From owner-freebsd-current@FreeBSD.ORG Sun Jun 30 11:18:43 2013 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 38BC67D5; Sun, 30 Jun 2013 11:18:43 +0000 (UTC) (envelope-from mjguzik@gmail.com) Received: from mail-wi0-x235.google.com (mail-wi0-x235.google.com [IPv6:2a00:1450:400c:c05::235]) by mx1.freebsd.org (Postfix) with ESMTP id A03511BA2; Sun, 30 Jun 2013 11:18:42 +0000 (UTC) Received: by mail-wi0-f181.google.com with SMTP id hq4so2219474wib.8 for ; Sun, 30 Jun 2013 04:18:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-type:content-disposition:in-reply-to :user-agent; bh=3q+mS4nSknGy42gNnHtBlspvAXIPqS57GKH1k+PN/To=; b=il0c4ZhhUkv3LRMQl5xOqFtMCcy2zVXx7eiAZz5jdOtPDO/snSQam8BLPE+mq8fHfj pqZphJw6fdumBQhGlRUim3NgG0kYRrI4xDT7hsGdDLwv30xwwT5/VjY2wfCOXvv1pQEt mxr5zz+PdQHKaolKnckICUcluJ+F0n9dbbVWIGFHJRRxmolHPPjkR8iczovtQlD7qHi6 6i+NtZf56qAqiJhNMYZUBUUiM+67McjHSjBaTudQ15VuVkrXUUexGNWnLzaox19oozlI 4ioLQL20rElVn/9UTmStxOQNRMo+uGuJRKqWkXFP5YQrPxmNBqwNV1teOvD4By6wDLEp /Pcg== X-Received: by 10.180.107.167 with SMTP id hd7mr9283864wib.33.1372591121869; Sun, 30 Jun 2013 04:18:41 -0700 (PDT) Received: from dft-labs.eu (n1x0n-1-pt.tunnel.tserv5.lon1.ipv6.he.net. [2001:470:1f08:1f7::2]) by mx.google.com with ESMTPSA id o14sm9310807wiv.3.2013.06.30.04.18.39 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Sun, 30 Jun 2013 04:18:40 -0700 (PDT) Date: Sun, 30 Jun 2013 13:18:36 +0200 From: Mateusz Guzik To: koobs@FreeBSD.org Subject: Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168 Message-ID: <20130630111836.GB22492@dft-labs.eu> Mail-Followup-To: Mateusz Guzik , koobs@FreeBSD.org, freebsd-current@FreeBSD.org References: <51CFDC86.2040506@FreeBSD.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <51CFDC86.2040506@FreeBSD.org> User-Agent: Mutt/1.5.21 (2010-09-15) Cc: freebsd-current@FreeBSD.org X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Jun 2013 11:18:43 -0000 On Sun, Jun 30, 2013 at 05:21:42PM +1000, Kubilay Kocak wrote: > I'm seeing what I believe is related panic, reliably being generated by > the Python regression test suite on a newly created FreeBSD 10-CURRENT > buildbot. > > Symptoms first seen in an freebsd.org FTP snapshot dated "Thu May 30 > 20:01:46 UTC 2013" and also reproducible on a freshly updated r252400 > > It is additionally reproducible after checking out pure upstream python > sources, using the following steps: > > hg clone http://hg.python.org/cpython > cd cpython && configure && make buildbottest > > An interesting possible correlation is that it seems to drop out > during/around "test_socket" > Turns out the bug is quite funny ;) Try this: diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 5d8e814..7a4db04 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -1764,8 +1764,8 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags) } for (i = 0; i < newfds; i++, fdp++) { fde = &fdesc->fd_ofiles[*fdp]; - fde->fde_file = fdep[0]->fde_file; - filecaps_move(&fdep[0]->fde_caps, + fde->fde_file = fdep[i]->fde_file; + filecaps_move(&fdep[i]->fde_caps, &fde->fde_caps); if ((flags & MSG_CMSG_CLOEXEC) != 0) fde->fde_flags |= UF_EXCLOSE; -- Mateusz Guzik