umount/ls panic

[Thomas E. Spanjaard]

Nicolas Thery wrote:
2007/10/4, Petr Janda <elekktretterr at exemail.com.au>:

Hi Matt and the rest,
I just discovered a new bug. What happened is this:
ad3s2 is mount on /mnt/windows

i mounted fat32 fs (ad3s3) over /mnt/windows

cd /mnt/windows, then force umount of /mnt/windows. if you dont get a panic
yet, try ls the directory you are in (mnt windows) and get this panic:
http://www.punchyouremployer.com/images/p1000675.jpg


This bug is not related to fat32.  It can for example be reproduced with /proc:

cd /proc
umount -f /proc
ls (or any external command)
It can also be reproduced w/o force unmount:

sleep 30 &
cd /proc/$!
... wait for 30s or kill the sleep process ...
ls (or any external command)
When forking ls, fdcopy() calls vref() on fd_cdir but the latter was
inactivated earlier during unmounting (vflush()).  This triggers the
assertion in vref().
I don't know how to fix this.  As an experiment, I tried setting
fd_cdir to NULL if VINACTIVE is set but this triggers a crash at
boot-time.  Maybe the assertion should be relaxed, for this case only,
to:
KKASSERT(vp->v_sysref.refcnt > 0 && (vp->v_flag & VFREE) == 0);

Any advice?
Ideally, the umount shouldn't be able to succeed because it's still open 
as CWD for someone.

Cheers,
--
        Thomas E. Spanjaard
        tgen at netphreax.net
Attachment:
signature.asc
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pgp00002.pgp
Type: application/octet-stream
Size: 186 bytes
Desc: "Description: OpenPGP digital signature"
URL: <http://lists.dragonflybsd.org/pipermail/bugs/attachments/20071021/1157bcca/attachment-0022.obj>