From owner-freebsd-bugs Thu Sep 26 10:40:12 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C32E737B401 for ; Thu, 26 Sep 2002 10:40:09 -0700 (PDT) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0F6E643E4A for ; Thu, 26 Sep 2002 10:40:09 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.6/8.12.6) with ESMTP id g8QHe8Co061675 for ; Thu, 26 Sep 2002 10:40:08 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.6/8.12.6/Submit) id g8QHe8Pl061674; Thu, 26 Sep 2002 10:40:08 -0700 (PDT) Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1640837B401 for ; Thu, 26 Sep 2002 10:35:48 -0700 (PDT) Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id AB35343E65 for ; Thu, 26 Sep 2002 10:35:47 -0700 (PDT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.12.6/8.12.6) with ESMTP id g8QHZl7R016683 for ; Thu, 26 Sep 2002 10:35:47 -0700 (PDT) (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.12.6/8.12.6/Submit) id g8QHZlGu016682; Thu, 26 Sep 2002 10:35:47 -0700 (PDT) Message-Id: <200209261735.g8QHZlGu016682@www.freebsd.org> Date: Thu, 26 Sep 2002 10:35:47 -0700 (PDT) From: al To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-1.0 Subject: kern/43396: repeatable kernel panic in if_xl.c:xl_newbuf:MCLGET Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 43396 >Category: kern >Synopsis: repeatable kernel panic in if_xl.c:xl_newbuf:MCLGET >Confidential: no >Severity: critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Sep 26 10:40:08 PDT 2002 >Closed-Date: >Last-Modified: >Originator: al >Release: 4.7-RC Sep 24 >Organization: >Environment: FreeBSD XXXX 4.7-RC FreeBSD 4.7-RC #12: Tue Sep 24 13:30:20 EDT 2002 YYYY@XXXX:/play/obj/usr/src/sys/XXXX i386 (not Generic) xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0xb800-0xb87f mem 0xf2800000-0xf280007f irq 9 at device 11.0 on pci2 >Description: While running ping sweeps of a corporate network the host panics. Panic does not occur while doing anything else, panic did not occur 2 or 3 months ago running same program under older version of -STABLE. Problem has been around for at least a few weeks as I pointed to this problem a while back runinng an earlier -STABLE http://docs.freebsd.org/cgi/getmsg.cgi?\ fetch=109403+0+archive/2002/freebsd-stable/20020915.freebsd-stable Might be related to http://www.FreeBSD.org/cgi/query-pr.cgi?pr=kern/30952 kgdb says panic occurs at #6 0xc02a129c in xl_newbuf (sc=0xc1a5c000, c=0xc1a5c194) at /usr/src/sys/pci/if_xl.c:1727 1727 MCLGET(m_new, M_DONTWAIT); kgdb) print m_new $3 = (struct mbuf *) 0xc0e6f000 (kgdb) print m_new->m_hdr.mh_flags $4 = 2 (kgdb) print m_new->m_hdr.mh_type $5 = 1 (kgdb) print m_new->m_hdr.mh_len $6 = 98 (kgdb) print m_new->m_hdr.mh_data $7 = 0xc0e6f02c "" In the networking area, the kernel has IPF built-in (for Security), and loads the kernel module for IPFW and DUMMYNET (for traffic shaping) (come to think of it, a few months ago DUMMYNET was not being used, so I could check if the problem occurs without IPFW and DUMMYNET) See above listed freebsd-stable posting for dmesg output. >How-To-Repeat: The bash script which can reliably generate panics generates ping requests with an alias source address and a payload string which includes the destination address. The ping requests are sent using individual instances of the ping command, due to the unique payload. The script forks about 1000 or 1500 pings, then waits for them all to complete, then sends another 1000 or so. After sending about about 1.2 million pings, the panic occurs, although this could be coincidence, as it will sometimes occur shortly after a reboot when picking up the scan where it left off after the panic, but sometimes will continue on without problem. The panic will always occur before the script completes, it is repeatable. >Fix: >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message