Date: Wed, 15 Dec 2004 16:08:24 +0100 From: Pawel Malachowski <pawmal-posting@freebsd.lublin.pl> To: freebsd-ipfw@freebsd.org Subject: Panic with dummynet, RELENG_4 (dummynet: heap_extract). Message-ID: <20041215150824.GA34851@shellma.zin.lublin.pl>
next in thread | raw e-mail | index | archive | help
Hello,
It hit me some time ago. 4.10-STABLE, perfectly stable, no
configuration changes for months (only xl(4) replaced with dc(4)),
works rock solid for years. IPFW2, kernel Tue Sep 28 16:04:43 CEST 2004.
This is direct call to panic(9) so probaly this is something
that Should Never Happen. Question: how could it happen?! :)
Details:
panic: dummynet: heap_extract
syncing disks... 2
done
Uptime: 56d3h32m3s
dumping to dev #ad/0x30001, offset 1572992
dump ata0: resetting devices .. done
(kgdb) bt
#0 dumpsys () at ../../kern/kern_shutdown.c:487
#1 0xc023c76f in boot (howto=256) at ../../kern/kern_shutdown.c:316
#2 0xc023cb94 in poweroff_wait (junk=0xc04160b6, howto=-1069457280)
at ../../kern/kern_shutdown.c:595
#3 0xc0293af9 in heap_extract (h=0xc77df138, obj=0xc7251a00)
at ../../netinet/ip_dummynet.c:297
#4 0xc0294df0 in dummynet_io (m=0xc1137b00, pipe_nr=412, dir=1, fwa=0xd8675dd8)
at ../../netinet/ip_dummynet.c:1222
#5 0xc029c8cd in ip_output (m0=0xc1137b00, opt=0x0, ro=0xc04cb7a4, flags=1,
imo=0x0, inp=0x0) at ../../netinet/ip_output.c:1007
#6 0xc029bc82 in ip_forward (m=0xc1137b00, srcrt=0, next_hop=0x0)
at ../../netinet/ip_input.c:1865
#7 0xc029aa87 in ip_input (m=0xc1137b00) at ../../netinet/ip_input.c:699
#8 0xc029ae0f in ipintr () at ../../netinet/ip_input.c:955
#9 0xc03ac1b9 in swi_net_next ()
#10 0xc0242845 in softclock () at ../../kern/kern_timeout.c:131
#11 0xc03ac173 in doreti_swi ()
#12 0x8049edf in ?? ()
#13 0x804a5e6 in ?? ()
#14 0x804b530 in ?? ()
#15 0x2807ae89 in ?? ()
#16 0x2807a9db in ?? ()
#17 0x80498b6 in ?? ()
#18 0x804926d in ?? ()
(kgdb) up 3
#3 0xc0293af9 in heap_extract (h=0xc77df138, obj=0xc7251a00)
at ../../netinet/ip_dummynet.c:297
297 panic("dummynet: heap_extract");
(kgdb) l
292 panic("dummynet: heap_extract from middle not supported
on this heap!!!\n");
293 father = *((int *)((char *)obj + h->offset)) ;
294 if (father < 0 || father >= h->elements) {
295 printf("dummynet: heap_extract, father %d out of bound
0..%d\n",
296 father, h->elements);
297 panic("dummynet: heap_extract");
298 }
299 }
300 RESET_OFFSET(h, father);
301 child = HEAP_LEFT(father) ; /* left child */
Sources:
static void
heap_extract(struct dn_heap *h, void *obj)
{
int child, father, max = h->elements - 1 ;
if (max < 0) {
printf("dummynet: warning, extract from empty heap 0x%p\n", h);
return ;
}
father = 0 ; /* default: move up smallest child */
if (obj != NULL) { /* extract specific element, index is at offset */
if (h->offset <= 0)
panic("dummynet: heap_extract from middle not supported on this heap!!!
father = *((int *)((char *)obj + h->offset)) ;
if (father < 0 || father >= h->elements) {
printf("dummynet: heap_extract, father %d out of bound 0..%d\n",
father, h->elements);
panic("dummynet: heap_extract");
}
}
So: (father < 0 || father >= h->elements) was true.
pipe_nr=412 is a queue, configured like this:
q00412: weight 99 pipe 4 8 KB 512 queues (512 buckets) droptail
mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
q00410: weight 1 pipe 4 8 KB 0 queues (512 buckets) droptail
mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
q00411: weight 1 pipe 4 8 KB 515 queues (512 buckets) droptail
mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
00004: 1.800 Mbit/s 0 ms 12 KB 0 queues (1 buckets) droptail
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
--
Paweł Małachowski
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041215150824.GA34851>