
>State:          patched
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 06 20:40:03 UTC 2009
>Closed-Date:    
>Last-Modified:  Sat May 09 18:17:58 UTC 2009
>Originator:     John Hickey
>Release:        RELENG_6_4
>Organization:
>Environment:
FreeBSD users.isi.deterlab.net 6.4-RELEASE-p3 FreeBSD 6.4-RELEASE-p3 #5: Mon Apr  6 12:35:02 PDT 2009     unknown@:/usr/obj/usr/src/sys/USERS  i386

>Description:
Unread portion of the kernel message buffer:
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 7; apic id = 07
fault virtual address	= 0x104
fault code		= supervisor read, page not present
instruction pointer	= 0x20:0xc05ba1e1
stack pointer	        = 0x28:0xeb571a74
frame pointer	        = 0x28:0xeb571a80
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= resume, IOPL = 0
current process		= 826 (nfsd)
trap number		= 12
panic: page fault
cpuid = 7
Uptime: 23h44m52s
Dumping 3578 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 3579MB (916048 pages) 3563 3547 3531 3515 3499 3483 3467 3451 3435 3419 3403 3387 3371 3355 3339 3323 3307 3291 3275 3259 3243 3227 3211 3195 3179 3163 3147 3131 3115 3099 3083 3067 3051 3035 3019 3003 2987 2971 2955 2939 2923 2907 2891 2875 2859 2843 2827 2811 2795 2779 2763 2747 2731 2715 2699 2683 2667 2651 2635 2619 2603 2587 2571 2555 2539 2523 2507 2491 2475 2459 2443 2427 2411 2395 2379 2363 2347 2331 2315 2299 2283 2267 2251 2235 2219 2203 2187 2171 2155 2139 2123 2107 2091 2075 2059 2043 2027 2011 1995 1979 1963 1947 1931 1915 1899 1883 1867 1851 1835 1819 1803 1787 1771 1755 1739 1723 1707 1691 1675 1659 1643 1627 1611 1595 1579 1563 1547 1531 1515 1499 1483 1467 1451 1435 1419 1403 1387 1371 1355 1339 1323 1307 1291 1275 1259 1243 1227 1211 1195 1179 1163 1147 1131 1115 1099 1083 1067 1051 1035 1019 1003 987 971 955 939 923 907 891 875 859 843 827 811 795 779 763 747 731 715 699 683 667 651 635 619 603 587 571 555 539 523 507 491 475 459 443 427 411 395 
 379 363 347 331 315 299 283 267 251 235 219 203 187 171 155 139 123 107 91 75 59 43 27 11

