From owner-freebsd-current@FreeBSD.ORG Thu Aug 19 21:00:51 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D68EB16A4CE; Thu, 19 Aug 2004 21:00:51 +0000 (GMT) Received: from www.cryptography.com (li-22.members.linode.com [64.5.53.22]) by mx1.FreeBSD.org (Postfix) with ESMTP id A3F4043D1D; Thu, 19 Aug 2004 21:00:51 +0000 (GMT) (envelope-from nate@root.org) Received: from [10.0.0.34] (adsl-67-127-84-57.dsl.snfc21.pacbell.net [67.127.84.57]) by www.cryptography.com (8.12.8/8.12.8) with ESMTP id i7JL0o8U015737; Thu, 19 Aug 2004 14:00:51 -0700 Message-ID: <41251502.2020607@root.org> Date: Thu, 19 Aug 2004 14:00:50 -0700 From: Nate Lawson User-Agent: Mozilla Thunderbird 0.7 (X11/20040702) X-Accept-Language: en-us, en MIME-Version: 1.0 To: current@freebsd.org Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: panic on kldunload ipfw.ko X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Aug 2004 21:00:52 -0000 Easy to reproduce -- boot single user. kldload ipfw.ko; kldunload ipfw.ko. Next timeout, you get the following panic: panic: write, page not present callout_reset() + 0x12c tcp_isn_tick() + 0x3f softclock ithread_loop (gdb) l *callout_reset+0x12c 0xc05011e8 is in callout_reset (../../../kern/kern_timeout.c:437). 432 433 c->c_arg = arg; 434 c->c_flags |= (CALLOUT_ACTIVE | CALLOUT_PENDING); 435 c->c_func = ftn; 436 c->c_time = ticks + to_ticks; 437 TAILQ_INSERT_TAIL(&callwheel[c->c_time & callwheelmask], 438 c, c_links.tqe); 439 mtx_unlock_spin(&callout_lock); 440 } 441 (gdb) l *tcp_isn_tick+0x3f 0xc0588c4f is in tcp_isn_tick (../../../netinet/tcp_subr.c:1368). 1363 if (projected_offset > isn_offset) 1364 isn_offset = projected_offset; 1365 1366 isn_offset_old = isn_offset; 1367 callout_reset(&isn_callout, 1, tcp_isn_tick, NULL); 1368 } 1369 1370 /* 1371 * When a source quench is received, close congestion window 1372 * to one segment. We will gradually open it again as we proceed. -Nate