From owner-freebsd-stable@FreeBSD.ORG Thu Jun 5 14:44:32 2008 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E628610656C2 for ; Thu, 5 Jun 2008 14:44:32 +0000 (UTC) (envelope-from gonzo@freebsd.org) Received: from luidgi.portaone.com (luidgi.portaone.com [195.138.219.143]) by mx1.freebsd.org (Postfix) with ESMTP id CA92A8FC1E for ; Thu, 5 Jun 2008 14:44:32 +0000 (UTC) (envelope-from gonzo@freebsd.org) Received: from mail.pbxpress.com ([65.61.203.142] helo=leaf.pbxpress.com) by luidgi.portaone.com (8.11.3/8.11.3) with ESMTP (TLSv1:AES256-SHA:256)id 1K4F1W-0001kG-L8; Thu, 05 Jun 2008 05:56:58 -0700 Received: from jeeves.bluezbox.com (k3-gw.portaone.com [193.28.87.193]) (authenticated bits=0) by leaf.pbxpress.com (8.13.3/8.13.3) with ESMTP id m55D0RHf026898 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 5 Jun 2008 06:00:34 -0700 (PDT) (envelope-from gonzo@freebsd.org) Message-ID: <4847E2A4.2020509@freebsd.org> Date: Thu, 05 Jun 2008 15:57:08 +0300 From: Oleksandr Tymoshenko User-Agent: Thunderbird 2.0.0.6 (X11/20070907) MIME-Version: 1.0 To: Alexander Motin References: <48470853.6080807@FreeBSD.org> In-Reply-To: <48470853.6080807@FreeBSD.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, recieved from trusted server Cc: freebsd-stable@freebsd.org Subject: Re: Crashes in devfs. Possibly on interface creation/destruction. X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jun 2008 14:44:33 -0000 Alexander Motin wrote: > Hi. > > After recent upgrading from 6.3-RC1/mpd-5.0rc1 to 6.3-STABLE/mpd-5.1 > some of my PPPoE servers started to crash with about weekly period. > Usually they just just hang without rebooting and core dumping. Consoles > are inaccessible. All I have got from them was: > > kernel: Fatal trap 12: page fau > kernel: lt while in k > kernel: ernel > kernel: mode > kernel: > kernel: cpuid = 1; apic id = 01 > kernel: faut virtual address = 0x58 > kernel: > kernel: fault code = supervisor read, page not present > kernel: > kernel: instruction pointer = 0x20:0xc04800be > kernel: > kernel: stack pointer = 0x28:0xd690883c > kernel: frame pointer = 0x28:0 > kernel: xd6908854 > kernel: code segment = > kernel: base 0x0, limit 0xfffff, type 0x1b > kernel: > kernel: = DPL 0, pres 1, def32 1, gra > kernel: n 1 > kernel: processor eflags = interrupt > kernel: enab > kernel: led, r > kernel: esume > kernel: , IOPL > kernel: = 0 > kernel: > kernel: current process = 1835 (mpd5) > kernel: > kernel: trap number = 12 > > "fault virtual address" and "instruction pointer" are always the same. > > Address 0xc04800be looks like part of devfs code: > > addr2line -f -e kernel.debug 0xc04800be > devfs_populate_loop > /usr/src/sys/fs/devfs/devfs_devs.c:443 > > devfs_devs.c: > de = devfs_newdirent(s, q - s); > if (cdp->cdp_c.si_flags & SI_ALIAS) { > de->de_uid = 0; > de->de_gid = 0; > de->de_mode = 0755; > de->de_dirent->d_type = DT_LNK; > pdev = cdp->cdp_c.si_parent; > ->> line 443 ->> j = strlen(pdev->si_name) + 1; > de->de_symlink = malloc(j, M_DEVFS, M_WAITOK); > bcopy(pdev->si_name, de->de_symlink, j); > > 0x58 - is precisely the offset of si_name field inside of struct cdev. > So looks like pdev = cdp->cdp_c.si_parent is NULL here for some reason. > > As soon as network interfaces have respective devfs entries and looking > higher interface creation/destruction rate that newest mpd5.1 is able to > reach due to optimizations, I think it may be some kind or race > somewhere interface creation. > > Can somebody give me any hint where to look to? On a quick glance the most likely place is make_dev_alias call in net/if.c line 457. And the most likely suspect is race for if_index variable. There are even a couple of "XXX: should be locked" notes there :) -- gonzo