From owner-freebsd-current@FreeBSD.ORG Mon Jul 16 14:57:55 2007 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id CC75D16A40F for ; Mon, 16 Jul 2007 14:57:55 +0000 (UTC) (envelope-from jhb@freebsd.org) Received: from speedfactory.net (mail6.speedfactory.net [66.23.216.219]) by mx1.freebsd.org (Postfix) with ESMTP id 7F8E113C4B6 for ; Mon, 16 Jul 2007 14:57:55 +0000 (UTC) (envelope-from jhb@freebsd.org) Received: from server.baldwin.cx (unverified [66.23.211.162]) by speedfactory.net (SurgeMail 3.7b8) with ESMTP id 196960709 for multiple; Mon, 16 Jul 2007 11:05:59 -0400 Received: from localhost.corp.yahoo.com (john@localhost [127.0.0.1]) (authenticated bits=0) by server.baldwin.cx (8.13.8/8.13.8) with ESMTP id l6GEvMLA032514; Mon, 16 Jul 2007 10:57:40 -0400 (EDT) (envelope-from jhb@freebsd.org) From: John Baldwin To: freebsd-current@freebsd.org Date: Mon, 16 Jul 2007 10:32:21 -0400 User-Agent: KMail/1.9.6 References: <20070619191203.GA1167@turion.vk2pj.dyndns.org> In-Reply-To: <20070619191203.GA1167@turion.vk2pj.dyndns.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200707161032.22207.jhb@freebsd.org> X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-2.0.2 (server.baldwin.cx [127.0.0.1]); Mon, 16 Jul 2007 10:57:40 -0400 (EDT) X-Virus-Scanned: ClamAV 0.88.3/3681/Mon Jul 16 09:16:18 2007 on server.baldwin.cx X-Virus-Status: Clean X-Spam-Status: No, score=-4.4 required=4.2 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.1.3 X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on server.baldwin.cx X-Server: High Performance Mail Server - http://surgemail.com r=1653887525 Cc: Peter Jeremy Subject: Re: Panic in callout_reset() X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Jul 2007 14:57:55 -0000 On Tuesday 19 June 2007 03:12:03 pm Peter Jeremy wrote: > Running: FreeBSD 7.0-CURRENT #5: Sat Jun 9 18:29:40 EST 2007 > root@server.vk2pj.dyndns.org:/var/obj/k7/usr/src/sys/server > Panic String: Bad tailq NEXT(0xcce421a8->tqh_last) != NULL > > #0 doadump () at pcpu.h:195 > #1 0xc04524a9 in db_fncall (dummy1=0xc0576aa2, dummy2=0x0, dummy3=0x1, dummy4=0xd3b23a3c "") > at /usr/src/sys/ddb/db_command.c:486 > #2 0xc0452a15 in db_command_loop () at /usr/src/sys/ddb/db_command.c:401 > #3 0xc0454195 in db_trap (type=0x3, code=0x0) at /usr/src/sys/ddb/db_main.c:222 > #4 0xc0576943 in kdb_trap (type=0x3, code=0x0, tf=0xd3b23bd4) at /usr/src/sys/kern/subr_kdb.c:502 > #5 0xc06d4d4b in trap (frame=0xd3b23bd4) at /usr/src/sys/i386/i386/trap.c:620 > #6 0xc06c21db in calltrap () at /usr/src/sys/i386/i386/exception.s:139 > #7 0xc0576aa2 in kdb_enter (msg=0xc0719d31 "panic") at cpufunc.h:60 > #8 0xc0550035 in panic (fmt=0xc06fdb26 "Bad tailq NEXT(%p->tqh_last) != NULL") > at /usr/src/sys/kern/kern_shutdown.c:547 > #9 0xc056180a in callout_reset (c=0xc07ec000, to_ticks=0xa, ftn=0xc063fd30 , arg=0x0) > at /usr/src/sys/kern/kern_timeout.c:477 > #10 0xc063fde4 in nfsrv_timer (arg=0x0) at /usr/src/sys/nfsserver/nfs_srvsock.c:815 > #11 0xc0561f1e in softclock (dummy=0x0) at /usr/src/sys/kern/kern_timeout.c:280 > #12 0xc0534485 in ithread_loop (arg=0xc2926670) at /usr/src/sys/kern/kern_intr.c:1036 > #13 0xc0531a57 in fork_exit (callout=0xc05342d0 , arg=0xc2926670, frame=0xd3b23d38) > at /usr/src/sys/kern/kern_fork.c:787 > #14 0xc06c2250 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205 > > 'c' in callout_reset looks like: > (kgdb) p *c > $1 = { > c_links = { > sle = { > sle_next = 0xc07e5e08 > }, > tqe = { > tqe_next = 0xc07e5e08, > tqe_prev = 0xcce42158 > } > }, > c_time = 0x3230ae73, > c_arg = 0x0, > c_func = 0xc063fd30 , > c_mtx = 0x0, > c_flags = 0x16 > } > > (kgdb) p *$1.c_links.tqe.tqe_next > $3 = { > c_links = { > sle = { > sle_next = 0x0 > }, > tqe = { > tqe_next = 0x0, > tqe_prev = 0xcce42158 > } > }, > c_time = 0x3230ae69, > c_arg = 0x0, > c_func = 0xc0605f80 , > c_mtx = 0x0, > c_flags = 0x16 > } > (kgdb) p *$1.c_links.tqe.tqe_prev > $5 = (struct callout *) 0xc07e5e08 > > Any suggestions? The panic is because the callout is already on a list. Maybe try moving the NFSD_UNLOCK() in nfsrv_timer() after the callout_reset(). -- John Baldwin