From owner-freebsd-current@FreeBSD.ORG Sun Jul 18 15:03:21 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7C61916A4CE for ; Sun, 18 Jul 2004 15:03:21 +0000 (GMT) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1624943D31 for ; Sun, 18 Jul 2004 15:03:21 +0000 (GMT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (localhost [127.0.0.1]) by fledge.watson.org (8.12.11/8.12.11) with ESMTP id i6IF2q0o010935; Sun, 18 Jul 2004 11:02:52 -0400 (EDT) (envelope-from robert@fledge.watson.org) Received: from localhost (robert@localhost)i6IF2qwX010932; Sun, 18 Jul 2004 11:02:52 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Sun, 18 Jul 2004 11:02:52 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Willem Jan Withagen In-Reply-To: <0f4201c46ccf$61de5f90$471b3dd4@digiware.nl> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: current@freebsd.org Subject: Re: panic: Duplicate free of item 0xffffff005c4a8600 from zone 0xffffff007fed4780(Mbuf) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Jul 2004 15:03:21 -0000 On Sun, 18 Jul 2004, Willem Jan Withagen wrote: > Started running with debug.mpsafe=1. Not shure if it has anything to do > with it.... It might well do, but here are some things to try: - See if you can reproduce this with your exact some configuration in a few runs. If you can, then we should try some other configurations. - Try it with debug.mpsafenet=0 and see if the problem "goes away" for a few runs. - Try compiling IPv6 out of your kernel -- this will turn on the inpcb locking assertions, which are compiled out by default because IPv4 and IPv6 share the same underlying pcb code and IPv6 does not yet lock that correctly in CVS. I have patches that do quite a bit of that in Perforce, and sent out an e-mail yesterday to the KAME folk to talk about merging strategies. - If this is a reproduceable problem, could you try disabling SACK and see if it changes at all? I'll do some review of the TCP reassembly and queue bits, it could well be that we're missing some locking here. Nicely configured system, btw. :-) BTW, I noticed that there are some bge0 warnings at the end of the dmesg -- is that indicative of some other problem with the driver on the system, and/or is bge0 used in your active configuration? Thanks for the nice bundling of config information, btw -- it answered a number of my questions up front quite nicely. Thanks, Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Principal Research Scientist, McAfee Research > > While running configure over NFS: > > Slab at 0xffffff005c4a8fb8, freei 6 = 0. > panic: Duplicate free of item 0xffffff005c4a8600 from zone 0xffffff007fed4780(Mb > uf) > > cpuid = 1; > KDB: stack backtrace: > kdb_backtrace() at kdb_backtrace+0x34 > panic() at panic+0x1d2 > uma_dbg_free() at uma_dbg_free+0x112 > uma_zfree_arg() at uma_zfree_arg+0x10a > mb_free_ext() at mb_free_ext+0x96 > m_freem() at m_freem+0x28 > tcp_reass() at tcp_reass+0x1bb > tcp_input() at tcp_input+0x2af9 > ip_input() at ip_input+0x94c > netisr_processqueue() at netisr_processqueue+0x8c > swi_net() at swi_net+0xe8 > ithread_loop() at ithread_loop+0x18d > fork_exit() at fork_exit+0xc9 > fork_trampoline() at fork_trampoline+0xe > --- trap 0, rip = 0, rsp = 0xffffffffb0bb5d00, rbp = 0 --- > KDB: enter: panic > [thread 100017] > Stopped at kdb_enter+0x2e: nop > > Coredump available.... 61Mb compressed. > > system contains a de card, which is correctly identified as > GIANT-LOCKED. The card is not connected. Next time I open up the box, > I'll remove it. > > system info available at: > http://withagen.dyndns.org/FreeBSD/cores/*.opteron > > --WjW > >