Date: Mon, 15 Jul 2013 15:16:37 +0600 From: "Eugene M. Zheganin" <emz@norma.perm.ru> To: freebsd-current@freebsd.org Subject: Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168 Message-ID: <51E3BDF5.7030602@norma.perm.ru> In-Reply-To: <20130701231011.GA1406@garage.freebsd.pl> References: <51CFDC86.2040506@FreeBSD.org> <20130630111836.GB22492@dft-labs.eu> <20130701231011.GA1406@garage.freebsd.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi.
On 02.07.2013 05:10, Pawel Jakub Dawidek wrote:
> On Sun, Jun 30, 2013 at 01:18:36PM +0200, Mateusz Guzik wrote:
>>
>> Turns out the bug is quite funny ;)
>>
>> Try this:
>> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
>> index 5d8e814..7a4db04 100644
>> --- a/sys/kern/uipc_usrreq.c
>> +++ b/sys/kern/uipc_usrreq.c
>> @@ -1764,8 +1764,8 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
>> }
>> for (i = 0; i < newfds; i++, fdp++) {
>> fde = &fdesc->fd_ofiles[*fdp];
>> - fde->fde_file = fdep[0]->fde_file;
>> - filecaps_move(&fdep[0]->fde_caps,
>> + fde->fde_file = fdep[i]->fde_file;
>> + filecaps_move(&fdep[i]->fde_caps,
>> &fde->fde_caps);
>> if ((flags & MSG_CMSG_CLOEXEC) != 0)
>> fde->fde_flags |= UF_EXCLOSE;
> Thanks for tracking it down before I had time to get to it!
> The change looks good.
>
Guys, if this is working, why it's not commited to HEAD ? I'm still
hitting this bug on r251990 and later ones.
Thanks.
Eugene.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?51E3BDF5.7030602>