Date: Fri, 04 Nov 2005 17:12:11 +0100 From: Andre Oppermann <andre@freebsd.org> To: current@FreeBSD.org Cc: glebius@freebsd.org, Kris Kennaway <kris@obsecurity.org> Subject: Re: panic: mb_dtor_pack: ref_cnt != 1 Message-ID: <436B885B.6010609@freebsd.org> In-Reply-To: <436B70FA.3080401@freebsd.org> References: <20051104092724.GA33945@xor.obsecurity.org> <436B70FA.3080401@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Andre Oppermann wrote:
> Kris Kennaway wrote:
>
>> I got this panic shortly after boot on a freshly-updated amd64
>> machine:
>>
>> FreeBSD/amd64 (fbsd-amd64.isc.org) (ttyd0)
>>
>> login: panic: mb_dtor_pack: ref_cnt != 1
>> cpuid = 3
>> KDB: enter: panic
>> [thread pid 1021 tid 100131 ]
>> Stopped at kdb_enter+0x31: leave
>> db> wh
>> Tracing pid 1021 tid 100131 td 0xffffff0323816a40
>> kdb_enter() at kdb_enter+0x31
>> panic() at panic+0x1e6
>> mb_dtor_pack() at mb_dtor_pack+0x103
>> uma_zfree_arg() at uma_zfree_arg+0x34
>> mb_free_ext() at mb_free_ext+0xe9
>> soreceive() at soreceive+0xafb
>> soo_read() at soo_read+0x5e
>> dofileread() at dofileread+0x9e
>> kern_readv() at kern_readv+0x4f
>> read() at read+0x4b
>> syscall() at syscall+0x350
>> Xfast_syscall() at Xfast_syscall+0xa8
>> --- syscall (3, FreeBSD ELF64, read), rip = 0x800b7e23c, rsp =
>> 0x7fffffffe1a8, rbp = 0x400 ---
>
>
> This should fix it. Commit in half an hour.
Ok, thanks to Danny Braniss and Peter Holm the KASSERT is working now.
--
Andre
Index: kern/uipc_mbuf.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/uipc_mbuf.c,v
retrieving revision 1.156
diff -u -p -r1.156 uipc_mbuf.c
--- kern/uipc_mbuf.c 2 Nov 2005 16:20:35 -0000 1.156
+++ kern/uipc_mbuf.c 4 Nov 2005 16:09:07 -0000
@@ -215,9 +215,11 @@ mb_free_ext(struct mbuf *m)
/* Free attached storage if this mbuf is the only reference to it. */
if (*(m->m_ext.ref_cnt) == 1 ||
- atomic_fetchadd_int(m->m_ext.ref_cnt, -1) == 1) {
+ atomic_fetchadd_int(m->m_ext.ref_cnt, -1) == 0) {
switch (m->m_ext.ext_type) {
- case EXT_CLUSTER:
+ case EXT_CLUSTER: /* The packet zone is special. */
+ if (*(m->m_ext.ref_cnt) == 0)
+ *(m->m_ext.ref_cnt) = 1;
uma_zfree(zone_pack, m);
return; /* Job done. */
break;
Index: kern/kern_mbuf.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/kern_mbuf.c,v
retrieving revision 1.12
diff -u -p -r1.12 kern_mbuf.c
--- kern/kern_mbuf.c 2 Nov 2005 16:20:35 -0000 1.12
+++ kern/kern_mbuf.c 4 Nov 2005 16:09:07 -0000
@@ -395,11 +395,10 @@ mb_ctor_clust(void *mem, int size, void
static void
mb_dtor_clust(void *mem, int size, void *arg)
{
- u_int *refcnt;
- refcnt = uma_find_refcnt(zone_clust, mem);
- KASSERT(*refcnt == 1, ("%s: refcnt incorrect %u", __func__, *refcnt));
- *refcnt = 0;
+ KASSERT(*(uma_find_refcnt(zone_clust, mem)) <= 1,
+ ("%s: refcnt incorrect %u", __func__,
+ *(uma_find_refcnt(zone_clust, mem))) );
#ifdef INVARIANTS
trash_dtor(mem, size, arg);
#endif
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?436B885B.6010609>