Re: mountd segfault on itanium2

[Garrick Staples <garrick@usc.edu>]

[-- Attachment #1: Type: text/plain, Size: 2259 bytes --]

On Mon, May 03, 2004 at 05:17:18PM -0700, Garrick Staples alleged:
> On Fri, Apr 30, 2004 at 08:07:30PM -0700, Garrick Staples alleged:
> > On Fri, Apr 30, 2004 at 04:43:27PM -0700, Garrick Staples alleged:
> > > I just spotted a pattern.  After collecting several strace samples, it always
> > > segfaults after read() or write() to fd 5.  And fd 5 is always:
> > > 
> > >    open("/proc/net/rpc/nfsd.fh/channel", O_RDWR) = 5
> > 
> > I have an ugly work-around that seems to be working.  It seems that 2.6 has a
> > new nfs interface for userspace.  By forcing mountd to use the older 2.4
> > interface, it doesn't segfault anymore.  So something in the new code paths is
> > broken.
> 
> I'm slowly starting to wrap my brain around how these RPC calls work.  I've
> found something that I can't make sense of.  In my_svc_run(), it packs fds 3,
> 4, 5, 6, and 7 into select().  3, 4, and 5 are 3 files in /proc/net/rpc.  fd 6
>  and 7 are udp and tcp sockets.  During my umount/mount tests, fd 6 is the
> only set bit after the select(), and is then passed to svc_getreqset().
> 
> But just before the segfault, select() sets fd 5, which is
> /proc/net/rpc/nfsd.fh/channel.  The thing that I don't understand is that fd 5
> is being passed to svc_getreqset().  Shouldn't svc_getreqset() be only for fds
> of sockets that have pending rpc calls?  Should fd 5 be cleared from the fdset
> before calling svc_getreqset()?

Going with this theory, I added a FD_CLR to clear those bits and it seems to
have fixed the problem.  I've no idea the ramification of this fix, but
everything seems to be working.  Anyone know if this is really bad?


diff -ruN utils/mountd/cache.c_orig utils/mountd/cache.c
--- utils/mountd/cache.c_orig   2004-05-03 18:07:26.257126950 -0700
+++ utils/mountd/cache.c        2004-05-03 18:07:28.639939421 -0700
@@ -317,6 +317,7 @@
                    FD_ISSET(fileno(cachelist[i].f), readfds)) {
                        cnt++;
                        cachelist[i].cache_handle(cachelist[i].f);
+                       FD_CLR(fileno(cachelist[i].f), readfds);
                }
        }
        return cnt;



-- 
Garrick Staples, Linux/HPCC Administrator
University of Southern California

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]