From owner-freebsd-current@freebsd.org Mon Jan 29 02:39:02 2018 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id DC615ECED5D for ; Mon, 29 Jan 2018 02:39:01 +0000 (UTC) (envelope-from cy.schubert@cschubert.com) Received: from smtp-out-so.shaw.ca (smtp-out-so.shaw.ca [64.59.136.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "Client", Issuer "CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4B33D7A647; Mon, 29 Jan 2018 02:39:01 +0000 (UTC) (envelope-from cy.schubert@cschubert.com) Received: from spqr.komquats.com ([96.50.22.10]) by shaw.ca with ESMTPA id fzLPeNciES7BpfzLReqHli; Sun, 28 Jan 2018 19:38:54 -0700 X-Authority-Analysis: v=2.2 cv=NKylwwyg c=1 sm=1 tr=0 a=jvE2nwUzI0ECrNeyr98KWA==:117 a=jvE2nwUzI0ECrNeyr98KWA==:17 a=kj9zAlcOel0A:10 a=RgaUWeydRksA:10 a=6I5d2MoRAAAA:8 a=pGLkceISAAAA:8 a=mDV3o1hIAAAA:8 a=9qJtDzCHAAAA:8 a=JAf30KXuAAAA:8 a=YxBL1-UpAAAA:8 a=kdC8WTYPHP6gL9xq4AUA:9 a=R3zDdWJ5I0K4Q6Qf:21 a=mviYWmmLeBl4YPNk:21 a=g6CZkk0KmXVHpAYe:21 a=CjuIK1q_8ugA:10 a=IjZwj45LgO3ly-622nXo:22 a=_FVE-zBwftR9WsbkzFJk:22 a=hiAHZcYKRbsBqHOmy6e6:22 a=GEL62FyrTCmHtEug2d3R:22 a=Ia-lj3WSrqcvXOmTRaiG:22 Received: from slippy.cwsent.com (slippy [10.1.1.91]) by spqr.komquats.com (Postfix) with ESMTPS id E38FE3389; Sun, 28 Jan 2018 18:38:50 -0800 (PST) Received: from slippy.cwsent.com (localhost [127.0.0.1]) by slippy.cwsent.com (8.15.2/8.15.2) with ESMTP id w0T2coKY053085; Sun, 28 Jan 2018 18:38:50 -0800 (PST) (envelope-from Cy.Schubert@cschubert.com) Received: from slippy (cy@localhost) by slippy.cwsent.com (8.15.2/8.15.2/Submit) with ESMTP id w0T2co4M053082; Sun, 28 Jan 2018 18:38:50 -0800 (PST) (envelope-from Cy.Schubert@cschubert.com) Message-Id: <201801290238.w0T2co4M053082@slippy.cwsent.com> X-Authentication-Warning: slippy.cwsent.com: cy owned process doing -bs X-Mailer: exmh version 2.8.0 04/21/2012 with nmh-1.7 Reply-to: Cy Schubert From: Cy Schubert X-os: FreeBSD X-Sender: cy@cwsent.com X-URL: http://www.cschubert.com/ To: Allan Jude cc: freebsd-current@freebsd.org Subject: Re: Panic on shutdown @r328436: "Unholding 6 with cnt = -559038242" In-Reply-To: Message from Allan Jude of "Sun, 28 Jan 2018 20:40:22 -0500." <2effa324-c428-6135-371b-acb00c803d29@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Sun, 28 Jan 2018 18:38:50 -0800 X-CMAE-Envelope: MS4wfCPAOJDx3PwxEOo7uw89dBbOx8rWv+O7hN05J3B66xJ99zGqAigm0j57P5Xd2CW1cJhwTKKsO24lmcQId2SO/QHKfH3/Jl5pFXdHpUKy1uctp0KaqClh BXgvUmbyg6brysehuX6+IopO3cPjGS7P8RC+nRl5UjyChXjjPFOQyJYNOuHHP3xal16uBxy88uqdckI/OiISg+cA35q27AAs1IQVOrH+XQc2ujkTS8ZqMMw8 X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jan 2018 02:39:02 -0000 In message <2effa324-c428-6135-371b-acb00c803d29@freebsd.org>, Allan Jude write s: > On 2018-01-28 16:28, Warner Losh wrote: > > On Sun, Jan 28, 2018 at 2:22 PM, thomas masper > > wrote: > > > >> Hi, > >> similar panic happen to me when extracting a pendrive from laptop USB port > >> (I tried 3 different pendrive). > >> No issue if I reboot or shutdown. I don't know if those two issues are > >> related. > >> > > > > Do you have a reproducible test case? Ideally, it would be 'insert and > > remove usb thumb drive' but maybe there's more steps between insert and > > removal. > > > > Warner > > > > > > > >> panic: Releasing 6 with cnt = -559038242 Converting this to hex we get DEADC0DE. > >> > >> GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD] > >> Copyright (C) 2017 Free Software Foundation, Inc. > >> License GPLv3+: GNU GPL version 3 or later >> html > >>> > >> This is free software: you are free to change and redistribute it. > >> There is NO WARRANTY, to the extent permitted by law. Type "show copying" > >> and "show warranty" for details. > >> This GDB was configured as "x86_64-portbld-freebsd12.0". > >> Type "show configuration" for configuration details. > >> For bug reporting instructions, please see: > >> . > >> Find