From owner-freebsd-current@FreeBSD.ORG Fri Oct 15 10:28:02 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 682D516A4CE for ; Fri, 15 Oct 2004 10:28:02 +0000 (GMT) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5F9E843D1F for ; Fri, 15 Oct 2004 10:28:01 +0000 (GMT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (localhost [127.0.0.1]) by fledge.watson.org (8.13.1/8.13.1) with ESMTP id i9FAQHS6062447 for ; Fri, 15 Oct 2004 06:26:17 -0400 (EDT) (envelope-from robert@fledge.watson.org) Received: from localhost (robert@localhost)i9FAQHuh062444 for ; Fri, 15 Oct 2004 06:26:17 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Fri, 15 Oct 2004 06:24:47 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Marc UBM Bocklet In-Reply-To: <20041015113321.126a6c4d.ubm@u-boot-man.de> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII ReSent-Date: Fri, 15 Oct 2004 06:26:13 -0400 (EDT) Resent-From: robert Resent-To: current@FreeBSD.org ReSent-Message-ID: Subject: Re: [BETA7-panic] sodealloc(): so_count 1 X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Oct 2004 10:28:02 -0000 On Fri, 15 Oct 2004, Marc UBM Bocklet wrote: > > Sounds good. I know that the problem Brian identified is a real race > > and a potential source of precisely the panic you were seeing. One > > reason I was interested in getting access to a dump from the panic, > > though, was to(if possible) confirm that it was *the* race causing the > > problem. It's a very likely candidate, but it would be good to know > > if we should be looking for another related race. If the code now in > > HEAD fixes it for you, please let me know (or if not, also :-). If it > > doesn't, the core would be very helpful. > > Ok, bad news first: > > I just got exactly the same panic with Brian's > tcp_accept_race_crash.patch applied. > > Debug output is attached, but it looks just like the last time. > > The good news: > > I got a coredump that I can poke. :-) > > So now I just need to know what info to extract from the dump :-) It would be interesting to have you try with the current head of RELENG_5, which now includes my fix, which is a little different from Brian's fix in the sense that it tries to rewrite things less (since that code is very sensitive to change). Regarding the dump -- wonderful. Here's what I'd like you to do. In one of the sofree/sodealloc frames, I'd like to see the contents of *so, to see what state the socket is in. If you move up a few frames to in_pcbdetach(), the contents of *inp would be very useful, and up another frame or so to the tcp_close() frame, *tp. I don't know how fmiliar you are with our kernel debugging suite, but if you're not the documentation in the handbook is fairly decent. The one caveat I'd give is that that documentation might still reference "gdb -k" instead of "kgdb" to work with the core dump. Thanks for your help on this one -- I'm still unable to reproduce the problem in my testbeds, so having someone who's willing to keep following through on the bug is really invaluable! Thanks, Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Principal Research Scientist, McAfee Research