From owner-freebsd-bugs@FreeBSD.ORG Mon May 19 13:10:04 2003 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9F0CD37B401 for ; Mon, 19 May 2003 13:10:04 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2B01743F75 for ; Mon, 19 May 2003 13:10:04 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h4JKA3Up081659 for ; Mon, 19 May 2003 13:10:03 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h4JKA3ck081658; Mon, 19 May 2003 13:10:03 -0700 (PDT) Date: Mon, 19 May 2003 13:10:03 -0700 (PDT) Message-Id: <200305192010.h4JKA3ck081658@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Mark Gooderum Subject: Re: kern/51352: panic: malloc(M_WAITOK) in interrupt context X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Mark Gooderum List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 May 2003 20:10:04 -0000 The following reply was made to PR kern/51352; it has been noted by GNATS. From: Mark Gooderum To: freebsd-gnats-submit@FreeBSD.org, dada@sbox.tugraz.at, Archie Cobbs Cc: Subject: Re: kern/51352: panic: malloc(M_WAITOK) in interrupt context Date: Mon, 19 May 2003 13:06:04 -0700 I've managed to trigger this running a kernel with DIAGNOSTIC and INVARIANTS - the core is always the traceback below. This is running 4.7. The offending MALLOC() is in dup_sockaddr() - which takes a flag for "canblock". The dup_sockaddr() call is from sorecieve() which _always_ calls dup_sockaddr() at splnet() with the canwait flag usually set to true (always in this particular code path down from recvfrom() as far as I can tell). Something here is a bug - if the MALLOC() blocks the socket code can get back to where it is so the splnet() to protect that socket is in fact not protecting the socket so I can see bad JuJu happening but I haven't discerned the full nature of this juju. But I don't understand enough of the socket code yet to say whether I can safely say don't wait always (as it looks like the code doesn't particulary seem to check or care if the dup fails). IdlePTD at phsyical address 0x003de000 initial pcb at physical address 0x00314bc0 panicstr: malloc(M_WAITOK) in interrupt context panic messages: --- panic: malloc(M_WAITOK) in interrupt context Uptime: 1d8h15m51s dumping to dev #ad/0x20001, offset 4120 dump ata0: resetting devices .. done 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 --- #0 dumpsys () at ../../kern/kern_shutdown.c:504 504 if (dumping++) { (kgdb) where #0 dumpsys () at ../../kern/kern_shutdown.c:504 #1 0xc01582f1 in boot (howto=260) at ../../kern/kern_shutdown.c:324 #2 0xc015878d in panic ( fmt=0xc02a7be0 "malloc(M_WAITOK) in interrupt context") at ../../kern/kern_shutdown.c:634 #3 0xc01535fb in malloc (size=10, type=0xc02fbac0, flags=0) at ../../kern/kern_malloc.c:157 #4 0xc017e9eb in dup_sockaddr (sa=0xc05e3114, canwait=1) at ../../kern/uipc_socket2.c:928 #5 0xc017b5b2 in soreceive (so=0xc6db1bc0, psa=0xc7a23e9c, uio=0xc7a23ec8, mp0=0x0, controlp=0x0, flagsp=0xc7a23f24) at ../../kern/uipc_socket.c:777 #6 0xc017f949 in recvit (p=0xc6938f60, s=14, mp=0xc7a23f0c, namelenp=0x855dd6c "\037") at ../../kern/uipc_syscalls.c:790 #7 0xc017fbf0 in recvfrom (p=0xc6938f60, uap=0xc7a23f80) at ../../kern/uipc_syscalls.c:927 #8 0xc024bed5 in syscall2 (frame={tf_fs = 138805295, tf_es = 138936367, tf_ds = 138936367, tf_edi = 139845116, tf_esi = 139844976, tf_ebp = 139845008, tf_isp = -945668140, tf_ebx = 139845116, tf_edx = 1048576, tf_ecx = 14, tf_eax = 29, tf_trapno = 22, tf_err = 2, tf_eip = 135653636, tf_cs = 31, tf_eflags = 535, tf_esp = 139844916, tf_ss = 47}) at ../../i386/i386/trap.c:1175 #9 0xc023ecd5 in Xint0x80_syscall () #10 0x807d25a in ?? () #11 0x80a8050 in ?? () #12 0x81463c1 in ?? () #13 0x8147ae5 in ?? () #14 0x8147a65 in ?? () #15 0x855de7c in ?? () Cannot access memory at address 0x158. (kgdb) up #1 0xc01582f1 in boot (howto=260) at ../../kern/kern_shutdown.c:324 324 dumpsys(); (kgdb) up #2 0xc015878d in panic ( fmt=0xc02a7be0 "malloc(M_WAITOK) in interrupt context") at ../../kern/kern_shutdown.c:634 634 boot(bootopt); (kgdb) up #3 0xc01535fb in malloc (size=10, type=0xc02fbac0, flags=0) at ../../kern/kern_malloc.c:157 157 KASSERT(intr_nesting_level == 0, (kgdb) list 152 #endif 153 register struct malloc_type *ksp = type; 154 155 #if defined(INVARIANTS) && defined(__i386__) 156 if (flags == M_WAITOK) 157 KASSERT(intr_nesting_level == 0, 158 ("malloc(M_WAITOK) in interrupt context")); 159 #endif 160 /* 161 * Must be at splmem() prior to initializing segment to handle (kgdb) up #4 0xc017e9eb in dup_sockaddr (sa=0xc05e3114, canwait=1) at ../../kern/uipc_socket2.c:928 928 MALLOC(sa2, struct sockaddr *, sa->sa_len, M_SONAME, (kgdb) list 923 struct sockaddr *sa; 924 int canwait; 925 { 926 struct sockaddr *sa2; 927 928 MALLOC(sa2, struct sockaddr *, sa->sa_len, M_SONAME, 929 canwait ? M_WAITOK : M_NOWAIT); 930 if (sa2) 931 bcopy(sa, sa2, sa->sa_len); 932 return sa2; (kgdb) up #5 0xc017b5b2 in soreceive (so=0xc6db1bc0, psa=0xc7a23e9c, uio=0xc7a23ec8, mp0=0x0, controlp=0x0, flagsp=0xc7a23f24) at ../../kern/uipc_socket.c:777 777 *psa = dup_sockaddr(mtod(m, struct sockaddr *), (kgdb) list 772 nextrecord = m->m_nextpkt; 773 if (pr->pr_flags & PR_ADDR) { 774 KASSERT(m->m_type == MT_SONAME, ("receive 1a")); 775 orig_resid = 0; 776 if (psa) 777 *psa = dup_sockaddr(mtod(m, struct sockaddr *), 778 mp0 == 0); 779 if (flags & MSG_PEEK) { 780 m = m->m_next; 781 } else { (kgdb)