From owner-freebsd-current@FreeBSD.ORG  Tue Nov  8 23:13:39 2005
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: freebsd-current@freebsd.org
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8C68816A41F
	for <freebsd-current@freebsd.org>; Tue,  8 Nov 2005 23:13:39 +0000 (GMT)
	(envelope-from tinguely@casselton.net)
Received: from casselton.net (casselton.net [63.165.140.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 28D4943D45
	for <freebsd-current@freebsd.org>; Tue,  8 Nov 2005 23:13:39 +0000 (GMT)
	(envelope-from tinguely@casselton.net)
Received: from casselton.net (localhost [127.0.0.1])
	by casselton.net (8.12.11/8.12.11) with ESMTP id jA8NDbdL005917;
	Tue, 8 Nov 2005 17:13:37 -0600 (CST)
	(envelope-from tinguely@casselton.net)
Received: (from tinguely@localhost)
	by casselton.net (8.12.11/8.12.11/Submit) id jA8NDbft005916;
	Tue, 8 Nov 2005 17:13:37 -0600 (CST) (envelope-from tinguely)
Date: Tue, 8 Nov 2005 17:13:37 -0600 (CST)
From: Mark Tinguely <tinguely@casselton.net>
Message-Id: <200511082313.jA8NDbft005916@casselton.net>
To: freebsd-current@freebsd.org, snezhko@indorsoft.ru
In-Reply-To: <u64r2kgko.fsf@indorsoft.ru>
X-Spam-Status: No, score=0.6 required=5.0 tests=REPLY_TO_EMPTY autolearn=no 
	version=3.1.0
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on ccn.casselton.net
Cc: max@love2party.net
Subject: Re: CURRENT + amd64 + user-ppp = panic
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Nov 2005 23:13:39 -0000


Okay, I am alittle dense in reading the soreceive() debugger line,
basically the debugger trace must refer to an expansion of the m_free()
inline definition in soreceive().

Either a callout is not being removed when the memory is freed
and that memory is recycled to an MBUF OR someone is incorrectly
chaining a memory location into an MBUF.

before too much work is done (below), could you print out the callout
that is being freed but active and the memory around it (before it
is overwritten by "deadc0de"). It may tell us which callout that it
is or was. You should be able to do that with your existing kernel.

If we cannot glean who the callout is/was, then more tests can be
added to determine if the UMA is allocating memory chained to the callout
or if the MBUF chain is corrupted.

--Mark Tinguely