From owner-freebsd-bugs@FreeBSD.ORG Thu Jun 7 15:30:05 2007 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 2FBAD16A400 for ; Thu, 7 Jun 2007 15:30:05 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id 0ABD713C45B for ; Thu, 7 Jun 2007 15:30:05 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l57FU283090183 for ; Thu, 7 Jun 2007 15:30:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l57FU2Qw090181; Thu, 7 Jun 2007 15:30:02 GMT (envelope-from gnats) Resent-Date: Thu, 7 Jun 2007 15:30:02 GMT Resent-Message-Id: <200706071530.l57FU2Qw090181@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Kena Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 9E0CA16A400 for ; Thu, 7 Jun 2007 15:25:47 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [69.147.83.33]) by mx1.freebsd.org (Postfix) with ESMTP id 77A8613C44B for ; Thu, 7 Jun 2007 15:25:47 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l57FPlHw094449 for ; Thu, 7 Jun 2007 15:25:47 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id l57FPlOs094448; Thu, 7 Jun 2007 15:25:47 GMT (envelope-from nobody) Message-Id: <200706071525.l57FPlOs094448@www.freebsd.org> Date: Thu, 7 Jun 2007 15:25:47 GMT From: Kena To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.0 Cc: Subject: kern/113457: Deadlock X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jun 2007 15:30:05 -0000 >Number: 113457 >Category: kern >Synopsis: Deadlock >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Jun 07 15:30:02 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Kena >Release: 7.0-CURRENT >Organization: >Environment: FreeBSD fungus.kahlua 7.0-CURRENT FreeBSD 7.0-CURRENT #3: Fri Jun 1 10:49:34 CEST 2007 root@fungus.kahlua:/usr/obj/usr/src/sys/FUNGUS i386 >Description: Using a tunnel to access ipv6 (gw6c from www.go6.net): a deadlock occurs if the tunnel goes down while there are tcp6 connections opened. Sample panic report on this system: em0: watchdog timeout -- resetting Jun 7 10:17:21 fungus gw6c: Connection timeout occured. Jun 7 10:17:21 fungus gw6c: Disconnected. Retrying in 30 seconds. em0: watchdog timeout -- resetting lock order reversal: 1st 0xc30630d8 rtentry (rtentry) @ /usr/src/sys/netinet6/nd6.c:1963 2nd 0xc2ed977c radix node head (radix node head) @ /usr/src/sys/net/route.c:147 KDB: stack backtrace db_trace_self_wrapper(....) at db_trace_self_wrapper+0x26 kdb_backtrace(...) at kbd_backtrace+0x29 witness_checkorder(...) at witness_checkorder+0x6b7 _mtx_lock_flags(...) at _mtx_lock_flags+0xb0 rtalloc1(...) at rtalloc1+0x60 nd6_lookup(...) at nd6_loockup+0x55 nd6_is_addr_neighbor(...) at nd6_is_addr_neighbor+0x37 nd6_output(...) at nd6_output+0x10d ip6_output(...) at ip6_output+0x108a tcp_output(...) at tcp_output+0x12b3 tcp_timer(...) at tcp_timer+0x2ad softclock(...) at softclock+0x293 ithread_loop(...) at ithread_loop+0x1a8 fork_exit(...) at fork_exit+0xed fork_trampoline() at fork_trampoline+0x8 --- trap 0, eip = 0, esp = 0xd3c81d70, ebp = 0 --- panic: _mtx_lock_sleep: recursed on non-recursive mutex rtentry @ /usr/src/sys/net/route.c:197 cpuid = 0 KBD: enter: panic [thread pid 11 tid 100004 ] Stopped at kbd_enter+0x32: leave db> Configuration for kernel "FUNGUS" is GENERIC from 7.0-CURRENT with cpu I486_CPU and I586_CPU disabled. >How-To-Repeat: 1. set up a ip6 link with gw6c (from www.go6.net), "router" mode 2. open a tcp6 connection (for example irssi -c ipv6.chat.freenode.net) 3. break the network link (pull ethernet cable) 4. wait for gw6c to timeout A few seconds after gw6c reports the disconnect on the console the panic occurs. Crash 100% reproducible. >Fix: >Release-Note: >Audit-Trail: >Unformatted: