Date: Sat, 21 Jan 2006 02:18:50 +0200 From: Ion-Mihai Tetcu <itetcu@people.tecnik93.com> To: freebsd-stable@freebsd.org Subject: 6-STABLE from 19: panic: mb_dtor_mbuf: M_EXT set Message-ID: <20060121021850.62042b95@it.buh.tecnik93.com>
next in thread | raw e-mail | index | archive | help
Hi,
On ifconfig vr0 up I get each time a the panic bellow; last good kernel
I have is from Dec 31 and if_vr hasn't been touched since November.
# kgdb /usr/obj/usr/src/sys/IT6_U/kernel.debug /usr/crash/vmcore.4
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so:=
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain condition=
s.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
Unread portion of the kernel message buffer:
[ ... ]
vr0: <VIA VT6102 Rhine II 10/100BaseTX> port 0xe400-0xe4ff mem 0xe3004000-0=
xe30040ff irq 23 at device 18.0 on pci0
vr0: Reserved 0x100 bytes for rid 0x10 type 4 at 0xe400
miibus0: <MII bus> on vr0
ukphy0: <Generic IEEE 802.3u media interface> on miibus0
ukphy0: OUI 0x004063, model 0x0032, rev. 10
ukphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
vr0: bpf attached
vr0: Ethernet address: 00:0f:ea:0a:96:11
ioapic0: routing intpin 23 (PCI IRQ 23) to cluster 0
vr0: [MPSAFE]
pci1: driver added
found-> vendor=3D0x1002, dev=3D0x4966, revid=3D0x01
bus=3D1, slot=3D0, func=3D0
class=3D03-00-00, hdrtype=3D0x00, mfdev=3D0
cmdreg=3D0x0087, statreg=3D0x02b0, cachelnsz=3D8 (dwords)
lattimer=3D0x20 (960 ns), mingnt=3D0x08 (2000 ns), maxlat=3D0x00 (0=
ns)
intpin=3Da, irq=3D16
powerspec 2 supports D0 D1 D2 D3 current D0
pci1:0:0: reprobing on driver added
<118>#
<118>vr0: flags=3D8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
<118> ether 00:0f:ea:0a:96:11
<118> media: Ethernet autoselect (none)
<118> status: no carrier
<118>#
<118>vr0: flags=3D8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
<118> ether 00:0f:ea:0a:96:11
<118> media: Ethernet autoselect (none)
<118> status: no carrier
<118>#
panic: mb_dtor_mbuf: M_EXT set
KDB: stack backtrace:
panic(c066952c,c0650ac0,c1035048,c4d44300,e5049b14) at panic+0x13a
mb_dtor_pack(c4d44300,100,0,956,c10383c0) at mb_dtor_pack
uma_zfree_arg(c104de80,c4d44300,0,c4da7934) at uma_zfree_arg+0x36a
mb_free_ext(c4d44300,c4c01400,c4da7000,c4da7000,e5049b74) at mb_free_ext+0x=
8f
m_freem(c4d44300,0,c52e460c,67c,c4da7950) at m_freem+0x27
vr_stop(c4d9ce80,1,c52e460c,59e,c4da7950) at vr_stop+0xca
vr_init_locked(c4da7950,8,c52e460c,625,0) at vr_init_locked+0x53
vr_ioctl(c4c01400,80206910,c51a8ca0,c04ceb72,c070aee0) at vr_ioctl+0x17f
ifhwioctl(c51a8ca0,c4b6b320,c51a8ca0,20,0) at ifhwioctl+0x5c5
ifioctl(c4e789bc,80206910,c51a8ca0,c4b6b320,2) at ifioctl+0x78
soo_ioctl(c4d9a6c0,80206910,c51a8ca0,c4a9fd80,c4b6b320) at soo_ioctl+0x2e8
ioctl(c4b6b320,e5049d04,c,41d,3) at ioctl+0x118
syscall(3b,3b,3b,3,1) at syscall+0x13d
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (54, FreeBSD ELF32, ioctl), eip =3D 0x281579a7, esp =3D 0xbfbfe=
58c, ebp =3D 0xbfbfe5d8 ---
KDB: enter: panic
panic: from debugger
Uptime: 17m48s
Dumping 1023 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 1023MB (261872 pages) 1007 991 975 959 943 927 911 895 879 863 8=
47 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 =
543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255=
239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
#0 doadump () at pcpu.h:165
165 pcpu.h: No such file or directory.
in pcpu.h
(kgdb) bt full
#0 doadump () at pcpu.h:165
No locals.
#1 0xc04d8606 in boot (howto=3D260) at /usr/src/sys/kern/kern_shutdown.c:3=
99
_ep =3D (struct eventhandler_entry *) 0x0
_el =3D (struct eventhandler_list *) 0xc4d31680
first_buf_printf =3D 1
#2 0xc04d80d7 in panic (fmt=3D0xc065d2b6 "from debugger") at /usr/src/sys/=
kern/kern_shutdown.c:555
bootopt =3D 260
newpanic =3D 0
buf =3D "mb_dtor_mbuf: M_EXT set", '\0' <repeats 232 times>
#3 0xc0444592 in db_panic (addr=3D-1068544094, have_addr=3D0, count=3D-1, =
modif=3D0xe5049928 "") at /usr/src/sys/ddb/db_command.c:438
No locals.
