GENERIC HEAD from Oct 24 13:21 UTC + nfs_serv.c.diff, vmcore.475

GDB: no debug ports present
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2005 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 7.0-CURRENT #34: Wed Oct 26 11:05:00 CEST 2005
    pho@current.osted.lan:/usr/src/sys/i386/compile/PHO
WARNING: WITNESS option enabled, expect reduced performance.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Celeron(R) CPU 1.80GHz (1799.14-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf13  Stepping = 3
  Features=0x3febfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM>
real memory  = 267583488 (255 MB)
avail memory = 251998208 (240 MB)
:
Trying to mount root from ufs:/dev/ad0s1a
rl0: link state changed to DOWN
Limiting icmp unreach response from 4084 to 200 packets/sec
Limiting icmp unreach response from 7033 to 200 packets/sec
Limiting icmp unreach response from 5321 to 200 packets/sec
:
Limiting icmp unreach response from 5159 to 200 packets/sec
Limiting icmp unreach response from 6831 to 200 packets/sec
panic: lock (sleep mutex) Giant not locked @ nfsserver/nfs_serv.c:2193
cpuid = 0
KDB: enter: panic
[thread pid 375 tid 100067 ]
Stopped at      kdb_enter+0x2b: nop
db> where
Tracing pid 375 tid 100067 td 0xc17ddc80
kdb_enter(c086aac3) at kdb_enter+0x2b
panic(c086ecd8,c0885d88,c087e411,c087e0bf,891) at panic+0x14b
witness_unlock(c0934100,8,c087e0bf,891) at witness_unlock+0xc0
_mtx_unlock_flags(c0934100,0,c087e0b6,891,8) at _mtx_unlock_flags+0x5b
nfsrv_mknod(c1e1de00,c1850980,c17ddc80,cf33ec3c,c063739c) at nfsrv_mknod+0x7f3
nfssvc_nfsd(c17ddc80,c17dc8f8,1,c0869e8c,12e) at nfssvc_nfsd+0x3d9
nfssvc(c17ddc80,cf33ed04,c,c17ddc80,cf33ed30) at nfssvc+0x18c
syscall(3b,3b,3b,1,0) at syscall+0x27e
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (155, FreeBSD ELF32, nfssvc), eip = 0x280b6bdb, esp = 0xbfbfeb1c, ebp = 0xbfbfeb38 ---
db> show alllocks
db> show lockedvnods
Locked vnodes
db> ps
  pid   proc     uid  ppid  pgrp  flag   stat  wmesg    wchan  cmd
 1413 c1879448 1001  1407  1413 0004002 [RUNQ] top
 1407 c1876cd8 1001  1406  1407 0004002 [SLPQ wait 0xc1876cd8][SLP] bash
 1406 c1879890 1001  1404  1404 0000100 [SLPQ select 0xc0981d64][SLP] sshd
 1404 c1879224    0   447  1404 0004100 [SLPQ sbwait 0xc1860d2c][SLP] sshd
  569 c1876ab4    0     1   569 0004002 [SLPQ ttyin 0xc16ff010][SLP] getty
  568 c1876890    0     1   568 0004002 [SLPQ ttyin 0xc16ff410][SLP] getty
  567 c17e066c    0     1   567 0004002 [SLPQ ttyin 0xc16f2810][SLP] getty
  566 c1879cd8    0     1   566 0004002 [SLPQ ttyin 0xc16f1810][SLP] getty
  565 c1876448    0     1   565 0004002 [SLPQ ttyin 0xc16f2c10][SLP] getty
  564 c187666c    0     1   564 0004002 [SLPQ ttyin 0xc16f0c10][SLP] getty
  563 c187a000    0     1   563 0004002 [SLPQ ttyin 0xc16f0810][SLP] getty
  562 c17e0ab4    0     1   562 0004002 [SLPQ ttyin 0xc16e7410][SLP] getty
  548 c1876224    0     1   548 0000000 [SLPQ select 0xc0981d64][SLP] inetd
  469 c1876000    0     1   469 0000000 [SLPQ nanslp 0xc0934a44][SLP] cron
  457 c1879ab4   25     1   457 0000100 [SLPQ pause 0xc1879ae8][SLP] sendmail
  453 c17dc000    0     1   453 0000100 [SLPQ select 0xc0981d64][SLP] sendmail
  447 c17e0448    0     1   447 0000100 [SLPQ select 0xc0981d64][SLP] sshd
  429 c17e0890    0     1   429 0000000 [RUNQ] ntpd
  398 c17dc224    0     1   398 0000000 [SLPQ select 0xc0981d64][SLP] usbd
  379 c17dc66c    0   373   373 0000000 [RUNQ] nfsd
  377 c17e0000    0   373   373 0000000 [RUNQ] nfsd
  376 c17dc448    0   373   373 0000000 [RUNQ] nfsd
  375 c17dc890    0   373   373 0000000 [CPU 0] nfsd
  373 c17dcab4    0     1   373 0000000 [SLPQ select 0xc0981d64][SLP] nfsd
  371 c17e0cd8    0     1   371 0000000 [SLPQ select 0xc0981d64][SLP] mountd
  302 c17dccd8    0     1   302 0000000 [SLPQ select 0xc0981d64][SLP] rpcbind
  274 c17e0224    0     1   274 0000000 [SLPQ select 0xc0981d64][SLP] devd
  228 c165d224    0     1   228 0000000 [SLPQ select 0xc0981d64][SLP] syslogd
   61 c165d66c    0     0     0 0000204 [SLPQ - 0xcca21d04][SLP] schedcpu
   60 c165d890    0     0     0 0000204 [SLPQ - 0xc098a3ec][SLP] nfsiod 3
   59 c165dab4    0     0     0 0000204 [SLPQ - 0xc098a3e8][SLP] nfsiod 2
   58 c165dcd8    0     0     0 0000204 [SLPQ - 0xc098a3e4][SLP] nfsiod 1
   57 c178b000    0     0     0 0000204 [SLPQ - 0xc098a3e0][SLP] nfsiod 0
   56 c178b224    0     0     0 0000204 [SLPQ vlruwt 0xc178b224][SLP] vnlru
   55 c178b448    0     0     0 0000204 [RUNQ] syncer
   54 c178b66c    0     0     0 0000204 [RUNQ] bufdaemon
   53 c178b890    0     0     0 000020c [SLPQ pgzero 0xc09909e4][SLP] pagezero
   52 c178bab4    0     0     0 0000204 [SLPQ psleep 0xc0990534][SLP] vmdaemon
   51 c178bcd8    0     0     0 0000204 [SLPQ psleep 0xc09904f0][SLP] pagedaemon
   50 c15ac66c    0     0     0 0000204 [SLPQ - 0xc169f83c][SLP] fdc0
   49 c15ac890    0     0     0 0000204 [IWAIT] swi0: sio
   48 c15acab4    0     0     0 0000204 [SLPQ usbevt 0xc1645210][SLP] usb4
   47 c15accd8    0     0     0 0000204 [SLPQ usbevt 0xc1695210][SLP] usb3
   46 c165c000    0     0     0 0000204 [SLPQ usbevt 0xc1696210][SLP] usb2
   45 c165c224    0     0     0 0000204 [SLPQ usbevt 0xc1680210][SLP] usb1
   44 c165c448    0     0     0 0000204 [SLPQ usbtsk 0xc0931664][SLP] usbtask
   43 c165c66c    0     0     0 0000204 [SLPQ usbevt 0xc164f210][SLP] usb0
   42 c165c890    0     0     0 0000204 [IWAIT] swi5:+
    9 c165cab4    0     0     0 0000204 [SLPQ - 0xc15b2400][SLP] thread taskq
    8 c165ccd8    0     0     0 0000204 [SLPQ - 0xc15b2480][SLP] acpi_task2
    7 c165d000    0     0     0 0000204 [SLPQ - 0xc15b2480][SLP] acpi_task1
    6 c159ecd8    0     0     0 0000204 [SLPQ - 0xc15b2480][SLP] acpi_task0
   41 c15aa000    0     0     0 0000204 [IWAIT] swi6:+
   40 c15aa224    0     0     0 0000204 [IWAIT] swi6: task queue
    5 c15aa448    0     0     0 0000204 [SLPQ - 0xc15b2700][SLP] kqueue taskq
   39 c15aa66c    0     0     0 0000204 [IWAIT] swi2: cambio
   38 c15aa890    0     0     0 0000204 [SLPQ - 0xc092f380][SLP] yarrow
    4 c15aaab4    0     0     0 0000204 [SLPQ - 0xc0931ea8][SLP] g_down
    3 c15aacd8    0     0     0 0000204 [SLPQ - 0xc0931ea4][SLP] g_up
    2 c15ac000    0     0     0 0000204 [SLPQ - 0xc0931e9c][SLP] g_event
   37 c15ac224    0     0     0 0000204 [IWAIT] swi3: vm
   36 c15ac448    0     0     0 000020c [RUNQ] swi4: clock sio
   35 c158a66c    0     0     0 0000204 [IWAIT] swi1: net
   34 c158a890    0     0     0 0000204 [IWAIT] irq23: ehci0
   33 c158aab4    0     0     0 0000204 [RUNQ] irq22: rl0
   32 c158acd8    0     0     0 0000204 [IWAIT] irq21:
   31 c159e000    0     0     0 0000204 [IWAIT] irq20:
   30 c159e224    0     0     0 0000204 [IWAIT] irq19: uhci1
   29 c159e448    0     0     0 0000204 [IWAIT] irq18: uhci2
   28 c159e66c    0     0     0 0000204 [IWAIT] irq17: pcm0
   27 c159e890    0     0     0 0000204 [IWAIT] irq16: uhci0 uhci3
   26 c159eab4    0     0     0 0000204 [IWAIT] irq15: ata1
   25 c155e224    0     0     0 0000204 [IWAIT] irq14: ata0
   24 c155e448    0     0     0 0000204 [IWAIT] irq13:
   23 c155e66c    0     0     0 0000204 [IWAIT] irq12:
   22 c155e890    0     0     0 0000204 [IWAIT] irq11:
   21 c155eab4    0     0     0 0000204 [IWAIT] irq10:
   20 c155ecd8    0     0     0 0000204 [IWAIT] irq9: acpi0
   19 c158a000    0     0     0 0000204 [IWAIT] irq8:
   18 c158a224    0     0     0 0000204 [IWAIT] irq7: ppc0
   17 c158a448    0     0     0 0000204 [IWAIT] irq6: fdc0
   16 c1559000    0     0     0 0000204 [IWAIT] irq5:
   15 c1559224    0     0     0 0000204 [IWAIT] irq4: sio0
   14 c1559448    0     0     0 0000204 [IWAIT] irq3:
   13 c155966c    0     0     0 0000204 [IWAIT] irq0:
   12 c1559890    0     0     0 0000204 [IWAIT] irq1: atkbd0
   11 c1559ab4    0     0     0 000020c [Can run] idle: cpu0
    1 c1559cd8    0     0     1 0004200 [SLPQ wait 0xc1559cd8][SLP] init
   10 c155e000    0     0     0 0000204 [SLPQ ktrace 0xc0932938][SLP] ktrace
    0 c0931fa0    0     0     0 0000200 [IWAIT] swapper
db> where 376
Tracing pid 376 tid 100065 td 0xc17df000
sched_switch(c17df000,0,1) at sched_switch+0x183
mi_switch(1,0) at mi_switch+0x274
sleepq_switch(c17b0e00,0,cf344c08,c064511a,c17b0e00) at sleepq_switch+0xe0
sleepq_wait_sig(c17b0e00,0,100,c087e354,1ff) at sleepq_wait_sig+0xc
msleep(c17b0e00,c098f6e0,158,c0863ed8,0) at msleep+0x302
nfssvc_nfsd(c17df000,c17dc4b0,1,c0869e8c,12e) at nfssvc_nfsd+0xe5
nfssvc(c17df000,cf344d04,c,c17df000,cf344d30) at nfssvc+0x18c
syscall(3b,3b,3b,1,0) at syscall+0x27e
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (155, FreeBSD ELF32, nfssvc), eip = 0x280b6bdb, esp = 0xbfbfeb1c, ebp = 0xbfbfeb38 ---
db> where 377
Tracing pid 377 tid 100070 td 0xc17dd7d0
sched_switch(c17dd7d0,0,1) at sched_switch+0x183
mi_switch(1,0) at mi_switch+0x274
sleepq_switch(c17b0c00,0,cf335c08,c064511a,c17b0c00) at sleepq_switch+0xe0
sleepq_wait_sig(c17b0c00,0,100,c087e354,1ff) at sleepq_wait_sig+0xc
msleep(c17b0c00,c098f6e0,158,c0863ed8,0) at msleep+0x302
nfssvc_nfsd(c17dd7d0,c17e0068,1,c0869e8c,12e) at nfssvc_nfsd+0xe5
nfssvc(c17dd7d0,cf335d04,c,c17dd7d0,cf335d30) at nfssvc+0x18c
syscall(3b,3b,3b,1,0) at syscall+0x27e
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (155, FreeBSD ELF32, nfssvc), eip = 0x280b6bdb, esp = 0xbfbfeb1c, ebp = 0xbfbfeb38 ---
db> where 379
Tracing pid 379 tid 100066 td 0xc17dde10
sched_switch(c17dde10,0,1) at sched_switch+0x183
mi_switch(1,0) at mi_switch+0x274
sleepq_switch(c17b0a00,0,cf341c08,c064511a,c17b0a00) at sleepq_switch+0xe0
sleepq_wait_sig(c17b0a00,0,100,c087e354,1ff) at sleepq_wait_sig+0xc
msleep(c17b0a00,c098f6e0,158,c0863ed8,0) at msleep+0x302
nfssvc_nfsd(c17dde10,c17dc6d4,1,c0869e8c,12e) at nfssvc_nfsd+0xe5
nfssvc(c17dde10,cf341d04,c,c17dde10,cf341d30) at nfssvc+0x18c
syscall(3b,3b,3b,1,0) at syscall+0x27e
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (155, FreeBSD ELF32, nfssvc), eip = 0x280b6bdb, esp = 0xbfbfeb1c, ebp = 0xbfbfeb38 ---
db> call doadump
Dumping 254 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 255MB (65072 pages) 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15 ... ok

Dump complete
= 0xf
db> reset

(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc0469cb3 in db_fncall (dummy1=0xc09adf40, dummy2=0x0, dummy3=0x0, dummy4=0xcf33e720 "L3d\017~83<3\220\a")
    at ../../../ddb/db_command.c:488
#2  0xc0469ab8 in db_command (last_cmdp=0xc091af04, cmd_table=0x0, aux_cmd_tablep=0xc08969d0, aux_cmd_tablep_end=0xc08969ec)
    at ../../../ddb/db_command.c:403
#3  0xc0469b80 in db_command_loop () at ../../../ddb/db_command.c:454
#4  0xc046b799 in db_trap (type=0x3, code=0x0) at ../../../ddb/db_main.c:228
#5  0xc0658b60 in kdb_trap (type=0x3, code=0x0, tf=0xcf33e8b8) at ../../../kern/subr_kdb.c:473
#6  0xc07fe7d0 in trap (frame=
      {tf_fs = 0xcf330008, tf_es = 0xc0650028, tf_ds = 0xc0860028, tf_edi = 0xc086ecd8, tf_esi = 0x1, tf_ebp = 0xcf33e8f8, tf_isp = 0xcf33e8e4, tf_ebx = 0xcf33e924, tf_edx = 0x0, tf_ecx = 0xc1033000, tf_eax = 0x12, tf_trapno = 0x3, tf_err = 0x0, tf_eip = 0xc06588c7, tf_cs = 0x20, tf_eflags = 0x80282, tf_esp = 0xcf33e918, tf_ss = 0xc063f16f}) at ../../../i386/i386/trap.c:610
#7  0xc07ebe4a in calltrap () at ../../../i386/i386/exception.s:139
#8  0xc06588c7 in kdb_enter (msg=0x12 <Address 0x12 out of bounds>) at cpufunc.h:60
#9  0xc063f16f in panic (fmt=0xc086ecd8 "lock (%s) %s not locked @ %s:%d") at ../../../kern/kern_shutdown.c:549
#10 0xc0663030 in witness_unlock (lock=0xc0934100, flags=0x8, file=0xc087e0bf "nfsserver/nfs_serv.c", line=0x891)
    at ../../../kern/subr_witness.c:1239
#11 0xc0637387 in _mtx_unlock_flags (m=0xc0934100, opts=0x0, file=0xc087e0b6 "../../../nfsserver/nfs_serv.c", line=0x891)
    at ../../../kern/kern_mutex.c:299
#12 0xc0727fc7 in nfsrv_mknod (nfsd=0xc1e1de00, slp=0xc1850980, td=0xc17ddc80, mrq=0xcf33ec3c) at ../../../nfsserver/nfs_serv.c:2193
#13 0xc0732f85 in nfssvc_nfsd (td=0x12) at ../../../nfsserver/nfs_syscalls.c:472
#14 0xc07328d4 in nfssvc (td=0xc17ddc80, uap=0xcf33ed04) at ../../../nfsserver/nfs_syscalls.c:181
#15 0xc07ff036 in syscall (frame=
      {tf_fs = 0x3b, tf_es = 0x3b, tf_ds = 0x3b, tf_edi = 0x1, tf_esi = 0x0, tf_ebp = 0xbfbfeb38, tf_isp = 0xcf33ed64, tf_ebx = 0x4, tf_edx = 0x281397d8, tf_ecx = 0x19, tf_eax = 0x9b, tf_trapno = 0xc, tf_err = 0x2, tf_eip = 0x280b6bdb, tf_cs = 0x33, tf_eflags = 0x296, tf_esp = 0xbfbfeb1c, tf_ss = 0x3b}) at ../../../i386/i386/trap.c:1001
#16 0xc07ebe9f in Xint0x80_syscall () at ../../../i386/i386/exception.s:200
#17 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) f 12
#12 0xc0727fc7 in nfsrv_mknod (nfsd=0xc1e1de00, slp=0xc1850980, td=0xc17ddc80, mrq=0xcf33ec3c) at ../../../nfsserver/nfs_serv.c:2193
2193          mtx_unlock(&Giant);       /* VFS */
(kgdb) info loc
mrep = (struct mbuf *) 0xc20b6b00
md = (struct mbuf *) 0xc2e77800
nam = (struct sockaddr *) 0xc2dc76cc
dpos = 0xc2e7781c ""...
cred = (struct ucred *) 0xc1e1de80
va = {va_type = VNON, va_mode = 0x180, va_nlink = 0xffff, va_uid = 0xffffffff, va_gid = 0xffffffff, va_fsid = 0xffffffff,
  va_fileid = 0xffffffff, va_size = 0xffffffffffffffff, va_blocksize = 0xffffffff, va_atime = {tv_sec = 0xffffffff, tv_nsec = 0xffffffff},
  va_mtime = {tv_sec = 0xffffffff, tv_nsec = 0xffffffff}, va_ctime = {tv_sec = 0xffffffff, tv_nsec = 0xffffffff}, va_birthtime = {
    tv_sec = 0xffffffff, tv_nsec = 0xffffffff}, va_gen = 0xffffffff, va_flags = 0xffffffff, va_rdev = 0xffffffff,
  va_bytes = 0xffffffffffffffff, va_filerev = 0x0, va_vaflags = 0x0, va_spare = 0x0}
dirfor = {va_type = VDIR, va_mode = 0x1ff, va_nlink = 0x5, va_uid = 0x3e9, va_gid = 0x0, va_fsid = 0x5c, va_fileid = 0x6879,
  va_size = 0x1200, va_blocksize = 0x4000, va_atime = {tv_sec = 0x435f6b26, tv_nsec = 0x0}, va_mtime = {tv_sec = 0x435f6b29,
    tv_nsec = 0x0}, va_ctime = {tv_sec = 0x435f6b29, tv_nsec = 0x0}, va_birthtime = {tv_sec = 0x4312f0c0, tv_nsec = 0x0},
  va_gen = 0x720c9cea, va_flags = 0x0, va_rdev = 0x35578, va_bytes = 0x1800, va_filerev = 0xecc49c9ac2, va_vaflags = 0x80246,
  va_spare = 0xc093b5c0}
diraft = {va_type = VDIR, va_mode = 0x1ff, va_nlink = 0x5, va_uid = 0x3e9, va_gid = 0x0, va_fsid = 0x5c, va_fileid = 0x6879,
  va_size = 0x1200, va_blocksize = 0x4000, va_atime = {tv_sec = 0x435f6b26, tv_nsec = 0x0}, va_mtime = {tv_sec = 0x435f6b29,
    tv_nsec = 0x0}, va_ctime = {tv_sec = 0x435f6b29, tv_nsec = 0x0}, va_birthtime = {tv_sec = 0x4312f0c0, tv_nsec = 0x0},
  va_gen = 0x720c9cea, va_flags = 0x0, va_rdev = 0x35578, va_bytes = 0x1800, va_filerev = 0xecc49c9ac2, va_vaflags = 0xc0650f57,
  va_spare = 0xc17ddc80}
tl = (u_int32_t *) 0x12
nd = {ni_dirp = 0xfc63966f <Address 0xfc63966f out of bounds>, ni_segflg = UIO_SYSSPACE, ni_startdir = 0x0, ni_rootdir = 0x94cc8408,
  ni_topdir = 0xfc63966f, ni_vp = 0x0, ni_dvp = 0x0, ni_pathlen = 0x1, ni_next = 0xc1a2a00d "", ni_loopcnt = 0xcf33ea9c, ni_cnd = {
    cn_nameiop = 0x1, cn_flags = 0xc0d00c, cn_thread = 0xc17ddc80, cn_cred = 0xc1e1de80, cn_lkflags = 0x2,
    cn_pnbuf = 0xc1a2a000 "fifo.11186.38", cn_nameptr = 0xc1a2a000 "fifo.11186.38", cn_namelen = 0xd, cn_consume = 0x0}}
bpos = 0x3 <Address 0x3 out of bounds>
error = 0x11
len = 0xd
dirfor_ret = 0x0
diraft_ret = 0x0
major = 0x0
vtyp = 17
mb = (struct mbuf *) 0xc086e86d
mreq = (struct mbuf *) 0x12
vp = (struct vnode *) 0xc2dc76cc
dirp = (struct vnode *) 0xc18136cc
nfh = {fh_generic = {fh_fsid = {val = {0x40c7709e, 0xfc9c93c9}}, fh_fid = {fid_len = 0xc, fid_reserved = 0x0,
      fid_data = "yh\000\000\234\fr\000\000\000\000\000\000\000"}},
  fh_bytes = "\236p@\223\234\f\000\000\000yh\000\000\234\fr\000\000\000\000\000\000\000\000\0303\a\033e\200}\v\000\000\000@U\200}\220}\202\000\b\000W\017e\200}@U\021X}\200}\2043ϼTd\200}@U\006\000\000\0004\200;E\024\000\220}Q\"\000\000\b\204\224"}
mp = (struct mount *) 0xc1787400
v3 = 0x8