#0  doadump () at pcpu.h:165
165	pcpu.h: No such file or directory.
	in pcpu.h(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc05c4ce6 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:410
#2  0xc05c503d in panic (fmt=0xc0780dc4 "%s") at /usr/src/sys/kern/kern_shutdown.c:566
#3  0xc0759ea6 in trap_fatal (frame=0xeb571a34, eva=260) at /usr/src/sys/i386/i386/trap.c:838
#4  0xc07595be in trap (frame=
      {tf_fs = -928776184, tf_es = -346619864, tf_ds = -1067253720, tf_edi = -921424896, tf_esi = 4, tf_ebp = -346613120, tf_isp = -346613152, tf_ebx = -921123716, tf_edx = 6, tf_ecx = 4, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1067736607, tf_cs = 32, tf_eflags = 65538, tf_esp = -921123840, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:270
#5  0xc07446aa in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#6  0xc05ba1e1 in _mtx_lock_sleep (m=0xc918c47c, tid=3373542400, opts=0, file=0x0, line=0) at /usr/src/sys/kern/kern_mutex.c:546
#7  0xc0618954 in vfs_export_lookup (mp=0xc909e7c8, nam=0x6) at /usr/src/sys/kern/vfs_export.c:380
#8  0xc06189d2 in vfs_stdcheckexp (mp=0xc909e7c8, nam=0xccf57360, extflagsp=0x1, credanonp=0x1) at /usr/src/sys/kern/vfs_export.c:415
#9  0xc06b5075 in nfsrv_fhtovp (fhp=0xeb571b68, lockflag=1, vpp=0xeb571b30, cred=0xca191500, slp=0xca67ae80, nam=0xccf57360, 
    rdonlyp=0x1, pubflag=1) at /usr/src/sys/nfsserver/nfs_srvsubs.c:1097
#10 0xc06a3629 in nfsrv_getattr (nfsd=0xca1ebd00, slp=0xca67ae80, td=0x1, mrq=0xeb571c98) at /usr/src/sys/nfsserver/nfs_serv.c:268
#11 0xc06b62b1 in nfssvc_nfsd (td=0x1) at /usr/src/sys/nfsserver/nfs_syscalls.c:474
#12 0xc06b5a90 in nfssvc (td=0xc9142c00, uap=0xeb571d04) at /usr/src/sys/nfsserver/nfs_syscalls.c:181
#13 0xc075a1eb in syscall (frame=
      {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = 1, tf_esi = 0, tf_ebp = -1077941464, tf_isp = -346612380, tf_ebx = 64, tf_edx = 1746200344, tf_ecx = 26, tf_eax = 155, tf_trapno = 12, tf_err = 2, tf_eip = 1745609635, tf_cs = 51, tf_eflags = 662, tf_esp = -1077941492, tf_ss = 59}) at /usr/src/sys/i386/i386/trap.c:984
#14 0xc07446ff in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
#15 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)


>How-To-Repeat:
This system does a good bit of NFS serving and the exports map is
modified on a regular basis (.  The system is an 8 way machine.

I'm no expert at what is going on here, but I suspect that we are getting
by doing a vfs_export_lookup while vfs_free_addrlist is going.

(kgdb) up 7
#7  0xc0618954 in vfs_export_lookup (mp=0xc909e7c8, nam=0x6) at /usr/src/sys/kern/vfs_export.c:380
380					RADIX_NODE_HEAD_LOCK(rnh);
(kgdb) list
375			 */
376			if (nam != NULL) {
377				saddr = nam;
378				rnh = nep->ne_rtable[saddr->sa_family];
379				if (rnh != NULL) {
380					RADIX_NODE_HEAD_LOCK(rnh);
381					np = (struct netcred *)
382					    (*rnh->rnh_matchaddr)(saddr, rnh);
383					RADIX_NODE_HEAD_UNLOCK(rnh);
384					if (np && np->netc_rnodes->rn_flags & RNF_ROOT)

There is a comment on line 217 of vfs_free_addrlist noting that it is
not SMP safe.  So between lines 379 and 380 rnh is being freed by
vfs_free_addrlist, but we still try to call RADIX_NODE_HEAD_LOCK on the
old address and get a page fault.   It appears when changing a mountpoint
the address hash is deleted completely and then recreated.
>Fix:


>Release-Note:
>Audit-Trail:

From: Keith Sklower <sklower@vangogh.CS.Berkeley.EDU>
To: bug-followup@FreeBSD.org, Jhickey@isi.edu
Cc:  
Subject: Re: kern/133439: [vfs][panic] Kernel Panic in kern_vfs
Date: Tue, 7 Apr 2009 08:03:38 -0700 (PDT)

 I would have otherwise entitled this :
     VFS_CHECKEXP inherently unsafe, even in 7.2 Beta?
 
 I'm writing after having been one of the users inconvenienced by the crashes
 reported by John Hickey in Problem report kerne/133439 who hypothesized
 that the panics were caused by referencing memory in an 8-way CPU
 in nfsrv_fhtovp that had been freed while revising the export list.
 
