Date: Sun, 30 Jun 2013 13:18:36 +0200 From: Mateusz Guzik <mjguzik@gmail.com> To: koobs@FreeBSD.org Cc: freebsd-current@FreeBSD.org Subject: Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168 Message-ID: <20130630111836.GB22492@dft-labs.eu> In-Reply-To: <51CFDC86.2040506@FreeBSD.org> References: <51CFDC86.2040506@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jun 30, 2013 at 05:21:42PM +1000, Kubilay Kocak wrote: > I'm seeing what I believe is related panic, reliably being generated by > the Python regression test suite on a newly created FreeBSD 10-CURRENT > buildbot. > > Symptoms first seen in an freebsd.org FTP snapshot dated "Thu May 30 > 20:01:46 UTC 2013" and also reproducible on a freshly updated r252400 > > It is additionally reproducible after checking out pure upstream python > sources, using the following steps: > > hg clone http://hg.python.org/cpython > cd cpython && configure && make buildbottest > > An interesting possible correlation is that it seems to drop out > during/around "test_socket" > Turns out the bug is quite funny ;) Try this: diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 5d8e814..7a4db04 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -1764,8 +1764,8 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags) } for (i = 0; i < newfds; i++, fdp++) { fde = &fdesc->fd_ofiles[*fdp]; - fde->fde_file = fdep[0]->fde_file; - filecaps_move(&fdep[0]->fde_caps, + fde->fde_file = fdep[i]->fde_file; + filecaps_move(&fdep[i]->fde_caps, &fde->fde_caps); if ((flags & MSG_CMSG_CLOEXEC) != 0) fde->fde_flags |= UF_EXCLOSE; -- Mateusz Guzik <mjguzik gmail.com>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130630111836.GB22492>