From owner-freebsd-current@FreeBSD.ORG Fri Nov 28 06:24:57 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 28F8016A4CE for ; Fri, 28 Nov 2003 06:24:57 -0800 (PST) Received: from ei.bzerk.org (ei.xs4all.nl [213.84.67.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id CC9A943F75 for ; Fri, 28 Nov 2003 06:24:54 -0800 (PST) (envelope-from mail25@bzerk.org) Received: from ei.bzerk.org (BOFH@localhost [127.0.0.1]) by ei.bzerk.org (8.12.10/8.12.10) with ESMTP id hASEP2TS099406 for ; Fri, 28 Nov 2003 15:25:02 +0100 (CET) (envelope-from mail25@bzerk.org) Received: (from bulk@localhost) by ei.bzerk.org (8.12.10/8.12.10/Submit) id hASEP2IR099405 for freebsd-current@freebsd.org; Fri, 28 Nov 2003 15:25:02 +0100 (CET) (envelope-from mail25@bzerk.org) X-Authentication-Warning: ei.bzerk.org: bulk set sender to mail25@bzerk.org using -f Date: Fri, 28 Nov 2003 15:25:02 +0100 From: Ruben de Groot To: freebsd-current@freebsd.org Message-ID: <20031128142502.GA98704@ei.bzerk.org> Mail-Followup-To: Ruben de Groot , freebsd-current@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.1i Subject: LOR and Panic in 5.2-BETA X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Nov 2003 14:24:57 -0000 This is on a machine running 5.2-BETA, compiled with last night's sources I get the following LOR when starting pptpclient: lock order reversal 1st 0xc27d6164 rtentry (rtentry) @ /usr/build/current/usr/src/sys/net/rtsock.c:387 2nd 0xc24e9c7c radix node head (radix node head) @ /usr/build/current/usr/src/sys/net/route.c:133 Stack backtrace: backtrace(c0690084,c24e9c7c,c0695c74,c0695c74,c0695cca) at backtrace+0x17 witness_lock(c24e9c7c,8,c0695cca,85,c0e97820) at witness_lock+0x672 _mtx_lock_flags(c24e9c7c,0,c0695cca,85,121) at _mtx_lock_flags+0xba rtalloc1(c27d556c,1,0,436,0) at rtalloc1+0x79 rt_setgate(c27d6100,c0e97820,c27d556c,184,0) at rt_setgate+0x258 route_output(c0eada00,c25bd1e0,7c,c0eada00,1f84) at route_output+0x67f raw_usend(c25bd1e0,0,c0eada00,0,0) at raw_usend+0x73 rts_send(c25bd1e0,0,c0eada00,0,0) at rts_send+0x35 sosend(c25bd1e0,0,de5abc80,c0eada00,0) at sosend+0x44d soo_write(c25a5550,de5abc80,c27d5f00,0,c25b68c0) at soo_write+0x70 dofilewrite(c25b68c0,c25a5550,1,bfbfde60,7c) at dofilewrite+0xfb write(c25b68c0,de5abd14,c06a86fb,3ee,3) at write+0x6e syscall(2f,2f,2f,1,1) at syscall+0x2c0 Xint0x80_syscall() at Xint0x80_syscall+0x1d --- syscall (4), eip = 0x282830af, esp = 0xbfbfde1c, ebp = 0xbfbfde48 --- Also, a repeatable panic when I run tcpdump on a gif interface. Without tcpdump, the tunnel is working as expected, but when tcpdump is listening on the gif0 interface and any traffic (e.g. a ping) is generated, I get the following panic : panic: gif_output: attempted use of a free mbuf! Debugger("panic") Stopped at Debugger+0x54: xchgl %ebx,in_Debugger.0 db> db> db> trace Debugger(c068cb20,c06e8940,c0681033,de5fe954,100) at Debugger+0x54 panic(c0681033,c06731f0,1,2,c0eadb00) at panic+0xd5 gif_output(c257c000,c0eadb00,de5feb40,c2586d00,c050c42b) at gif_output+0xd5 ip_output(c0eadb00,0,0,20,0,c27ebe10) at ip_output+0xfad rip_output(c0eadb00,c25be0f0,2800000a,2cf,40) at rip_output+0x1c2 rip_send(c25be0f0,0,c0eadb00,c0e869e0,0) at rip_send+0xfe sosend(c25be0f0,c0e869e0,de5fec4c,c0eadb00,0) at sosend+0x44d kern_sendit(c27b4000,3,de5fecc4,0,0) at kern_sendit+0x17c sendit(c27b4000,3,de5fecc4,0,804ee14) at sendit+0x16e sendto(c27b4000,de5fed14,c06a86fb,3ee,6) at sendto+0x5b syscall(2f,2f,2f,804edd4,804edd4) at syscall+0x2c0 Xint0x80_syscall() at Xint0x80_syscall+0x1d --- syscall (133, FreeBSD ELF32, sendto), eip = 0x280de68f, esp = 0xbfbee7cc, ebp = 0xbfbee808 --- If there's any other info I should provide, please let me know. Ruben