 I have some historical connection to this code, having written the
 original radix tree implementation, proposing its use to Kirk Mckusick for
 nfs exports, and providing him the 30 lines or so of code that at
 the time were need to switch from hash lists to the tree;
 so I was intensely curious about the nature of the crash.
 
 I spent a few hours enjoying some code spelunking yesterday afternoon,
 and have the following impressions:
 
 The VFS_CHECKEXP handle takes as inputs a mount point, and a network
 address, and returns as output flags which are written into storage
 provided by the caller, and a pointer to an internal u_cred which resides`
 in storage provided by the the file system underneath, and not by the caller.
 
 When the underlying interface handle is vfs_stdcheckexp, although
 FreeBSD 7.2 improves the locking around looking up the the appropriate
 credential, once that critical section is exited, nothing prevents
 another kernel thread from freeing the netred element that encompasses
 that credential.
 
 This leaves us with 3 unfortunate choices:
 
 1.) Acknowledging that the interface is SMP-unsafe and requiring 
     anybody using VFS_CHECKEXP to explicitly call
     lockmgr(&mp->mnt_explock, LK_EXCLUSIVE, NULL, curthread);
     and release it once having copied the u_cred structure
     (and, of course removing the lockmgr calls from vfs_stdcheckexp()
     so that it doesn't deadlock against itself)
 
 or
 
 2.) changing the definition of VFS_CHECKEXP so that the  *caller*
     provides storage for it to copy the u_cred structure into.
 
 or
 
 3.) defining a new handle in the interface, e.g. VFS_CHECKFREE so that
     VFS_CHECKEXP can lock the specific opaque elment returned, and
     VFS_CHECKFREE would unlock and do the actual freeing of it if
     it has evaporated since being looked up, analogous to the way
     rtalloc() and RTFREE() work.   (which actually work by reference 
     counts).
 
 I leave to your judgement which of the three to pick.
 
 Regards,
 
 Keith Sklower
 
 P.S.
 Given the comment at the bottom of vfs_export() in 7.2
 I would recommend moving the 
    lockmgr(&mp->mnt_explock, LK_RELEASE, NULL, curthread);
 from immediately after out:
 to immediately before the return(error); 
Responsible-Changed-From-To: freebsd-bugs->kan 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Thu May 7 18:25:43 UTC 2009 
Responsible-Changed-Why:  
kan has agreed to look at this. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=133439 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/133439: commit references a PR
Date: Sat,  9 May 2009 18:09:30 +0000 (UTC)

 Author: kan
 Date: Sat May  9 18:09:17 2009
 New Revision: 191940
 URL: http://svn.freebsd.org/changeset/base/191940
 
 Log:
   Do not embed struct ucred into larger netcred parent structures.
   
   Credential might need to hang around longer than its parent and be used
   outside of mnt_explock scope controlling netcred lifetime. Use separate
   reference-counted ucred allocated separately instead.
   
   While there, extend mnt_explock coverage in vfs_stdexpcheck and clean-up
   some unused declarations in new NFS code.
   
   Reported by:	John Hickey
   PR:		kern/133439
   Reviewed by:	dfr, kib
 
 Modified:
   head/sys/fs/nfs/nfsport.h
   head/sys/fs/nfsserver/nfs_nfsdport.c
   head/sys/fs/nfsserver/nfs_nfsdsocket.c
   head/sys/kern/vfs_export.c
   head/sys/nfsserver/nfs_srvsubs.c
   head/sys/nlm/nlm_prot_impl.c
   head/sys/ufs/ufs/ufs_extern.h
 
 Modified: head/sys/fs/nfs/nfsport.h
 ==============================================================================
 --- head/sys/fs/nfs/nfsport.h	Sat May  9 17:47:42 2009	(r191939)
 +++ head/sys/fs/nfs/nfsport.h	Sat May  9 18:09:17 2009	(r191940)
 @@ -446,16 +446,6 @@ int nfsmsleep(void *, void *, int, const
  #define	VT_NFSV4ROOT		"nfsv4root"
  
