From owner-freebsd-current@FreeBSD.ORG  Mon Jul 15 09:16:41 2013
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id AD890172
 for <freebsd-current@freebsd.org>; Mon, 15 Jul 2013 09:16:41 +0000 (UTC)
 (envelope-from emz@norma.perm.ru)
Received: from elf.hq.norma.perm.ru (mail.norma.perm.ru [128.127.144.4])
 by mx1.freebsd.org (Postfix) with ESMTP id 62785A63
 for <freebsd-current@freebsd.org>; Mon, 15 Jul 2013 09:16:40 +0000 (UTC)
Received: from bsdrookie.norma.com. (bsdrookie.norma.com [192.168.7.159])
 by elf.hq.norma.perm.ru (8.14.5/8.14.5) with ESMTP id r6F9GbsC027461
 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO)
 for <freebsd-current@freebsd.org>; Mon, 15 Jul 2013 15:16:37 +0600 (YEKT)
 (envelope-from emz@norma.perm.ru)
Message-ID: <51E3BDF5.7030602@norma.perm.ru>
Date: Mon, 15 Jul 2013 15:16:37 +0600
From: "Eugene M. Zheganin" <emz@norma.perm.ru>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:17.0) Gecko/20130709 Thunderbird/17.0.6
MIME-Version: 1.0
To: freebsd-current@freebsd.org
Subject: Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168
References: <51CFDC86.2040506@FreeBSD.org> <20130630111836.GB22492@dft-labs.eu>
 <20130701231011.GA1406@garage.freebsd.pl>
In-Reply-To: <20130701231011.GA1406@garage.freebsd.pl>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7
 (elf.hq.norma.perm.ru [192.168.3.10]); Mon, 15 Jul 2013 15:16:37 +0600 (YEKT)
X-Spam-Status: No hits=-101.0 bayes=0.5 testhits ALL_TRUSTED=-1,
 USER_IN_WHITELIST=-100 autolearn=unavailable version=3.3.2
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on elf.hq.norma.perm.ru
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Jul 2013 09:16:41 -0000

Hi.

On 02.07.2013 05:10, Pawel Jakub Dawidek wrote:
> On Sun, Jun 30, 2013 at 01:18:36PM +0200, Mateusz Guzik wrote:
>>
>> Turns out the bug is quite funny ;)
>>
>> Try this:
>> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
>> index 5d8e814..7a4db04 100644
>> --- a/sys/kern/uipc_usrreq.c
>> +++ b/sys/kern/uipc_usrreq.c
>> @@ -1764,8 +1764,8 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
>>  			}
>>  			for (i = 0; i < newfds; i++, fdp++) {
>>  				fde = &fdesc->fd_ofiles[*fdp];
>> -				fde->fde_file = fdep[0]->fde_file;
>> -				filecaps_move(&fdep[0]->fde_caps,
>> +				fde->fde_file = fdep[i]->fde_file;
>> +				filecaps_move(&fdep[i]->fde_caps,
>>  				    &fde->fde_caps);
>>  				if ((flags & MSG_CMSG_CLOEXEC) != 0)
>>  					fde->fde_flags |= UF_EXCLOSE;
> Thanks for tracking it down before I had time to get to it!
> The change looks good.
>
Guys, if this is working, why it's not commited to HEAD ? I'm still
hitting this bug on r251990 and later ones.

Thanks.
Eugene.