Date: Wed, 17 Sep 2014 21:58:53 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 193724] New: [panic] in tcp_discardcb (/usr/src/sys/netinet/tcp_subr.c:929) Message-ID: <bug-193724-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193724 Bug ID: 193724 Summary: [panic] in tcp_discardcb (/usr/src/sys/netinet/tcp_subr.c:929) Product: Base System Version: 10.0-RELEASE Hardware: amd64 OS: Any Status: Needs Triage Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: girgen@FreeBSD.org Hi! We got a spontaneous reboot on a producion system. I have a crash dump, can someone perhaps make use of it to actually find the culprit. I'd rather see it happen again. I cannot find anything in the log files. This is FreeBSD 10.0-RELEASE-p6 Kernel conf: --- include GENERIC cpu HAMMER ident CAJA # Virtual networking for jail options VIMAGE # The nullFS to mount local directory options NULLFS --- [girgen@caja /usr/obj/usr/src/sys/CAJA]$ kgdb kernel.debug /var/crash/vmcore.0 GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"... Unread portion of the kernel message buffer: Fatal trap 12: page fault while in kernel mode cpuid = 22; apic id = 26 fault virtual address = 0x20 fault code = supervisor read data, page not present instruction pointer = 0x20:0xffffffff80a506e2 stack pointer = 0x28:0xfffffe1835e5e780 frame pointer = 0x28:0xfffffe1835e5e7f0 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 84230 (httpd) trap number = 12 panic: page fault cpuid = 22 KDB: stack backtrace: #0 0xffffffff808eb720 at kdb_backtrace+0x60 #1 0xffffffff808b2de5 at panic+0x155 #2 0xffffffff80ca05b2 at trap_fatal+0x3a2 #3 0xffffffff80ca0889 at trap_pfault+0x2c9 #4 0xffffffff80ca0016 at trap+0x5e6 #5 0xffffffff80c872b2 at calltrap+0x8 #6 0xffffffff80a58d6e at tcp_usr_detach+0xde #7 0xffffffff80923263 at sofree+0x163 #8 0xffffffff809237c2 at soclose+0x362 #9 0xffffffff808718c9 at _fdrop+0x29 #10 0xffffffff80874137 at closef+0x237 #11 0xffffffff80871b95 at closefp+0x95 #12 0xffffffff80ca0ea7 at amd64_syscall+0x357 #13 0xffffffff80c8759b at Xfast_syscall+0xfb Uptime: 1d19h54m41s Dumping 13667 out of 98244 MB:..1%..11%..21%..31%..41%..51%..61%..71%..81%..91% Reading symbols from /boot/kernel/zfs.ko.symbols...done. Loaded symbols for /boot/kernel/zfs.ko.symbols Reading symbols from /boot/kernel/opensolaris.ko.symbols...done. Loaded symbols for /boot/kernel/opensolaris.ko.symbols Reading symbols from /boot/kernel/ng_bridge.ko.symbols...done. Loaded symbols for /boot/kernel/ng_bridge.ko.symbols Reading symbols from /boot/kernel/netgraph.ko.symbols...done. Loaded symbols for /boot/kernel/netgraph.ko.symbols Reading symbols from /boot/kernel/ng_eiface.ko.symbols...done. Loaded symbols for /boot/kernel/ng_eiface.ko.symbols Reading symbols from /boot/kernel/ng_ether.ko.symbols...done. Loaded symbols for /boot/kernel/ng_ether.ko.symbols Reading symbols from /boot/kernel/accf_data.ko.symbols...done. Loaded symbols for /boot/kernel/accf_data.ko.symbols Reading symbols from /boot/kernel/accf_http.ko.symbols...done. Loaded symbols for /boot/kernel/accf_http.ko.symbols Reading symbols from /boot/kernel/ums.ko.symbols...done. Loaded symbols for /boot/kernel/ums.ko.symbols Reading symbols from /boot/kernel/ng_socket.ko.symbols...done. Loaded symbols for /boot/kernel/ng_socket.ko.symbols #0 doadump (textdump=<value optimized out>) at pcpu.h:219 219 __asm("movq %%gs:%1,%0" : "=r" (td) (kgdb) list *0xffffffff80a506e2 0xffffffff80a506e2 is in tcp_discardcb (/usr/src/sys/netinet/tcp_subr.c:929). 924 * portion of the remainder of tcp_discardcb() to an asynchronous 925 * context that can callout_drain() and then continue. Some care 926 * will be required to ensure that no further processing takes place 927 * on the tcpcb, even though it hasn't been freed (a flag?). 928 */ 929 callout_stop(&tp->t_timers->tt_rexmt); 930 callout_stop(&tp->t_timers->tt_persist); 931 callout_stop(&tp->t_timers->tt_keep); 932 callout_stop(&tp->t_timers->tt_2msl); 933 callout_stop(&tp->t_timers->tt_delack); Current language: auto; currently minimal (kgdb) backtrace #0 doadump (textdump=<value optimized out>) at pcpu.h:219 #1 0xffffffff808b2a60 in kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:447 #2 0xffffffff808b2e24 in panic (fmt=<value optimized out>) at /usr/src/sys/kern/kern_shutdown.c:754 #3 0xffffffff80ca05b2 in trap_fatal (frame=<value optimized out>, eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:882 #4 0xffffffff80ca0889 in trap_pfault (frame=0xfffffe1835e5e6d0, usermode=0) at /usr/src/sys/amd64/amd64/trap.c:699 #5 0xffffffff80ca0016 in trap (frame=0xfffffe1835e5e6d0) at /usr/src/sys/amd64/amd64/trap.c:463 #6 0xffffffff80c872b2 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:232 #7 0xffffffff80a506e2 in tcp_discardcb (tp=0x0) at /usr/src/sys/netinet/tcp_subr.c:905 #8 0xffffffff80a58d6e in tcp_usr_detach (so=<value optimized out>) at /usr/src/sys/netinet/tcp_usrreq.c:207 #9 0xffffffff80923263 in sofree (so=0xfffff80934dac570) at /usr/src/sys/kern/uipc_socket.c:735 #10 0xffffffff809237c2 in soclose (so=<value optimized out>) at /usr/src/sys/kern/uipc_socket.c:837 #11 0xffffffff808718c9 in _fdrop (fp=0xfffff8002d9b3050, td=0xfffff80060425000) at file.h:342 #12 0xffffffff80874137 in closef (fp=<value optimized out>, td=<value optimized out>) at /usr/src/sys/kern/kern_descrip.c:2310 #13 0xffffffff80871b95 in closefp (fdp=0xfffff802fc70b800, fd=<value optimized out>, fp=0xfffff8002d9b3050, td=0xfffff80060425000, holdleaders=<value optimized out>) at /usr/src/sys/kern/kern_descrip.c:1159 #14 0xffffffff80ca0ea7 in amd64_syscall (td=0xfffff80060425000, traced=0) at subr_syscall.c:134 #15 0xffffffff80c8759b in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:391 #16 0x0000000801e6214a in ?? () Previous frame inner to this frame (corrupt stack?) (kgdb) quit -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-193724-8>