  /*
 - * XXX - not in any system .h file, just vfs_export.c
 - * Network address lookup element
 - */
 -struct netcred {
 -	struct	radix_node netc_rnodes[2];
 -	int	netc_exflags;
 -	struct	ucred netc_anon;
 -};
 -
 -/*
   * Define whatever it takes to do a vn_rdwr().
   */
  #define	NFSD_RDWR(r, v, b, l, o, s, i, c, a, p) \
 
 Modified: head/sys/fs/nfsserver/nfs_nfsdport.c
 ==============================================================================
 --- head/sys/fs/nfsserver/nfs_nfsdport.c	Sat May  9 17:47:42 2009	(r191939)
 +++ head/sys/fs/nfsserver/nfs_nfsdport.c	Sat May  9 18:09:17 2009	(r191940)
 @@ -2565,6 +2565,8 @@ nfsd_fhtovp(struct nfsrv_descript *nd, s
  		if (nd->nd_repstat)
  			vput(*vpp);
  	}
 +	if (credanon != NULL)
 +		crfree(credanon);
  	if (nd->nd_repstat) {
  		if (startwrite)
  			vn_finished_write(mp);
 @@ -2598,16 +2600,6 @@ fp_getfvp(struct thread *p, int fd, stru
  }
  
  /*
 - * Network export information
 - */
 -struct netexport {
 -	struct	netcred ne_defexported;		      /* Default export */
 -	struct	radix_node_head *ne_rtable[AF_MAX+1]; /* Individual exports */
 -};
 -
 -struct netexport nfsv4root_export;
 -
 -/*
   * Called from newnfssvc() to update the exports list. Just call
   * vfs_export(). This has to be done, since the v4 root fake fs isn't
   * in the mount list.
 @@ -2861,6 +2853,8 @@ nfsvno_v4rootexport(struct nfsrv_descrip
  		return (NFSERR_PROGUNAVAIL);
  	if ((exflags & MNT_EXGSSONLY))
  		nd->nd_flag |= ND_EXGSSONLY;
 +	if (credanon != NULL)
 +		crfree(credanon);
  	return (0);
  }
  
 
 Modified: head/sys/fs/nfsserver/nfs_nfsdsocket.c
 ==============================================================================
 --- head/sys/fs/nfsserver/nfs_nfsdsocket.c	Sat May  9 17:47:42 2009	(r191939)
 +++ head/sys/fs/nfsserver/nfs_nfsdsocket.c	Sat May  9 18:09:17 2009	(r191940)
 @@ -870,6 +870,8 @@ nfsrvd_compound(struct nfsrv_descript *n
  				    if (!nd->nd_repstat)
  					nd->nd_repstat = nfsd_excred(nd,
  					    &nes, credanon);
 +				    if (credanon != NULL)
 +					crfree(credanon);
  				    if (!nd->nd_repstat) {
  					if (vpnes.nes_vfslocked)
  					    nfsvno_unlockvfs(mp);
 
 Modified: head/sys/kern/vfs_export.c
 ==============================================================================
 --- head/sys/kern/vfs_export.c	Sat May  9 17:47:42 2009	(r191939)
 +++ head/sys/kern/vfs_export.c	Sat May  9 18:09:17 2009	(r191940)
 @@ -68,7 +68,7 @@ static struct netcred *vfs_export_lookup
  struct netcred {
  	struct	radix_node netc_rnodes[2];
  	int	netc_exflags;
 -	struct	ucred netc_anon;
 +	struct	ucred *netc_anon;
  	int	netc_numsecflavors;
  	int	netc_secflavors[MAXSECFLAVORS];
  };
 @@ -83,7 +83,7 @@ struct netexport {
  
