Re: kern/48212: modunload(8) for nfsserver leaves a dangling callout scheduled

[Paul Goyette <paul%whooppee.com@localhost>]

> > The nfs timer callout should be diesatablished by
> > nfsserver_modcmd(MODULE_CMD_FINI) ->nfs_fini()->nfs_timer_fini().

I think I have identified the problem:

1. When unloading the nfsserver module, nfsserver_modcmd() eventually 
calls nfs_fini().

2. nfs_fini() calls nfs_timer_fini()

3. nfs_timer_fini() destroys the nfs_timer_lock mutex

4. At some future time, the scheduled nfs_timer call-out fires, and it 
tries to obtain the nfs_timer_lock mutex in order to check whether or 
not server-side processing is needed (by checking nfs_timer_srvvec)

5. Since the mutex has been destroyed, it is no longer valid to attempt 
to acquire it.

Looking at the code, it would seem that nfs_fini() is intended only for 
use in nfs client processing, and should NOT be called by nfs server 
code.  We already have nfsrv_fini() for closing down the server, and it 
is already being called.



-------------------------------------------------------------------------
| Paul Goyette     | PGP Key fingerprint:     | E-mail addresses:       |
| Customer Service | FA29 0E3B 35AF E8AE 6651 | paul at whooppee.com    |
| Network Engineer | 0786 F758 55DE 53BA 7731 | pgoyette at juniper.net |
| Kernel Developer |                          | pgoyette at netbsd.org  |
-------------------------------------------------------------------------