Date: Fri, 29 Jul 2005 00:19:52 +0100 (BST) From: Robert Watson <rwatson@FreeBSD.org> To: Rong-En Fan <grafan@gmail.com> Cc: stable@freebsd.org Subject: Re: panic: sbflush_locked on 5.4-p5/i386 Message-ID: <20050729001511.O60522@fledge.watson.org> In-Reply-To: <6eb82e0507241001615f7490@mail.gmail.com> References: <6eb82e0507241001615f7490@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 25 Jul 2005, Rong-En Fan wrote: > I have a 5.4-p5 running on i386. Got a panic: panic: sbflush_locked: cc > 0 || mb 0xc33bf000 || mbcnt 4294967040 It is an web server running > Apache and Postfix as a backup MX. I'm using gmirror on all partitions > and thus cannot get a dump (swap is on gmirror). Some ddb outputs are > below. Is this system an SMP and/or HTT system? If this problem is reproduceable, could I ask you to capture the following serial console output from DDB: show pcpu show pcpu 0 show pcpu 1 show pcpu 2 show pcpu 3 # continue until out of CPU's ps And then traces of interesting threads -- in particular, threads mentioned in the pcpu output, the current thread, and threads of network-related processors (most importantly, the netisr thread, but also other active threads -- i.e., without a wchan listed). This sounds like a race between two threads in the TCP code, but to diagnose it further, I'll need to know what else is running. If you have access to serial gdb, I'd be quite interested in seeing the output of "l *so" in the sofree() frame, *tp in a tcp-related frame, and *inp if it's available in one of those frames, likely the in_pcbdetach() frame or tcp_close() frame if it's there. Would it be possible to add an extra ATA disk to use for swap and capturing a core dump? Robert N M Watson > > Google told me that > http://lists.freebsd.org/pipermail/freebsd-current/2004-December/044535.html > looks related. But the code path is different. Note that the patch in > that mail is already in 5.4. > > If needed, I can provide kernel conf. I also tuned following sysctls: > vfs.hirunningspace=2097152 > kern.ipc.somaxconn=4096 > kern.maxfiles=30000 > kern.maxfilesperproc=30000 > net.inet.ip.random_id=1 > machdep.hyperthreading_allowed=1 > > The DDB messages go here: > cpuid = 3 > KDB: enter: panic > [thread pid 61 tid 100061 ] > Stopped at kdb_enter+0x2b: nop > db> wh > Tracing pid 61 tid 100061 td 0xc311e180 > kdb_enter(c05f3bc6) at kdb_enter+0x2b > panic(c05f6f09,0,c33bf000,ffffff00,c3a1970c) at panic+0x127 > sbflush_locked(c3a1970c,c3a19654,e74aeba4,c04e4cb4,c3a1970c) at > sbflush_locked+0x6f > sbrelease_locked(c3a1970c,c3a19654) at sbrelease_locked+0xd > sofree(c3a19654) at sofree+0x26c > in_pcbdetach(c371d870,c3e996f0,c3e996f0,e74aec9c,c05355df) at in_pcbdetach+0xb6 > tcp_close(c3e996f0,1,1,1042e,1) at tcp_close+0x16 > tcp_input(c4513400,14,1c1e708c,0,0) at tcp_input+0x2297 > ip_input(c4513400) at ip_input+0x4f1 > netisr_processqueue(c0643298) at netisr_processqueue+0xa3 > swi_net(0) at swi_net+0xf2 > ithread_loop(c3094c80,e74aed48) at ithread_loop+0x159 > fork_exit(c049c138,c3094c80,e74aed48) at fork_exit+0x75 > fork_trampoline() at fork_trampoline+0x8 > --- trap 0x1, eip = 0, esp = 0xe74aed7c, ebp = 0 --- > db> ps > 61 c311ce20 0 0 0 0000204 [CPU 3] swi1: net > > Regards, > Rong-En Fan > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050729001511.O60522>