  /*
   * Build hash lists of net addresses and hang them off the mount point.
 - * Called by ufs_mount() to set up the lists of export addresses.
 + * Called by vfs_export() to set up the lists of export addresses.
   */
  static int
  vfs_hang_addrlist(struct mount *mp, struct netexport *nep,
 @@ -118,15 +118,14 @@ vfs_hang_addrlist(struct mount *mp, stru
  		}
  		np = &nep->ne_defexported;
  		np->netc_exflags = argp->ex_flags;
 -		bzero(&np->netc_anon, sizeof(np->netc_anon));
 -		np->netc_anon.cr_uid = argp->ex_anon.cr_uid;
 -		np->netc_anon.cr_ngroups = argp->ex_anon.cr_ngroups;
 -		bcopy(argp->ex_anon.cr_groups, np->netc_anon.cr_groups,
 -		    sizeof(np->netc_anon.cr_groups));
 +		np->netc_anon = crget();
 +		np->netc_anon->cr_uid = argp->ex_anon.cr_uid;
 +		np->netc_anon->cr_ngroups = argp->ex_anon.cr_ngroups;
 +		bcopy(argp->ex_anon.cr_groups, np->netc_anon->cr_groups,
 +		    sizeof(np->netc_anon->cr_groups));
  		np->netc_numsecflavors = argp->ex_numsecflavors;
  		bcopy(argp->ex_secflavors, np->netc_secflavors,
  		    sizeof(np->netc_secflavors));
 -		refcount_init(&np->netc_anon.cr_ref, 1);
  		MNT_ILOCK(mp);
  		mp->mnt_flag |= MNT_DEFEXPORTED;
  		MNT_IUNLOCK(mp);
 @@ -204,15 +203,14 @@ vfs_hang_addrlist(struct mount *mp, stru
  		goto out;
  	}
  	np->netc_exflags = argp->ex_flags;
 -	bzero(&np->netc_anon, sizeof(np->netc_anon));
 -	np->netc_anon.cr_uid = argp->ex_anon.cr_uid;
 -	np->netc_anon.cr_ngroups = argp->ex_anon.cr_ngroups;
 -	bcopy(argp->ex_anon.cr_groups, np->netc_anon.cr_groups,
 -	    sizeof(np->netc_anon.cr_groups));
 +	np->netc_anon = crget();
 +	np->netc_anon->cr_uid = argp->ex_anon.cr_uid;
 +	np->netc_anon->cr_ngroups = argp->ex_anon.cr_ngroups;
 +	bcopy(argp->ex_anon.cr_groups, np->netc_anon->cr_groups,
 +	    sizeof(np->netc_anon->cr_groups));
  	np->netc_numsecflavors = argp->ex_numsecflavors;
  	bcopy(argp->ex_secflavors, np->netc_secflavors,
  	    sizeof(np->netc_secflavors));
 -	refcount_init(&np->netc_anon.cr_ref, 1);
  	return (0);
  out:
  	free(np, M_NETADDR);
 @@ -267,9 +265,9 @@ vfs_export(struct mount *mp, struct expo
  	    || argp->ex_numsecflavors >= MAXSECFLAVORS)
  		return (EINVAL);
  
 -	nep = mp->mnt_export;
  	error = 0;
  	lockmgr(&mp->mnt_explock, LK_EXCLUSIVE, NULL);
 +	nep = mp->mnt_export;
  	if (argp->ex_flags & MNT_DELEXPORT) {
  		if (nep == NULL) {
  			error = ENOENT;
 @@ -375,8 +373,9 @@ vfs_setpublicfs(struct mount *mp, struct
  	 * If an indexfile was specified, pull it in.
  	 */
  	if (argp->ex_indexfile != NULL) {
 -		nfs_pub.np_index = malloc(MAXNAMLEN + 1, M_TEMP,
 -		    M_WAITOK);
 +		if (nfs_pub.np_index != NULL)
 +			nfs_pub.np_index = malloc(MAXNAMLEN + 1, M_TEMP,
 +			    M_WAITOK);
  		error = copyinstr(argp->ex_indexfile, nfs_pub.np_index,
  		    MAXNAMLEN, (size_t *)0);
  		if (!error) {
 @@ -392,6 +391,7 @@ vfs_setpublicfs(struct mount *mp, struct
  		}
  		if (error) {
  			free(nfs_pub.np_index, M_TEMP);
 +			nfs_pub.np_index = NULL;
  			return (error);
  		}
  	}
 @@ -461,15 +461,19 @@ vfs_stdcheckexp(struct mount *mp, struct
  
