From owner-freebsd-stable@FreeBSD.ORG Wed Nov 10 15:43:10 2004 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A18FD16A4CE for ; Wed, 10 Nov 2004 15:43:10 +0000 (GMT) Received: from rproxy.gmail.com (rproxy.gmail.com [64.233.170.200]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2ACC043D4C for ; Wed, 10 Nov 2004 15:43:10 +0000 (GMT) (envelope-from avleeuwen@gmail.com) Received: by rproxy.gmail.com with SMTP id 34so295110rns for ; Wed, 10 Nov 2004 07:43:04 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=DSF9CE+TQrqxNDXcFDpKeOqfyeQ0JT4FPrBS14bNp8RmFi80/2kFw0LChk4pXQsAPhz7mjjUcU3nBVrzVfGvB3pLORkeJacNWmkWvif8F2hk/z1r+a6jMS1UFxitCSG0w5bA8oAs4iqaVcnGt1LupHRAdO1ippGliPyxZIqBDSY= Received: by 10.38.8.19 with SMTP id 19mr789498rnh; Wed, 10 Nov 2004 07:43:04 -0800 (PST) Received: by 10.38.206.31 with HTTP; Wed, 10 Nov 2004 07:43:04 -0800 (PST) Message-ID: Date: Wed, 10 Nov 2004 16:43:04 +0100 From: Arjan Van Leeuwen To: Robert Watson In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: cc: sebastian@struchtrup.de cc: freebsd-stable@freebsd.org Subject: Re: Panic in 5.3, related to network traffic X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Arjan Van Leeuwen List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Nov 2004 15:43:10 -0000 On Wed, 10 Nov 2004 10:15:31 +0000 (GMT), Robert Watson wrote: > > Could you recompile your kernel with "options INVARIANTS"? It looks like > whatever is happening should be triggering one of the assertions in > m_copydata(), if not icmp_error(), and it would be helpful to track it a > little earlier before it faults. It looks like m_copydata() is alking off > of the end of an mbuf chain, since min()'s only pointer dereference is to > get the length out of an mbuf. However, under those circumstances it > shouldn't need to walk a chain. > > Another thing we may want to do for debugging purposes, subject to this > being something you can put the system through, is add an additional > warning in icmp_error() if the mbuf comes in fragmented. Something like > the following would generate a warning instead of panicking: > (...) I've applied the patch and enabled INVARIANTS. The result was that I did indeed see the warning once, but _not_ when I was trying to create a panic; I saw the warning shortly after starting the machine, I didn't yet start emule to get the panic. When I did start emule, I got a panic that looked a bit different. In this screenshot, you can see both the warning message (that appeared a lot earlier, independent of the panic) and the new panic: http://www.piwebs.com/freebsd/panic.jpg Here is what addr2line tells me: winston% addr2line -f -e kernel.debug.20041110 0xC074CF44 uma_dbg_free /usr/src/sys/vm/uma_dbg.c:308 winston% addr2line -f -e kernel.debug.20041110 0xC074BD13 uma_zfree_arg /usr/src/sys/vm/uma_core.c:2237 winston% addr2line -f -e kernel.debug.20041110 0xC0646C9A m_freem /usr/src/sys/vm/uma.h:302 winston% addr2line -f -e kernel.debug.20041110 0xC0460D11 fr_check /usr/src/sys/contrib/ipfilter/netinet/fil.c:1402 winston% addr2line -f -e kernel.debug.20041110 0xC0462052 fr_check_wrapper /usr/src/sys/contrib/ipfilter/netinet/ip_fil.c:344 winston% addr2line -f -e kernel.debug.20041110 0xC067F11D pfil_run_hooks /usr/src/sys/net/pfil.c:137 winston% addr2line -f -e kernel.debug.20041110 0xC069BE95 ip_input /usr/src/sys/netinet/ip_input.c:439 winston% addr2line -f -e kernel.debug.20041110 0xC067DB92 netisr_processqueue /usr/src/sys/net/netisr.c:229 winston% addr2line -f -e kernel.debug.20041110 0xC067DD76 swi_net /usr/src/sys/net/netisr.c:346 winston% addr2line -f -e kernel.debug.20041110 0xC06051C4 ithread_loop /usr/src/sys/kern/kern_intr.c:548 Thanks for your help, Arjan