From owner-freebsd-current@FreeBSD.ORG  Fri Aug 20 00:39:18 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B96C516A4CE
	for <current@freebsd.org>; Fri, 20 Aug 2004 00:39:18 +0000 (GMT)
Received: from c00l3r.networx.ch (c00l3r.networx.ch [62.48.2.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 04A2C43D31
	for <current@freebsd.org>; Fri, 20 Aug 2004 00:39:18 +0000 (GMT)
	(envelope-from andre@freebsd.org)
Received: (qmail 2398 invoked from network); 20 Aug 2004 00:39:18 -0000
Received: from unknown (HELO freebsd.org) ([62.48.0.53])
          (envelope-sender <andre@freebsd.org>)
          by c00l3r.networx.ch (qmail-ldap-1.03) with SMTP
          for <nate@root.org>; 20 Aug 2004 00:39:18 -0000
Message-ID: <41254833.B531B868@freebsd.org>
Date: Fri, 20 Aug 2004 02:39:15 +0200
From: Andre Oppermann <andre@freebsd.org>
X-Mailer: Mozilla 4.8 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Nate Lawson <nate@root.org>
References: <41251502.2020607@root.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
cc: current@freebsd.org
Subject: Re: panic on kldunload ipfw.ko
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Aug 2004 00:39:18 -0000

Nate Lawson wrote:
> 
> Easy to reproduce -- boot single user.  kldload ipfw.ko; kldunload
> ipfw.ko.  Next timeout, you get the following panic:

The bug is fixed in 'netinet/ip_fw_pfil.c' rev 1.5 a few minutes ago.

-- 
Andre


> panic: write, page not present
> callout_reset() + 0x12c
> tcp_isn_tick() + 0x3f
> softclock
> ithread_loop
> 
> (gdb) l *callout_reset+0x12c
> 0xc05011e8 is in callout_reset (../../../kern/kern_timeout.c:437).
> 432
> 433             c->c_arg = arg;
> 434             c->c_flags |= (CALLOUT_ACTIVE | CALLOUT_PENDING);
> 435             c->c_func = ftn;
> 436             c->c_time = ticks + to_ticks;
> 437             TAILQ_INSERT_TAIL(&callwheel[c->c_time & callwheelmask],
> 438                               c, c_links.tqe);
> 439             mtx_unlock_spin(&callout_lock);
> 440     }
> 441
> 
> (gdb) l *tcp_isn_tick+0x3f
> 0xc0588c4f is in tcp_isn_tick (../../../netinet/tcp_subr.c:1368).
> 1363            if (projected_offset > isn_offset)
> 1364                    isn_offset = projected_offset;
> 1365
> 1366            isn_offset_old = isn_offset;
> 1367            callout_reset(&isn_callout, 1, tcp_isn_tick, NULL);
> 1368    }
> 1369
> 1370    /*
> 1371     * When a source quench is received, close congestion window
> 1372     * to one segment.  We will gradually open it again as we proceed.
> 
> -Nate