From owner-cvs-all@FreeBSD.ORG Thu Feb 24 10:46:02 2005 Return-Path: Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6CC9716A4CE; Thu, 24 Feb 2005 10:46:02 +0000 (GMT) Received: from cyrus.watson.org (cyrus.watson.org [204.156.12.53]) by mx1.FreeBSD.org (Postfix) with ESMTP id 24ECF43D31; Thu, 24 Feb 2005 10:46:02 +0000 (GMT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by cyrus.watson.org (Postfix) with SMTP id B303546B3C; Thu, 24 Feb 2005 05:46:01 -0500 (EST) Date: Thu, 24 Feb 2005 10:44:18 +0000 (GMT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Mike Silbersack In-Reply-To: <200303290548.h2T5ma5Q007596@repoman.freebsd.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: cvs-src@FreeBSD.org cc: src-committers@FreeBSD.org cc: cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/kern uipc_mbuf.c src/sys/sys mbuf.h X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Feb 2005 10:46:02 -0000 On Fri, 28 Mar 2003, Mike Silbersack wrote: > Add the m_defrag routine, as discussed on committers@. This > incarnation should address the concerns of all in the discussion, > and keeps statistics which show how much it is used. I just started tracking a bug report from Peter Holm in which if_rl free's an already free'd mbuf, and tracked it back to the following problem: when you went through and adapted various drivers to use m_defrag(), two bugs were introduced: (1) Callers of m_defrag() did not properly handle the case where m_defrag() would return a new mbuf cluster as the head. Specifically, on encapsulation failure, they might requeue the old head in the ifnet queue. (2) Callers of m_defrag() did not properly handle the case where m_defrag() would return NULL due to mbuf exhaustion. Specifically, on encapsulation failure in the case where m_defrag() fails, they might attempt to enqueue a NULL mbuf pointer or a free'd mbuf pointer into the ifnet queue. This may explain a number of problems seen with several device drivers when under very high load. It looks like if_vge, if_bfe, if_dc, if_re, if_rl, if_sis, if_vr, and if_xl may all be partially affected by these bugs. I may have missed other cases of breakage. It looks like you and jmg fixed a few at least partially, though. It would be really good if we could get this fixed for 5.4, and probably merged to the 5.3 patch branch! Robert N M Watson