the GDB manual and other documentation resources online at: > >> . > >> For help, type "help". > >> Type "apropos word" to search for commands related to "word"... > >> Reading symbols from /boot/kernel/kernel...Reading symbols from > >> /usr/lib/debug//boot/kernel/kernel.debug...done. > >> done. > >> > >> Unread portion of the kernel message buffer: > >> da0 at umass-sim0 bus 0 scbus4 target 0 lun 0 > >> da0: s/n 30E47C20 detached > >> (da0:umass-sim0:0:0:0): Periph destroyed > >> panic: Releasing 6 with cnt = -559038242 > >> cpuid = 0 > >> time = 1517158352 > >> KDB: stack backtrace: > >> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame > >> 0xfffffe00593838c0 > >> vpanic() at vpanic+0x18d/frame 0xfffffe0059383920 > >> panic() at panic+0x43/frame 0xfffffe0059383980 > >> dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0 > >> g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00593839d0 > >> g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0 > >> g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30 > >> g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70 > >> fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0 > >> fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0 > >> --- trap 0, rip = 0, rsp = 0, rbp = 0 --- > >> KDB: enter: panic > >> > >> __curthread () at ./machine/pcpu.h:229 > >> 229 __asm("movq %%gs:%1,%0" : "=r" (td) > >> (kgdb) #0 __curthread () at ./machine/pcpu.h:229 > >> #1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346 > >> #2 0xffffffff8040a08b in db_dump (dummy=, > >> dummy2=, dummy3=, dummy4=) > >> at /usr/src/sys/ddb/db_command.c:574 > >> #3 0xffffffff80409e59 in db_command (last_cmdp=, > >> cmd_table=, dopager=) > >> at /usr/src/sys/ddb/db_command.c:481 > >> #4 0xffffffff80409bd4 in db_command_loop () > >> at /usr/src/sys/ddb/db_command.c:534 > >> #5 0xffffffff8040cdff in db_trap (type=, code= >> out>) > >> at /usr/src/sys/ddb/db_main.c:250 > >> #6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf= >> out>) > >> at /usr/src/sys/kern/subr_kdb.c:697 > >> #7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0) > >> at /usr/src/sys/amd64/amd64/trap.c:547 > >> #8 > >> #9 kdb_enter (why=0xffffffff811f101e "panic", msg=) > >> at /usr/src/sys/kern/subr_kdb.c:479 > >> #10 0xffffffff80ac8d3a in vpanic (fmt=, > >> ap=0xfffffe0059383960) > >> at /usr/src/sys/kern/kern_shutdown.c:800 > >> #11 0xffffffff80ac8dc3 in panic ( > >> fmt=0xffffffff81b1bbd8 "\257\257\033\201\377\377\377\ > >> 377") > >> at /usr/src/sys/kern/kern_shutdown.c:738 > >> #12 0xffffffff80368bb2 in da_periph_release (periph=, > >> token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591 > >> #13 dadiskgonecb (dp=) at > >> /usr/src/sys/cam/scsi/scsi_da.c:1904 > >> #14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700) > >> at /usr/src/sys/geom/geom_disk.c:783 > >> #15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700) > >> at /usr/src/sys/geom/geom_subr.c:746 > >> #16 0xffffffff80a15e17 in g_wither_washer () > >> at /usr/src/sys/geom/geom_subr.c:461 > >> #17 0xffffffff80a112da in g_run_events () > >> at /usr/src/sys/geom/geom_event.c:297 > >> #18 0xffffffff80a89444 in fork_exit ( > >> callout=0xffffffff80a138c0 , arg=0x0, > >> frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039 > >> #19 > >> (kgdb) > >> > >> > >> uname -a > >> FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13 > >> r328509M: Sun Jan 28 15:38:35 CET 2018 > >> tommy@laptopW530.tommyBSD.