Date: Mon, 12 Mar 2007 20:00:39 +0300 From: Yar Tikhiy <yar@comp.chem.msu.su> To: Bruce M Simpson <bms@incunabulum.net> Cc: freebsd-gnats-submit@FreeBSD.org, Gleb Smirnoff <glebius@FreeBSD.org>, net@FreeBSD.org Subject: Re: kern/86848: [pf][multicast] destroying active syncdev leads to panic Message-ID: <20070312170038.GG44732@comp.chem.msu.su> In-Reply-To: <45E1B629.6080607@incunabulum.net> References: <45E1B629.6080607@incunabulum.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Feb 25, 2007 at 04:15:37PM +0000, Bruce M Simpson wrote:
>
> Please try the attached patch which should hopefully fix this issue
> (untested).
I'm sorry to come up with bad news, but the patch resulted in a
different panic:
--
Yar
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex pf task mtx r = 0 (0xc0679ee4) locked @ contrib/pf/net/if_ pfsync.c:1897
KDB: stack backtrace:
db_trace_self_wrapper(c0625b0a) at db_trace_self_wrapper+0x25
kdb_backtrace(1,0,c,cccbcadc,cccbcad0,...) at kdb_backtrace+0x29
witness_warn(5,0,c0641504) at witness_warn+0x192
trap(cccbcadc) at trap+0x144
calltrap() at calltrap+0x6
--- trap 0xc, eip = 0xc056a4ab, esp = 0xcccbcb1c, ebp = 0xcccbcb24 ---
in_delmulti(c1982ae0,c1a1e4a0,cccbcb60,c055ae35,c19d5300,...) at in_delmulti+0xb
pfsync_ifdetach(c19d5300,c19d0c00,c1a1a00c,0,c062ec24,...) at pfsync_ifdetach+0x 99
if_detach(c19d0c00,c19d0c00,c19d0c00,cccbcb8c,c1b12be8,...) at if_detach+0x2cd
ether_ifdetach(c19d0c00,c19d0c00,c1b14840,2d,cccbcbc4,...) at ether_ifdetach+0x3 a
vlan_clone_destroy(c1b14840,c19d0c00,c19d0c00,c1b133ee,c1b14870,0,c062f063,d6) a t vlan_clone_destroy+0x14
if_clone_destroyif(c1b14840,c19d0c00,80206979,c19aa720,cccbcbf4,...) at if_clone _destroyif+0xc7
if_clone_destroy(c19aa720,80206979,c1abee44,c19aa720,cccbcc1c,...) at if_clone_d estroy+0x81
ifioctl(c1abee44,80206979,c19aa720,c1ab36c0,0,...) at ifioctl+0xbe
soo_ioctl(c1aa2480,80206979,c19aa720,c18f0d00,c1ab36c0) at soo_ioctl+0x2db
kern_ioctl(c1ab36c0,3,80206979,c19aa720) at kern_ioctl+0x296
ioctl(c1ab36c0,cccbcd00) at ioctl+0xf1
syscall(cccbcd38) at syscall+0x256
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (54, FreeBSD ELF32, ioctl), eip = 0x281582df, esp = 0xbfbfe52c, ebp = 0xbfbfe548 ---
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xdeadc138
fault code = supervisor read, page not present
instruction pointer = 0x20:0xc056a4ab
stack pointer = 0x28:0xcccbcb1c
frame pointer = 0x28:0xcccbcb24
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 144 (ifconfig)
panic: from debugger
Uptime: 1m52s
Physical memory: 251 MB
Dumping 16 MB: 1
#0 doadump () at pcpu.h:147
147 pcpu.h: No such file or directory.
in pcpu.h
(kgdb) bt
#0 doadump () at pcpu.h:147
#1 0xc04e73d0 in boot (howto=260) at ../../../kern/kern_shutdown.c:409
#2 0xc04e767b in panic (fmt=0xc06150e1 "from debugger") at ../../../kern/kern_shutdown.c:563
#3 0xc045640e in db_panic (addr=-1068063573, have_addr=0, count=-1, modif=0xcccbc91c "") at ../../../ddb/db_command.c:433
#4 0xc04563a7 in db_command (last_cmdp=0xc067d804, cmd_table=0x0) at ../../../ddb/db_command.c:401
#5 0xc0456462 in db_command_loop () at ../../../ddb/db_command.c:453
#6 0xc04580ad in db_trap (type=12, code=0) at ../../../ddb/db_main.c:222
#7 0xc0505889 in kdb_trap (type=12, code=0, tf=0x0) at ../../../kern/subr_kdb.c:502
#8 0xc05fcc1d in trap_fatal (frame=0xcccbcadc, eva=3735929144) at ../../../i386/i386/trap.c:859
#9 0xc05fc2cc in trap (frame=0xcccbcadc) at ../../../i386/i386/trap.c:276
#10 0xc05e8ddb in calltrap () at ../../../i386/i386/exception.s:139
#11 0xc056a4ab in in_delmulti (inm=0xc1982ae0) at ../../../netinet/in.c:1052
#12 0xc0433f99 in pfsync_ifdetach (arg=0xc19d5300, ifp=0xc19cee00) at ../../../contrib/pf/net/if_pfsync.c:1908
#13 0xc055ae35 in if_detach (ifp=0xc19d0c00) at ../../../net/if.c:709
#14 0xc055fb9a in ether_ifdetach (ifp=0xc19d0c00) at ../../../net/if_ethersubr.c:917
#15 0xc1b12be8 in vlan_clone_destroy (ifc=0xc1b14840, ifp=0xc19d0c00) at /usr/src/sys/modules/if_vlan/../../net/if_vlan.c:766
#16 0xc055e27f in if_clone_destroyif (ifc=0xc1b14840, ifp=0xc19d0c00) at ../../../net/if_clone.c:218
#17 0xc055e1b1 in if_clone_destroy (name=0xc19aa720 "vlan0") at ../../../net/if_clone.c:196
#18 0xc055d03a in ifioctl (so=0xc1abee44, cmd=2149607801, data=0xc19aa720 "vlan0", td=0xc1ab36c0) at ../../../net/if.c:1810
#19 0xc0518237 in soo_ioctl (fp=0xc19cee00, cmd=2149607801, data=0xc19aa720, active_cred=0xc18f0d00, td=0xc1ab36c0)
at ../../../kern/sys_socket.c:202
#20 0xc0512f7a in kern_ioctl (td=0xc1ab36c0, fd=3, com=2149607801, data=0xc19aa720 "vlan0") at file.h:266
#21 0xc0512c9d in ioctl (td=0xc1ab36c0, uap=0xcccbcd00) at ../../../kern/sys_generic.c:544
#22 0xc05fcf12 in syscall (frame=0xcccbcd38) at ../../../i386/i386/trap.c:1008
#23 0xc05e8e40 in Xint0x80_syscall () at ../../../i386/i386/exception.s:196
#24 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) frame 11
#11 0xc056a4ab in in_delmulti (inm=0xc1982ae0) at ../../../netinet/in.c:1052
1052 ifp = inm->inm_ifp;
(kgdb) p inm
$4 = (struct in_multi *) 0xc1982ae0
(kgdb) p *inm
$5 = {inm_link = {le_next = 0xdeadc0de, le_prev = 0xdeadc0de}, inm_addr = {s_addr = 3735929054}, inm_ifp = 0xdeadc0de,
inm_ifma = 0xdeadc0de, inm_timer = 3735929054, inm_state = 3735929054, inm_rti = 0xc0665040}
%%% EOF %%%
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070312170038.GG44732>