From owner-freebsd-bugs@freebsd.org Mon Jan 30 03:04:24 2017 Return-Path: Delivered-To: freebsd-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id DA2B1CC7BFF for ; Mon, 30 Jan 2017 03:04:24 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C98A5846 for ; Mon, 30 Jan 2017 03:04:24 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id v0U34ONr058697 for ; Mon, 30 Jan 2017 03:04:24 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 204340] [panic] nfsd, em, msix, fatal trap 9 Date: Mon, 30 Jan 2017 03:04:24 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 10.2-RELEASE X-Bugzilla-Keywords: IntelNetworking, crash, patch X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: rmacklem@FreeBSD.org X-Bugzilla-Status: Closed X-Bugzilla-Resolution: FIXED X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: rmacklem@FreeBSD.org X-Bugzilla-Flags: mfc-stable9- mfc-stable10+ X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Jan 2017 03:04:25 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D204340 --- Comment #18 from Rick Macklem --- Andriy Gapon, did your crash occur when the machine was being shut down (or the nfsd threads were being killed off)? If not, it is not caused by what these patches were intended for. (They are in 10.3.) Your crash basically indicates that either: 1 - The sg_group was free'd when a socket upcall was still in progress. Since the sg_group structures aren't free'd until the nfsd threads are killed (shutdown or ??), I don't think this can happen during normal operation. OR 2 - The xprt structure that referenced the sg_group was free'd prematurely and the sg pointer was bogus. If it was #2, I think I can come up with a simple patch to avoid this. (Basically acquire a reference count on the xprt structure during the socket upcall.) rick --=20 You are receiving this mail because: You are on the CC list for the bug.=