Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 2 Jul 2013 01:10:11 +0200
From:      Pawel Jakub Dawidek <pjd@FreeBSD.org>
To:        Mateusz Guzik <mjguzik@gmail.com>, koobs@FreeBSD.org, freebsd-current@FreeBSD.org
Subject:   Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168
Message-ID:  <20130701231011.GA1406@garage.freebsd.pl>
In-Reply-To: <20130630111836.GB22492@dft-labs.eu>
References:  <51CFDC86.2040506@FreeBSD.org> <20130630111836.GB22492@dft-labs.eu>

next in thread | previous in thread | raw e-mail | index | archive | help

--LQksG6bCIzRHxTLp
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 30, 2013 at 01:18:36PM +0200, Mateusz Guzik wrote:
> On Sun, Jun 30, 2013 at 05:21:42PM +1000, Kubilay Kocak wrote:
> > I'm seeing what I believe is related panic, reliably being generated by
> > the Python regression test suite on a newly created FreeBSD 10-CURRENT
> > buildbot.
> >=20
> > Symptoms first seen in an freebsd.org FTP snapshot dated "Thu May 30
> > 20:01:46 UTC 2013" and also reproducible on a freshly updated r252400
> >=20
> > It is additionally reproducible after checking out pure upstream python
> > sources, using the following steps:
> >=20
> > hg clone http://hg.python.org/cpython
> > cd cpython && configure && make buildbottest
> >=20
> > An interesting possible correlation is that it seems to drop out
> > during/around "test_socket"
> >=20
>=20
> Turns out the bug is quite funny ;)
>=20
> Try this:
> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
> index 5d8e814..7a4db04 100644
> --- a/sys/kern/uipc_usrreq.c
> +++ b/sys/kern/uipc_usrreq.c
> @@ -1764,8 +1764,8 @@ unp_externalize(struct mbuf *control, struct mbuf *=
*controlp, int flags)
>  			}
>  			for (i =3D 0; i < newfds; i++, fdp++) {
>  				fde =3D &fdesc->fd_ofiles[*fdp];
> -				fde->fde_file =3D fdep[0]->fde_file;
> -				filecaps_move(&fdep[0]->fde_caps,
> +				fde->fde_file =3D fdep[i]->fde_file;
> +				filecaps_move(&fdep[i]->fde_caps,
>  				    &fde->fde_caps);
>  				if ((flags & MSG_CMSG_CLOEXEC) !=3D 0)
>  					fde->fde_flags |=3D UF_EXCLOSE;

Thanks for tracking it down before I had time to get to it!
The change looks good.

--=20
Pawel Jakub Dawidek                       http://www.wheelsystems.com
FreeBSD committer                         http://www.FreeBSD.org
Am I Evil? Yes, I Am!                     http://mobter.com

--LQksG6bCIzRHxTLp
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (FreeBSD)

iEYEARECAAYFAlHSDFMACgkQForvXbEpPzRnawCgxiD6AX7hF+71/YTKmcLtLEt2
bDsAnRoCZyNLXZWN0B0zyt0cD1c9WpJz
=juSa
-----END PGP SIGNATURE-----

--LQksG6bCIzRHxTLp--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130701231011.GA1406>