Date: Wed, 31 Mar 1999 19:58:23 -0600 From: Bob Willcox <bob@luke.pmr.com> To: bugs list <freebsd-bugs@freebsd.org> Subject: Re: kern/10872: Panic in soreceive() in 3.1-stable running amanda Message-ID: <19990331195822.A69831@luke.pmr.com> In-Reply-To: <199903301709.LAA33066@luke.pmr.com>; from bob@pmr.com on Tue, Mar 30, 1999 at 11:09:42AM -0600 References: <199903301709.LAA33066@luke.pmr.com>
next in thread | previous in thread | raw e-mail | index | archive | help
As a follow-up to this bug report if I remove the "options INVARIANTS"
from my kernel config file the panic moves to sbdrop as illustrated
below. Also, I have discovered that I can easily recreate the panic by
simply using using rsh and a couple of dd's to send large ammounts of
data to the panicing system simultaneiously from two other systems on
the same 100Mbps LAN. The commands I have used are:
dd count=10000 bs=32k if=/dev/zero|rsh deathstar "dd bs=32k of=/stuff/tmp/junk"
dd count=10000 bs=32k if=/dev/zero|rsh deathstar "dd bs=32k of=/stuff2/tmp/junk"
The two filesystems, /stuff and /stuff2 just happen to be my two amanda
holding disk filesystems (they are on separate physical disks).
Bob
panicstr: from debugger
panic messages:
---
panic: sbdrop
panic: from debugger
dumping to dev 20401, offset 196608
dump 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
---
#0 boot (howto=260) at ../../kern/kern_shutdown.c:285
285 dumppcb.pcb_cr3 = rcr3();
(kgdb) where
#0 boot (howto=260) at ../../kern/kern_shutdown.c:285
#1 0xf014e38d in panic (fmt=0xf02328bc "from debugger")
at ../../kern/kern_shutdown.c:446
#2 0xf012aa91 in db_panic (addr=-266267417, have_addr=0, count=-1,
modif=0xf359acc0 "") at ../../ddb/db_command.c:432
#3 0xf012aa31 in db_command (last_cmdp=0xf024fae0, cmd_table=0xf024f940,
aux_cmd_tablep=0xf0265704) at ../../ddb/db_command.c:332
#4 0xf012aaf6 in db_command_loop () at ../../ddb/db_command.c:454
#5 0xf012ce47 in db_trap (type=3, code=0) at ../../ddb/db_trap.c:71
#6 0xf02112c2 in kdb_trap (type=3, code=0, regs=0xf359adb0)
at ../../i386/i386/db_interface.c:157
#7 0xf021aa34 in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = 0,
tf_esi = 256, tf_ebp = -212226572, tf_isp = -212226600,
tf_ebx = -266111659, tf_edx = -266052200, tf_ecx = -267677952,
tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -266267417, tf_cs = 8,
tf_eflags = 598, tf_esp = -266052216, tf_ss = -266117345})
at ../../i386/i386/trap.c:548
#8 0xf02114e7 in Debugger (msg=0xf0235f1f "panic")
at ../../i386/i386/db_interface.c:317
#9 0xf014e384 in panic (fmt=0xf0237555 "sbdrop")
at ../../kern/kern_shutdown.c:444
#10 0xf0167be8 in sbdrop (sb=0xf3441184, len=4380)
at ../../kern/uipc_socket2.c:739
#11 0xf0167b71 in sbflush (sb=0xf3441184) at ../../kern/uipc_socket2.c:719
#12 0xf019ea1f in tcp_disconnect (tp=0xf3494cc0)
at ../../netinet/tcp_usrreq.c:742
#13 0xf019e21a in tcp_usr_disconnect (so=0xf3441140)
at ../../netinet/tcp_usrreq.c:268
#14 0xf0165b78 in sodisconnect (so=0xf3441140) at ../../kern/uipc_socket.c:369
#15 0xf016599a in soclose (so=0xf3441140) at ../../kern/uipc_socket.c:249
#16 0xf015c403 in soo_close (fp=0xf081c1c0, p=0xf35157e0)
at ../../kern/sys_socket.c:179
#17 0xf01471c8 in closef (fp=0xf081c1c0, p=0xf35157e0)
at ../../kern/kern_descrip.c:1065
#18 0xf0146fbf in fdfree (p=0xf35157e0) at ../../kern/kern_descrip.c:977
#19 0xf014844b in exit1 (p=0xf35157e0, rv=0) at ../../kern/kern_exit.c:199
#20 0xf01482b4 in exit1 (p=0xf35157e0, rv=-212226156)
at ../../kern/kern_exit.c:104
#21 0xf021b243 in syscall (frame={tf_es = 39, tf_ds = 39, tf_edi = 134863080,
tf_esi = 0, tf_ebp = -272639180, tf_isp = -212226076, tf_ebx = -1,
tf_edx = 1, tf_ecx = 0, tf_eax = 1, tf_trapno = 22, tf_err = 2,
tf_eip = 134761776, tf_cs = 31, tf_eflags = 582, tf_esp = -272639196,
tf_ss = 39}) at ../../i386/i386/trap.c:1100
#22 0xf0211c1c in Xint0x80_syscall ()
#23 0x805bdc3 in ?? ()
#24 0x805bb5b in ?? ()
#25 0x805b84b in ?? ()
#26 0x80480c9 in ?? ()
(kgdb) up 10
#10 0xf0167be8 in sbdrop (sb=0xf3441184, len=4380)
at ../../kern/uipc_socket2.c:739
739 panic("sbdrop");
(kgdb) list
734
735 next = (m = sb->sb_mb) ? m->m_nextpkt : 0;
736 while (len > 0) {
737 if (m == 0) {
738 if (next == 0)
739 panic("sbdrop");
740 m = next;
741 next = m->m_nextpkt;
742 continue;
743 }
--
Bob Willcox The man who follows the crowd will usually get no
bob@luke.pmr.com further than the crowd. The man who walks alone is
Austin, TX likely to find himself in places no one has ever
been. -- Alan Ashley-Pitt
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990331195822.A69831>