Re: kern/48212: modunload(8) for nfsserver leaves a dangling callout scheduled

[Paul Goyette <paul%whooppee.com@localhost>]

The following reply was made to PR kern/48212; it has been noted by GNATS.

From: Paul Goyette <paul%whooppee.com@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, 
netbsd-bugs%netbsd.org@localhost, 
    martin%netbsd.org@localhost
Subject: Re: kern/48212: modunload(8) for nfsserver leaves a dangling callout
 scheduled
Date: Sun, 15 Sep 2013 20:29:07 -0700 (PDT)

 >> The nfs timer callout should be diesatablished by
 >> nfsserver_modcmd(MODULE_CMD_FINI) ->nfs_fini()->nfs_timer_fini().
 
 I think I have identified the problem:
 
 1. When unloading the nfsserver module, nfsserver_modcmd() eventually 
 calls nfs_fini().
 
 2. nfs_fini() calls nfs_timer_fini()
 
 3. nfs_timer_fini() destroys the nfs_timer_lock mutex
 
 4. At some future time, the scheduled nfs_timer call-out fires, and it 
 tries to obtain the nfs_timer_lock mutex in order to check whether or 
 not server-side processing is needed (by checking nfs_timer_srvvec)
 
 5. Since the mutex has been destroyed, it is no longer valid to attempt 
 to acquire it.
 
 Looking at the code, it would seem that nfs_fini() is intended only for 
 use in nfs client processing, and should NOT be called by nfs server 
 code.  We already have nfsrv_fini() for closing down the server, and it 
 is already being called.
 
 
 
 -------------------------------------------------------------------------
 | Paul Goyette     | PGP Key fingerprint:     | E-mail addresses:       |
 | Customer Service | FA29 0E3B 35AF E8AE 6651 | paul at whooppee.com    |
 | Network Engineer | 0786 F758 55DE 53BA 7731 | pgoyette at juniper.net |
 | Kernel Developer |                          | pgoyette at netbsd.org  |
 -------------------------------------------------------------------------