#4 0xc0444b10 in db_command_loop () at /usr/src/sys/ddb/db_command.c:350
No locals.
#5 0xc0446934 in db_trap (type=3D3, code=3D0) at /usr/src/sys/ddb/db_main.=
c:221
jb =3D {{_jb =3D {-452683308, -452683336, -452683256, -994659552, 0=
, -1069258453, -452683124, -1, -1066911948, 672496039, -452683256, -1068543=
056}}}
prev_jb =3D (void *) 0x0
bkpt =3D 0
#6 0xc04f5432 in kdb_trap (type=3D0, code=3D0, tf=3D0xe5049a5c) at /usr/sr=
c/sys/kern/subr_kdb.c:473
handled =3D -452683172
#7 0xc0635767 in trap (frame=3D
{tf_fs =3D 8, tf_es =3D 40, tf_ds =3D 40, tf_edi =3D 256, tf_esi =3D =
1, tf_ebp =3D -452683100, tf_isp =3D -452683128, tf_ebx =3D 1, tf_edx =3D 1=
, tf_ecx =3D -1066668832, tf_eax =3D 18, tf_trapno =3D 3, tf_err =3D 0, tf_=
eip =3D -1068544094, tf_cs =3D 32, tf_eflags =3D 662, tf_esp =3D -106700425=
9, tf_ss =3D -1067012681})
at /usr/src/sys/i386/i386/trap.c:593
p =3D (struct proc *) 0xc4d99c48
sticks =3D 4
i =3D 0
ucode =3D 0
type =3D 3
code =3D 0
eva =3D 0
#8 0xc06232aa in calltrap () at /usr/src/sys/i386/i386/exception.s:139
No locals.
#9 0xc04f4fa2 in kdb_enter (msg=3D0x12 <Address 0x12 out of bounds>) at cp=
ufunc.h:60
No locals.
#10 0xc04d814c in panic (fmt=3D0x1 <Address 0x1 out of bounds>) at /usr/src=
/sys/kern/kern_shutdown.c:539
bootopt =3D 256
newpanic =3D 18
buf =3D "mb_dtor_mbuf: M_EXT set", '\0' <repeats 232 times>
#11 0xc04cced0 in mb_dtor_mbuf (mem=3D0xc4d44300, size=3D18, arg=3D0x12) at=
/usr/src/sys/kern/kern_mbuf.c:321
__func__ =3D "mb_dtor_mbuf"
#12 0xc05dd40a in uma_zfree_arg (zone=3D0xc104de80, item=3D0xc4d44300, udat=
a=3D0x0) at /usr/src/sys/vm/uma_core.c:2270
keg =3D 0xc10383c0
cache =3D 0x3f
bucket =3D 0xc4d44300
bflags =3D 1
#13 0xc05194cf in mb_free_ext (m=3D0xc4d44300) at uma.h:303
cnt =3D 3302649856
__func__ =3D "mb_free_ext"
#14 0xc05195b7 in m_freem (mb=3D0x1) at mbuf.h:484
No locals.
#15 0xc52e232a in ?? ()
---Type <return> to continue, or q <return> to quit---
No symbol table info available.
#16 0xc4d44300 in ?? ()
[ ... ]
#48 0xe5049c30 in ?? ()
No symbol table info available.
#49 0xc0555495 in ifhwioctl (cmd=3D3302649856, ifp=3D0x3f, data=3D0xc4d9ce8=
0 "", td=3D0x1) at /usr/src/sys/net/if.c:1279
oldmtu =3D 3302649856
error =3D -992317440
new_flags =3D -992317440
temp_flags =3D 18
namelen =3D 3302649856
onamelen =3D 3842284404
new_name =3D "\000C=D4=C4\000\000\000\000\fF.=C5|\006\000"
ifa =3D (struct ifaddr *) 0xc4da7000
sdl =3D (struct sockaddr_dl *) 0xc4da7000
Previous frame inner to this frame (corrupt stack?)
(kgdb) l *0xc05194cf
0xc05194cf is in mb_free_ext (/usr/src/sys/kern/uipc_mbuf.c:283).
278 }
279 m->m_ext.ext_buf =3D NULL;
280 }
281 }
282 uma_zfree(zone_mbuf, m);
283 }
284
285 /*
286 * "Move" mbuf pkthdr from "from" to "to".
287 * "from" must have M_PKTHDR set, and "to" must be empty.
(kgdb) =20
--=20
IOnut - Unregistered ;) FreeBSD "user"
"Intellectual Property" is nowhere near as valuable as "Intellect"
BOFH excuse #27:
radiosity depletion
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060121021850.62042b95>