  	lockmgr(&mp->mnt_explock, LK_SHARED, NULL);
  	np = vfs_export_lookup(mp, nam);
 -	lockmgr(&mp->mnt_explock, LK_RELEASE, NULL);
 -	if (np == NULL)
 +	if (np == NULL) {
 +		lockmgr(&mp->mnt_explock, LK_RELEASE, NULL);
 +		*credanonp = NULL;
  		return (EACCES);
 +	}
  	*extflagsp = np->netc_exflags;
 -	*credanonp = &np->netc_anon;
 +	if ((*credanonp = np->netc_anon) != NULL)
 +		crhold(*credanonp);
  	if (numsecflavors)
  		*numsecflavors = np->netc_numsecflavors;
  	if (secflavors)
  		*secflavors = np->netc_secflavors;
 +	lockmgr(&mp->mnt_explock, LK_RELEASE, NULL);
  	return (0);
  }
  
 
 Modified: head/sys/nfsserver/nfs_srvsubs.c
 ==============================================================================
 --- head/sys/nfsserver/nfs_srvsubs.c	Sat May  9 17:47:42 2009	(r191939)
 +++ head/sys/nfsserver/nfs_srvsubs.c	Sat May  9 18:09:17 2009	(r191940)
 @@ -1193,6 +1193,9 @@ nfsrv_fhtovp(fhandle_t *fhp, int lockfla
  	if (!lockflag)
  		VOP_UNLOCK(*vpp, 0);
  out:
 +	if (credanon != NULL)
 +		crfree(credanon);
 +
  	if (error) {
  		VFS_UNLOCK_GIANT(vfslocked);
  	} else
 
 Modified: head/sys/nlm/nlm_prot_impl.c
 ==============================================================================
 --- head/sys/nlm/nlm_prot_impl.c	Sat May  9 17:47:42 2009	(r191939)
 +++ head/sys/nlm/nlm_prot_impl.c	Sat May  9 18:09:17 2009	(r191940)
 @@ -1752,7 +1752,8 @@ nlm_get_vfs_state(struct nlm_host *host,
  	}
  	if (cred->cr_uid == 0 || (exflags & MNT_EXPORTANON)) {
  		crfree(cred);
 -		cred = crhold(credanon);
 +		cred = credanon;
 +		credanon = NULL;
  	}
  
  	/*
 @@ -1772,6 +1773,8 @@ nlm_get_vfs_state(struct nlm_host *host,
  out:
  	if (cred)
  		crfree(cred);
 +	if (credanon)
 +		crfree(credanon);
  
  	return (error);
  }
 
 Modified: head/sys/ufs/ufs/ufs_extern.h
 ==============================================================================
 --- head/sys/ufs/ufs/ufs_extern.h	Sat May  9 17:47:42 2009	(r191939)
 +++ head/sys/ufs/ufs/ufs_extern.h	Sat May  9 18:09:17 2009	(r191940)
 @@ -38,7 +38,6 @@ struct direct;
  struct indir;
  struct inode;
  struct mount;
 -struct netcred;
  struct thread;
  struct sockaddr;
  struct ucred;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: kan 
State-Changed-When: Sat May 9 18:16:17 UTC 2009 
State-Changed-Why:  
Patched in -CURRENT and will MFC to stable-7 in a month or two. 
Will not be fixed in 6.x. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=133439 
>Unformatted:
