Re: mountd segfault on itanium2

[Garrick Staples <garrick@usc.edu>]

[-- Attachment #1: Type: text/plain, Size: 1779 bytes --]

On Fri, Apr 30, 2004 at 02:24:14PM -0700, Garrick Staples alleged:
> Hi all,
>    I'm having a terrible time with mountd segfaulting on two Itanium boxes.  I
> can't find a specific trigger, but I can generally trigger it within a few
> minutes by just calling mount/umount a few hundred times.
> 
> I'm using glibc 2.3.2 and nfs-utils 1.0.6 from RHE.
> 
> In the tests below, I have a single directory exported to 10.125.0.0/16.  Since
> I know name resolution was a recent problem, I've made sure all clients are in
> /etc/hosts.  I'm using NIS, but files is before dns and nis in nsswitch.conf.
> I've also tested with and without nscd running.

> select(1024, [3 4 5 6 7], NULL, NULL, NULL) = 2 (in [5 6])
> read(5, "", 0)                          = 0
> --- SIGSEGV (Segmentation fault) @ 20000008002c19d0 (63742f3132353111) ---

> write(5, "10.125.0.0/16 0 \\x00080011020000"..., 62) = 62
> --- SIGSEGV (Segmentation fault) @ 20000000002899d0 (7064752f35343639) ---


I just spotted a pattern.  After collecting several strace samples, it always
segfaults after read() or write() to fd 5.  And fd 5 is always:

   open("/proc/net/rpc/nfsd.fh/channel", O_RDWR) = 5

I have no idea what the file is for, but grep'ing my straces shows that mountd
doesn't normally use it.  It can handle hundreds of mount/umount requests
without ever touching fd 5.  Then at some point it reads once:

   read(5, "10.125.0.0/16 0 \\x00080011020000"..., 128) = 35

If it doesn't segfault on the read(), it might segfault on a write() very soon
after:

   write(5, "10.125.0.0/16 0 \\x00080011020000"..., 62) = 62


Thanks in advance to anyone that knows what's going on.

-- 
Garrick Staples, Linux/HPCC Administrator
University of Southern California

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]