Date: Sun, 18 Jan 2026 02:30:58 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 292547] uipc_soreceive_stream_or_seqpacket() - repeatable panic Message-ID: <bug-292547-227-YfepqoRlMz@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-292547-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | previous in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292547 --- Comment #9 from Andrew Gallatin <gallatin@FreeBSD.org> --- Created attachment 267259 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=267259&action=edit null out freed mbuf in iflib_txsd_free() Sorry about this.. I did test it a lot and never ran into this bug! What driver are you using? Its not apparent from the stack. Anyway, can you please try the attached diff? When adding the IFLIB_GET_MBUF/FLAGS abstraction, I neglected to NULL out the mbuf in the descriptor ring. I didn't think this should matter, as I thought that the ring was going to be re-alloced. But if I'm wrong, it would explain perfectly what you're seeing. A free, stale mbuf stays in the ring, and chaos ensues. -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-292547-227-YfepqoRlMz>