kern/59229: Occasional crash on forced umount of nfs file system

[vezhlys%gmail.com@localhost]

>Number:         59229
>Category:       kern
>Synopsis:       Occasional crash on forced umount of nfs file system
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 28 13:00:00 +0000 2025
>Originator:     Andrius V
>Release:        NetBSD 10
>Organization:
>Environment:
>Description:
I get an occasional crash when forcibly unmounting my NFS file system
(nfs -f <pathtonfs>), which seems to be a null pointer dereference. Unfortunately, I don't have a easily reproducible flow, but it happens after longer usage period, sometimes PC is just idle for hours, but likely I was using NFS mount during some period in between.

bt:
uvm_fault(0xffffffff819592a0, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip 0xffffffff80c21afd cs 0x8 rflags 0x10282 cr2 0x80 ilevel 0 rsp 0xffffb392726bbed0
curlwp 0xfffffdb77ad3eb00 pid 0.3676 lowest kstack 0xffffb392726b72c0
panic: trap
cpu5: Begin traceback...
vpanic() at netbsd:vpanic+0x183
panic() at netbsd:panic+0x3c
trap() at netbsd:trap+0xb27
--- trap (number 6) ---
nfs_getattrcache() at netbsd:nfs_getattrcache+0x14
nfs_kqpoll() at netbsd:nfs_kqpoll+0x66
cpu5: End traceback...
>How-To-Repeat:

>Fix:
mlelstv proposed fix in https://nxr.netbsd.org/xref/src/sys/nfs/nfs_clntsubs.c?r=1.7#323:

-       if (np->n_attrstamp == 0 ||
+       if (np == NULL ||
+           np->n_attrstamp == 0 ||


The only problem that I don't have an easily reproducible flow (except "long" usage), thus I would likely need to apply it with some logging and test for some time.