From owner-freebsd-i386@FreeBSD.ORG  Thu Jun 30 21:00:39 2005
Return-Path: <owner-freebsd-i386@FreeBSD.ORG>
X-Original-To: freebsd-i386@hub.freebsd.org
Delivered-To: freebsd-i386@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C38C516A421
	for <freebsd-i386@hub.freebsd.org>;
	Thu, 30 Jun 2005 21:00:39 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9598E43D49
	for <freebsd-i386@hub.freebsd.org>;
	Thu, 30 Jun 2005 21:00:39 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j5UL0dZn030609
	for <freebsd-i386@freefall.freebsd.org>; Thu, 30 Jun 2005 21:00:39 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j5UL0d0I030608;
	Thu, 30 Jun 2005 21:00:39 GMT (envelope-from gnats)
Date: Thu, 30 Jun 2005 21:00:39 GMT
Message-Id: <200506302100.j5UL0d0I030608@freefall.freebsd.org>
To: freebsd-i386@FreeBSD.org
From: "Richard Legault" <rlegault@SANDVINE.com>
Cc: 
Subject: Re: i386/82285: kernel panic during reboot
X-BeenThere: freebsd-i386@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Richard Legault <rlegault@SANDVINE.com>
List-Id: I386-specific issues for FreeBSD <freebsd-i386.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-i386>,
	<mailto:freebsd-i386-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-i386>
List-Post: <mailto:freebsd-i386@freebsd.org>
List-Help: <mailto:freebsd-i386-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-i386>,
	<mailto:freebsd-i386-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Jun 2005 21:00:39 -0000

The following reply was made to PR i386/82285; it has been noted by GNATS.

From: "Richard Legault" <rlegault@SANDVINE.com>
To: <bug-followup@FreeBSD.org>,
	"Richard Legault" <rlegault@SANDVINE.com>
Cc:  
Subject: Re: i386/82285: kernel panic during reboot
Date: Thu, 30 Jun 2005 16:57:48 -0400

 I have determined that the p_ucred value has never been set. In other =
 words this proc was in the "process" of being created as
 evidence by p->p_state=3DPRS_NEW.
 
 In the file kern_fork.c (1.234.2.4) I have found a potential race =
 condition.
 In function fork1() at line 410 the process (p2) is added to the allproc =
 list.
 At line 515 p2->p_ucred is set. Thus there are some 40 instructions in =
 which
 a reboot could swap this task out and start unraveling the all proc =
 list.
 I have confirmed on 3 consecutive panics that it was the first proc in =
 the allproc list.
 
 I have moved the setting of the p2->p_ucred =3D crhold(td->td_ucred) to =
 before the addition
 of p2 to the allproc list.=20
 
 Are there other race conditions sitting here that have yet to be =
 uncovered?
 Should other instructions be moved ahead of adding p2 to the proclist?
 I looked at the p_cansignal path and found no other gotchas.
 
 Having applied the fix I have continuously rebooted for 5 hours without =
 a panic at a rate of a 1reboot/3min.
 The previous record was 3 hours without a panic, with most happening =
 within an hour.
 
 
 Richard Legault
 Senior Engineer
 519-880-2400 ext 2722
 www.sandvine.com