From yasu@mrit.mei.co.jp  Sun Oct  4 23:47:03 1998
Received: from mie.mrit.co.jp (mie.mrit.co.jp [210.128.138.3])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id XAA19547
          for <FreeBSD-gnats-submit@freebsd.org>; Sun, 4 Oct 1998 23:46:56 -0700 (PDT)
          (envelope-from yasu@mrit.mei.co.jp)
Received: by mie.mrit.co.jp (8.8.4/mrit980615) from mrit [133.185.23.3] with ESMTP
	id PAA11996 for <FreeBSD-gnats-submit@freebsd.org>; Mon, 5 Oct 1998 15:46:29 +0900 (JST)
Received: by mrit.mei.co.jp (8.8.4/mrit980615) with ESMTP
	id PAA06823; Mon, 5 Oct 1998 15:46:28 +0900 from [133.185.25.71];
Received: by waltz.codec.mrit.mei.co.jp (8.9.1/codec-FreeBSD9703)
	id PAA18863; Mon, 5 Oct 1998 15:46:27 +0900 (JST)
Message-Id: <199810050646.PAA18863@waltz.codec.mrit.mei.co.jp>
Date: Mon, 5 Oct 1998 15:46:27 +0900 (JST)
From: yasu@mrit.mei.co.jp (Yasuhiko WATANABE)
Reply-To: yasu@mrit.mei.co.jp
To: FreeBSD-gnats-submit@freebsd.org
Subject: Kernel panic happend in nfsd.
X-Send-Pr-Version: 3.2

>Number:         8154
>Category:       kern
>Synopsis:       Kernel panic happend in nfsd.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Oct  4 23:50:00 PDT 1998
>Closed-Date:    Sat Nov 14 02:09:25 PST 1998
>Last-Modified:  Sat Nov 14 02:09:59 PST 1998
>Originator:     Yasuhiko WATANABE
>Release:        FreeBSD 3.0-BETA i386
>Organization:
Matsushita Research Institue Tokyo, Inc.
>Environment:
FreeBSD niccolo.codec.mrit.mei.co.jp 3.0-BETA FreeBSD 3.0-BETA #2: Mon Oct  5 14:28:37 JST 1998     yasu@waltz:/usr/src/sys/compile/NICCOLO  i386

>Description:
Here is the stack trace.

Script started on Mon Oct  5 15:25:20 1998
You have mail.
naoko# gdb -k kernel vmcore.0
GDB is free software and you are welcome to distribute copies of it
 under certain conditions; type "show copying" to see the conditions.
There is absolutely no warranty for GDB; type "show warranty" for details.
GDB 4.16 (i386-unknown-freebsd), 
Copyright 1996 Free Software Foundation, Inc...
IdlePTD 267000
current pcb at 213be4
panic: from debugger
#0  0xf011aad3 in boot ()
(kgdb) bt
#0  0xf011aad3 in boot ()
#1  0xf011ae10 in panic ()
#2  0xf0102975 in db_panic ()
#3  0xf0102855 in db_command ()
#4  0xf01029e2 in db_command_loop ()
#5  0xf01050f3 in db_trap ()
#6  0xf01c8f11 in kdb_trap ()
#7  0xf01d36a8 in trap ()
#8  0xf01c9145 in Debugger ()
#9  0xf011ae07 in panic ()
#10 0xf0117893 in free (addr=0x0, type=0xf0201050)
    at ../../kern/kern_malloc.c:334
#11 0xf0184ab5 in nfsrv_dorec (slp=0xf0946100, nfsd=0xf0947a00, ndp=0xf5750e38)
    at ../../nfs/nfs_socket.c:2235
#12 0xf0188a40 in nfssvc_nfsd (nsd=0xf5750e94, argp=0x80751f4 "", p=0xf570ae80)
    at ../../nfs/nfs_syscalls.c:537
#13 0xf018865d in nfssvc (p=0xf570ae80, uap=0xf5750f94)
    at ../../nfs/nfs_syscalls.c:342
#14 0xf01d4183 in syscall ()
#15 0xf01c986c in Xint0x80_syscall ()
#16 0x80480cd in ?? ()
(kgdb) frame 10
#10 0xf0117893 in free (addr=0x0, type=0xf0201050)
    at ../../kern/kern_malloc.c:334
334				panic("free: multiple frees");
(kgdb) list
329		freep->type = type;
330	#endif /* DIAGNOSTIC */
331		kup->ku_freecnt++;
332		if (kup->ku_freecnt >= kbp->kb_elmpercl)
333			if (kup->ku_freecnt > kbp->kb_elmpercl)
334				panic("free: multiple frees");
335			else if (kbp->kb_totalfree > kbp->kb_highwat)
336				kbp->kb_couldfree++;
337		kbp->kb_totalfree++;
338		ksp->ks_memuse -= size;
(kgdb) frame 11
#11 0xf0184ab5 in nfsrv_dorec (slp=0xf0946100, nfsd=0xf0947a00, ndp=0xf5750e38)
    at ../../nfs/nfs_socket.c:2235
2235			FREE(nam, M_SONAME);
(kgdb) list
2230		nd->nd_md = nd->nd_mrep = m;
2231		nd->nd_nam2 = nam;
2232		nd->nd_dpos = mtod(m, caddr_t);
2233		error = nfs_getreq(nd, nfsd, TRUE);
2234		if (error) {
2235			FREE(nam, M_SONAME);
2236			free((caddr_t)nd, M_NFSRVDESC);
2237			return (error);
2238		}
2239		*ndp = nd;
(kgdb) frame 12
#12 0xf0188a40 in nfssvc_nfsd (nsd=0xf5750e94, argp=0x80751f4 "", p=0xf570ae80)
    at ../../nfs/nfs_syscalls.c:537
537					error = nfsrv_dorec(slp, nfsd, &nd);
(kgdb) list
532						nfsrv_rcv(slp->ns_so, (caddr_t)slp,
533							M_WAIT);
534						nfs_sndunlock(&slp->ns_solock,
535							&slp->ns_solock);
536					}
537					error = nfsrv_dorec(slp, nfsd, &nd);
538					cur_usec = nfs_curusec();
539					if (error && slp->ns_tq.lh_first &&
540					    slp->ns_tq.lh_first->nd_time <= cur_usec) {
541						error = 0;
(kgdb) frame 13 
#13 0xf018865d in nfssvc (p=0xf570ae80, uap=0xf5750f94)
    at ../../nfs/nfs_syscalls.c:342
342			error = nfssvc_nfsd(nsd, uap->argp, p);
(kgdb) list
337				    }
338				}
339			}
340			if ((uap->flag & NFSSVC_AUTHINFAIL) && (nfsd = nsd->nsd_nfsd))
341				nfsd->nfsd_flag |= NFSD_AUTHFAIL;
342			error = nfssvc_nfsd(nsd, uap->argp, p);
343		}
344	#endif /* NFS_NOSERVER */
345		if (error == EINTR || error == ERESTART)
346			error = 0;
(kgdb) frame 14
#14 0xf01d4183 in syscall ()
(kgdb) list
347		return (error);
348	}
349	
350	#ifndef NFS_NOSERVER
351	/*
352	 * Adds a socket to the list for servicing by nfsds.
353	 */
354	static int
355	nfssvc_addsock(fp, mynam, p)
356		struct file *fp;
(kgdb) frame 15
#15 0xf01c986c in Xint0x80_syscall ()
(kgdb) list
357		struct sockaddr *mynam;
358		struct proc *p;
359	{
360		register struct mbuf *m;
361		register int siz;
362		register struct nfssvc_sock *slp;
363		register struct socket *so;
364		struct nfssvc_sock *tslp;
365		int error, s;
366	
(kgdb) exit
Undefined command: "exit".  Try "help".
(kgdb) q
>How-To-Repeat:
At the time the kernel paniced, I was using editor and reading mails
from the nfs client machene.
	


>Fix:
	
	

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: dfr 
State-Changed-When: Sat Nov 14 02:09:25 PST 1998 
State-Changed-Why:  
Fixed in revision 1.47 of nfs_socket.c 
>Unformatted:
