From owner-freebsd-current@freebsd.org Sun Jan 28 22:22:15 2018 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 19A39EE2C7B for ; Sun, 28 Jan 2018 22:22:15 +0000 (UTC) (envelope-from def@FreeBSD.org) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id A4CBE715F5 for ; Sun, 28 Jan 2018 22:22:14 +0000 (UTC) (envelope-from def@FreeBSD.org) Received: by mailman.ysv.freebsd.org (Postfix) id 64103EE2C6E; Sun, 28 Jan 2018 22:22:14 +0000 (UTC) Delivered-To: current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4210EEE2C6D for ; Sun, 28 Jan 2018 22:22:14 +0000 (UTC) (envelope-from def@FreeBSD.org) Received: from troz.pl (troz.pl [37.187.125.115]) by mx1.freebsd.org (Postfix) with ESMTP id BAE5C715F2 for ; Sun, 28 Jan 2018 22:22:13 +0000 (UTC) (envelope-from def@FreeBSD.org) Received: from [192.168.1.140] (3224033-cl69.boa.fiberby.dk [89.23.224.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by troz.pl (Postfix) with ESMTPSA id A66DC98; Sun, 28 Jan 2018 23:22:12 +0100 (CET) Subject: Re: Panic on shutdown @r328436: "Unholding 6 with cnt = -559038242" To: Warner Losh , thomas masper Cc: FreeBSD Current References: <20180126122947.GA1287@albert.catwhisker.org> <20180126150710.GV1287@albert.catwhisker.org> From: Konrad Witaszczyk Message-ID: Date: Sun, 28 Jan 2018 23:22:08 +0100 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="VtflopWLmYIeDj1YLhKUTDjETETL8iAIo" X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jan 2018 22:22:15 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --VtflopWLmYIeDj1YLhKUTDjETETL8iAIo Content-Type: multipart/mixed; boundary="leT38lHe12LKG3Iu8lpLMUPogGckJAwzE"; protected-headers="v1" From: Konrad Witaszczyk To: Warner Losh , thomas masper Cc: FreeBSD Current Message-ID: Subject: Re: Panic on shutdown @r328436: "Unholding 6 with cnt = -559038242" References: <20180126122947.GA1287@albert.catwhisker.org> <20180126150710.GV1287@albert.catwhisker.org> In-Reply-To: --leT38lHe12LKG3Iu8lpLMUPogGckJAwzE Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 01/28/2018 22:28, Warner Losh wrote: > On Sun, Jan 28, 2018 at 2:22 PM, thomas masper > wrote: >=20 >> Hi, >> similar panic happen to me when extracting a pendrive from laptop USB = port >> (I tried 3 different pendrive). >> No issue if I reboot or shutdown. I don't know if those two issues are= >> related. >> >=20 > Do you have a reproducible test case? Ideally, it would be 'insert and > remove usb thumb drive' but maybe there's more steps between insert and= > removal. >=20 > Warner I hit the same problem after upgrading to r328500. I booted my laptop fro= m a pendrive, got a GELI password prompt, removed the pendrive, typed in a GE= LI password and then I got the kernel panic. Removing the pendrive at an ear= lier stage is a workaround for me at the moment. >> panic: Releasing 6 with cnt =3D -559038242 >> >> GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD] >> Copyright (C) 2017 Free Software Foundation, Inc. >> License GPLv3+: GNU GPL version 3 or later > html >>> >> This is free software: you are free to change and redistribute it. >> There is NO WARRANTY, to the extent permitted by law. Type "show copy= ing" >> and "show warranty" for details. >> This GDB was configured as "x86_64-portbld-freebsd12.0". >> Type "show configuration" for configuration details. >> For bug reporting instructions, please see: >> . >> Find the GDB manual and other documentation resources online at: >> . >> For help, type "help". >> Type "apropos word" to search for commands related to "word"... >> Reading symbols from /boot/kernel/kernel...Reading symbols from >> /usr/lib/debug//boot/kernel/kernel.debug...done. >> done. >> >> Unread portion of the kernel message buffer: >> da0 at umass-sim0 bus 0 scbus4 target 0 lun 0 >> da0: s/n 30E47C20 detached >> (da0:umass-sim0:0:0:0): Periph destroyed >> panic: Releasing 6 with cnt =3D -559038242 >> cpuid =3D 0 >> time =3D 1517158352 >> KDB: stack backtrace: >> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame >> 0xfffffe00593838c0 >> vpanic() at vpanic+0x18d/frame 0xfffffe0059383920 >> panic() at panic+0x43/frame 0xfffffe0059383980 >> dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0 >> g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe005938= 39d0 >> g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839= f0 >> g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30 >> g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70 >> fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0 >> fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0 >> --- trap 0, rip =3D 0, rsp =3D 0, rbp =3D 0 --- >> KDB: enter: panic >> >> __curthread () at ./machine/pcpu.h:229 >> 229 __asm("movq %%gs:%1,%0" : "=3Dr" (td) >> (kgdb) #0 __curthread () at ./machine/pcpu.h:229 >> #1 doadump (textdump=3D0) at /usr/src/sys/kern/kern_shutdown.c:346 >> #2 0xffffffff8040a08b in db_dump (dummy=3D, >> dummy2=3D, dummy3=3D, dummy4=3D) >> at /usr/src/sys/ddb/db_command.c:574 >> #3 0xffffffff80409e59 in db_command (last_cmdp=3D, >> cmd_table=3D, dopager=3D) >> at /usr/src/sys/ddb/db_command.c:481 >> #4 0xffffffff80409bd4 in db_command_loop () >> at /usr/src/sys/ddb/db_command.c:534 >> #5 0xffffffff8040cdff in db_trap (type=3D, code=3D> out>) >> at /usr/src/sys/ddb/db_main.c:250 >> #6 0xffffffff80b0d923 in kdb_trap (type=3D3, code=3D-61456, tf=3D> out>) >> at /usr/src/sys/kern/subr_kdb.c:697 >> #7 0xffffffff80f7b498 in trap (frame=3D0xfffffe00593837f0) >> at /usr/src/sys/amd64/amd64/trap.c:547 >> #8 >> #9 kdb_enter (why=3D0xffffffff811f101e "panic", msg=3D= ) >> at /usr/src/sys/kern/subr_kdb.c:479 >> #10 0xffffffff80ac8d3a in vpanic (fmt=3D, >> ap=3D0xfffffe0059383960) >> at /usr/src/sys/kern/kern_shutdown.c:800 >> #11 0xffffffff80ac8dc3 in panic ( >> fmt=3D0xffffffff81b1bbd8 "\257\257\033\201\377\377\37= 7\ >> 377") >> at /usr/src/sys/kern/kern_shutdown.c:738 >> #12 0xffffffff80368bb2 in da_periph_release (periph=3D,= >> token=3DDA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591 >> #13 dadiskgonecb (dp=3D) at >> /usr/src/sys/cam/scsi/scsi_da.c:1904 >> #14 0xffffffff80a0fdd5 in g_disk_providergone (pp=3D0xfffff80003e8b700= ) >> at /usr/src/sys/geom/geom_disk.c:783 >> #15 0xffffffff80a15f9e in g_destroy_provider (pp=3D0xfffff80003e8b700)= >> at /usr/src/sys/geom/geom_subr.c:746 >> #16 0xffffffff80a15e17 in g_wither_washer () >> at /usr/src/sys/geom/geom_subr.c:461 >> #17 0xffffffff80a112da in g_run_events () >> at /usr/src/sys/geom/geom_event.c:297 >> #18 0xffffffff80a89444 in fork_exit ( >> callout=3D0xffffffff80a138c0 , arg=3D0x0, >> frame=3D0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039 >> #19 >> (kgdb) >> >> >> uname -a >> FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13 >> r328509M: Sun Jan 28 15:38:35 CET 2018 >> tommy@laptopW530.tommyBSD.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC= >> amd64 >> >> Regards, >> thomas >> >> >> On Fri, Jan 26, 2018 at 4:07 PM, David Wolfskill >> wrote: >> >>> On Fri, Jan 26, 2018 at 07:47:48AM -0700, Warner Losh wrote: >>>> On Fri, Jan 26, 2018 at 5:29 AM, David Wolfskill >> >>>> wrote: >>>> >>>>> This is on my "build machine" (laptop is still building updated por= ts >>>>> for today, so I don't know yet whether or not it encounters this.) >>>>> >>>> >>>> Running a kernel with INVARIANTS, right? >>> >>> Yes -- GENERIC. >>> >>>>> I had performed a source-based update from r328393 to r328436, >>>>> rebooted, performed "make delete-old-libs", and all seemed well. >>>>> >>>> >>>> This has my change 328415 in it. >>> >>> :-) >>> >>>>> I then issued "sudo shutdown -p now", and serial console shows: >>>>> panic: Unholding 6 with cnt =3D -559038242 >>>>> cpuid =3D 3 >>>>> time =3D 1516968697 >>>>> KDB: stack backtrace: >>>>> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame >>>>> 0xfffffe00004288c0 >>>>> vpanic() at vpanic+0x18d/frame 0xfffffe0000428920 >>>>> panic() at panic+0x43/frame 0xfffffe0000428980 >>>>> dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0 >>>>> g_disk_providergone() at g_disk_providergone+0x25/frame >>> 0xfffffe00004289d0 >>>>> g_destroy_provider() at g_destroy_provider+0xae/frame >>> 0xfffffe00004289f0 >>>>> g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30 >>>>> g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70 >>>>> fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0 >>>>> fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0 >>>>> --- trap 0, rip =3D 0, rsp =3D 0, rbp =3D 0 --- >>>>> KDB: enter: panic >>>>> [ thread pid 13 tid 100044 ] >>>>> Stopped at kdb_enter+0x3b: movq $0,kdb_why >>>>> db> >>>>> >>>> >>>> That's no good. We're releasing a reference to the da peripheral >> because >>>> geom has finished with the disk and is giving us a final callback so= we >>> can >>>> drop the reference we took when we created the geom. Trouble is, cnt= >>> should >>>> be like 1 always for this code, but it's not. It looks like it may b= e >>> bytes >>>> to a pointer :( >>>> >>>> >>>>> As noted, this is a build machine, and it was to be powered off for= >>>>> the rest of the day anyway, so I don't need to get it up & running >>>>> immediately: I can poke at the ddb prompt, given some clues. >>>>> >>>> >>>> I don't suppose you can attach kgdb to this machine? I'd be interest= ed >> to >>>> see what the contents of the softc are...a >>> >>> Pointer to how to do that? >>> >>> I do have ddb right now.... >>> >>>> .... >>>> Thanks for the report. This is quite troubling. >>> >>> Well, let's get it fixed, then! :-) >>> >>>> Warner >>>> .... >>> >>> I should still have access to the serial console after I get in to th= e >>> office (heading out shortly). >>> >>> Peace, >>> david >>> -- >>> David H. Wolfskill david@catwhisker.org >>> "unfortunately, no trust!=E2=80=9D -- well, of course! You reap what= you sow. >>> >>> See http://www.catwhisker.org/~david/publickey.gpg for my public key.= >>> >> _______________________________________________ >> freebsd-current@freebsd.org mailing list >> https://lists.freebsd.org/mailman/listinfo/freebsd-current >> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.= org" >> > _______________________________________________ > freebsd-current@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.o= rg" --leT38lHe12LKG3Iu8lpLMUPogGckJAwzE-- --VtflopWLmYIeDj1YLhKUTDjETETL8iAIo Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEE/bUwFm9Qs8vtm2934cEiWwsmpPAFAlpuTRBfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZE QjUzMDE2NkY1MEIzQ0JFRDlCNkY3N0UxQzEyMjVCMEIyNkE0RjAACgkQ4cEiWwsm pPBAFg//T6ob21EIjLPXC9LFvpsk30wmy7genVtJu3ONA6wXAspGxzK2Eka9usio v6IGM6RatWVBKoLt2naDJALo+hsEwfBLLuYJVBGOVHEbI+lo4wGI50dDr6vKVtjT 4Xg2tUXWH/E8l/y0R1Ag88bvQT+agFprSprfCChxMI006TZJH8qRaMQNVu+hhoML LoLotneavaQsPB32W712G+38+4cgJfxutO16exFQChMPNv0EPVJPDV1Hqs74VpDW o+ploudOCuFxD/M+yNRJvBCLqDUKKe9CO/+yyXDSU9dRRz3uxpvcfnualcKEhanF W5HvjpoVkfIE54esmd56yDmLUJ0uuIG6UW9v+VFC4sNT9/NRRO9I1Cq+oO8ipXrH +a/mQ/52ylT5FVA7P11nz89CA/y02vp6xpagSx93vKd1ypPGR7jSlXIbyl6HfDcd 5g6TA6qnb5knHisaSCMjlHdJ7T8w7Ukzju2q+5DyoWYzP2bfvtHhAJ8W2ksbjuPg bbp0pfmyCDEioI97gosCvyTaFCZ3OuV/sc8cXpGUxTn8jtQ1V3mA2MpyGHGdKo4A BG46SiYDWmruVd/YNStcuvepMh+IgJpdD6vezHjRAwOE7/9xOj46vGF8J/Vtx1b0 YMDxLMNOvEpWPyr/sAm+YU1h+zVZZWv6T1Jncvydlzb8tLbSfZk= =5pux -----END PGP SIGNATURE----- --VtflopWLmYIeDj1YLhKUTDjETETL8iAIo--