https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=204340
--- Comment #15 from commit-h...@freebsd.org --- A commit references this bug: Author: rmacklem Date: Sat Nov 21 23:55:46 UTC 2015 New revision: 291150 URL: https://svnweb.freebsd.org/changeset/base/291150 Log: When the nfsd threads are terminated, the NFSv4 server state (opens, locks, etc) is retained, which I believe is correct behaviour. However, for NFSv4.1, the server also retained a reference to the xprt (RPC transport socket structure) for the backchannel. This caused svcpool_destroy() to not call SVC_DESTROY() for the xprt and allowed a socket upcall to occur after the mutexes in the svcpool were destroyed, causing a crash. This patch fixes the code so that the backchannel xprt structure is dereferenced just before svcpool_destroy() is called, so the code does do an SVC_DESTROY() on the xprt, which shuts down the socket upcall. Tested by: g_amana...@yahoo.com PR: 204340 MFC after: 2 weeks Changes: head/sys/fs/nfs/nfs_var.h head/sys/fs/nfsserver/nfs_nfsdkrpc.c head/sys/fs/nfsserver/nfs_nfsdstate.c -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ freebsd-bugs@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-bugs To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"