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC > >> amd64 > >> > >> Regards, > >> thomas > >> > >> > >> On Fri, Jan 26, 2018 at 4:07 PM, David Wolfskill > >> wrote: > >> > >>> On Fri, Jan 26, 2018 at 07:47:48AM -0700, Warner Losh wrote: > >>>> On Fri, Jan 26, 2018 at 5:29 AM, David Wolfskill >>> > >>>> wrote: > >>>> > >>>>> This is on my "build machine" (laptop is still building updated ports > >>>>> for today, so I don't know yet whether or not it encounters this.) > >>>>> > >>>> > >>>> Running a kernel with INVARIANTS, right? > >>> > >>> Yes -- GENERIC. > >>> > >>>>> I had performed a source-based update from r328393 to r328436, > >>>>> rebooted, performed "make delete-old-libs", and all seemed well. > >>>>> > >>>> > >>>> This has my change 328415 in it. > >>> > >>> :-) > >>> > >>>>> I then issued "sudo shutdown -p now", and serial console shows: > >>>>> panic: Unholding 6 with cnt = -559038242 > >>>>> cpuid = 3 > >>>>> time = 1516968697 > >>>>> KDB: stack backtrace: > >>>>> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame > >>>>> 0xfffffe00004288c0 > >>>>> vpanic() at vpanic+0x18d/frame 0xfffffe0000428920 > >>>>> panic() at panic+0x43/frame 0xfffffe0000428980 > >>>>> dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0 > >>>>> g_disk_providergone() at g_disk_providergone+0x25/frame > >>> 0xfffffe00004289d0 > >>>>> g_destroy_provider() at g_destroy_provider+0xae/frame > >>> 0xfffffe00004289f0 > >>>>> g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30 > >>>>> g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70 > >>>>> fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0 > >>>>> fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0 > >>>>> --- trap 0, rip = 0, rsp = 0, rbp = 0 --- > >>>>> KDB: enter: panic > >>>>> [ thread pid 13 tid 100044 ] > >>>>> Stopped at kdb_enter+0x3b: movq $0,kdb_why > >>>>> db> > >>>>> > >>>> > >>>> That's no good. We're releasing a reference to the da peripheral > >> because > >>>> geom has finished with the disk and is giving us a final callback so we > >>> can > >>>> drop the reference we took when we created the geom. Trouble is, cnt > >>> should > >>>> be like 1 always for this code, but it's not. It looks like it may be > >>> bytes > >>>> to a pointer :( > >>>> > >>>> > >>>>> As noted, this is a build machine, and it was to be powered off for > >>>>> the rest of the day anyway, so I don't need to get it up & running > >>>>> immediately: I can poke at the ddb prompt, given some clues. > >>>>> > >>>> > >>>> I don't suppose you can attach kgdb to this machine? I'd be interested > >> to > >>>> see what the contents of the softc are...a > >>> > >>> Pointer to how to do that? > >>> > >>> I do have ddb right now.... > >>> > >>>> .... > >>>> Thanks for the report. This is quite troubling. > >>> > >>> Well, let's get it fixed, then! :-) > >>> > >>>> Warner > >>>> .... > >>> > >>> I should still have access to the serial console after I get in to the > >>> office (heading out shortly). > >>> > >>> Peace, > >>> david > >>> -- > >>> David H. Wolfskill david@catwhisker.org > >>> "unfortunately, no trust!” -- well, of course! You reap what you sow. > >>> > >>> See http://www.catwhisker.org/~david/publickey.gpg for my public key. > >>> > >> _______________________________________________ > >> freebsd-current@freebsd.org mailing list > >> https://lists.freebsd.org/mailman/listinfo/freebsd-current > >> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" > >> > > _______________________________________________ > > freebsd-current@freebsd.org mailing list > > https://lists.freebsd.org/mailman/listinfo/freebsd-current > > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" > > > > I've been seeing this today while working on my laptop. > > 1) insert USB stick. > 2) mount UFS partition to /mnt > 3) copy a file off > 4) umount /mnt > 5) remove usb stick > 6) instant panic > > Oddly, it is the same negative number every time (-559038242), so it > isn't random/memory corruption. > > > -- > Allan Jude > _______________________________________________ > freebsd-current@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" > -- Cheers, Cy Schubert FreeBSD UNIX: Web: http://www.FreeBSD.org The need of the many outweighs the greed of the few.