From owner-freebsd-ipfw@FreeBSD.ORG Tue Jan 16 23:31:19 2007 Return-Path: X-Original-To: freebsd-ipfw@freebsd.org Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id D29A016A494 for ; Tue, 16 Jan 2007 23:31:19 +0000 (UTC) (envelope-from oleg@lath.rinet.ru) Received: from lath.rinet.ru (lath.rinet.ru [195.54.192.90]) by mx1.freebsd.org (Postfix) with ESMTP id 40D6813C441 for ; Tue, 16 Jan 2007 23:31:19 +0000 (UTC) (envelope-from oleg@lath.rinet.ru) Received: from lath.rinet.ru (localhost [127.0.0.1]) by lath.rinet.ru (8.13.8/8.13.8) with ESMTP id l0GN0dVr083966 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 17 Jan 2007 02:00:39 +0300 (MSK) (envelope-from oleg@lath.rinet.ru) Received: (from oleg@localhost) by lath.rinet.ru (8.13.8/8.13.8/Submit) id l0GN0dmp083965; Wed, 17 Jan 2007 02:00:39 +0300 (MSK) (envelope-from oleg) Date: Wed, 17 Jan 2007 02:00:39 +0300 From: Oleg Bulyzhin To: Olexandr Davydenko Message-ID: <20070116230039.GA83503@lath.rinet.ru> References: <200701151240.l0FCeNUV042057@freefall.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200701151240.l0FCeNUV042057@freefall.freebsd.org> User-Agent: Mutt/1.5.13 (2006-08-11) Cc: freebsd-ipfw@freebsd.org Subject: Re: kern/106534: [ipfw] [panic] ipfw + dummynet X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jan 2007 23:31:19 -0000 On Mon, Jan 15, 2007 at 12:40:23PM +0000, Olexandr Davydenko wrote: > The following reply was made to PR kern/106534; it has been noted by GNATS. > > From: Olexandr Davydenko > To: bug-followup@FreeBSD.org > Cc: > Subject: Re: kern/106534: [ipfw] [panic] ipfw + dummynet > Date: Mon, 15 Jan 2007 14:20:22 +0200 > > Similar problem with ipfw + dummynet and 132 pipes for traffic shaping: > sometimes panic when trafshow run and put interface in promiscuous > mode or in any another time. > > FreeBSD 6.1-RELEASE-p10 #1: Wed Oct 4 12:46:05 EEST 2006 > root@xxx:/server/OBJ/server/SRC/RELENG_6_1/sys/xxx > > # ifconfig > fxp0: flags=8843 mtu 1500 > options=48 > ether 00:90:27:10:33:b4 > media: Ethernet autoselect (100baseTX ) > status: active > fxp1: flags=8843 mtu 1500 > options=48 > ether 00:30:48:22:58:79 > media: Ethernet 100baseTX > status: active > fxp2: flags=8843 mtu 1500 > options=48 > ether 00:30:48:22:58:7a > media: Ethernet autoselect (100baseTX ) > status: active > lo0: flags=8049 mtu 16384 > inet 127.0.0.1 netmask 0xff000000 > > kgdb output: > GNU gdb 6.1.1 [FreeBSD] > Copyright 2004 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "i386-marcel-freebsd". > > Unread portion of the kernel message buffer: > > > Fatal trap 12: page fault while in kernel mode > fault virtual address = 0xc > fault code = supervisor read, page not present > instruction pointer = 0x20:0xc0516ffb > stack pointer = 0x28:0xcbd36b60 > frame pointer = 0x28:0xcbd36b84 > code segment = base 0x0, limit 0xfffff, type 0x1b > = DPL 0, pres 1, def32 1, gran 1 > processor eflags = interrupt enabled, resume, IOPL = 0 > current process = 12 (swi4: clock sio) > trap number = 12 > panic: page fault > Uptime: 29d17h3m30s > Dumping 254 MB (2 chunks) > chunk 0: 1MB (159 pages) ... ok > chunk 1: 254MB (65024 pages) 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15 > > #0 doadump () at pcpu.h:165 > in pcpu.h > (kgdb) bt > #0 doadump () at pcpu.h:165 > #1 0xc04e1b65 in boot (howto=260) at /server/SRC/RELENG_6_1/sys/kern/kern_shutdown.c:402 > #2 0xc04e1dfc in panic (fmt=0xc063e3b0 "%s") at /server/SRC/RELENG_6_1/sys/kern/kern_shutdown.c:558 > #3 0xc06254fc in trap_fatal (frame=0xcbd36b20, eva=12) at /server/SRC/RELENG_6_1/sys/i386/i386/trap.c:836 > #4 0xc0625263 in trap_pfault (frame=0xcbd36b20, usermode=0, eva=12) > at /server/SRC/RELENG_6_1/sys/i386/i386/trap.c:744 > #5 0xc0624ec1 in trap (frame= > {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -1014294700, tf_esi = 320, tf_ebp = -875336828, tf_isp = -875336884, tf_ebx = -1014294784, tf_edx = 0, tf_ecx = -1026586592, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1068404741, tf_cs = 32, tf_eflags = 590338, tf_esp = 0, tf_ss = -875336824}) > at /server/SRC/RELENG_6_1/sys/i386/i386/trap.c:434 > #6 0xc06153ba in calltrap () at /server/SRC/RELENG_6_1/sys/i386/i386/exception.s:139 > #7 0xc0516ffb in m_copym (m=0x0, off0=1500, len=1480, wait=1) > at /server/SRC/RELENG_6_1/sys/kern/uipc_mbuf.c:400 > #8 0xc056bff8 in ip_fragment (ip=0xc2cf8820, m_frag=0xcbd36c3c, mtu=-1014294784, if_hwassist_flags=0, > sw_csum=1) at /server/SRC/RELENG_6_1/sys/netinet/ip_output.c:975 > #9 0xc056bc9e in ip_output (m=0xc33a1c00, opt=0xc1d8e000, ro=0xcbd36c08, flags=1, imo=0x0, inp=0x0) > at /server/SRC/RELENG_6_1/sys/netinet/ip_output.c:804 > #10 0xc055ef71 in dummynet_send (m=0xc33a1c00) at /server/SRC/RELENG_6_1/sys/netinet/ip_dummynet.c:771 > #11 0xc055ef04 in dummynet (unused=0x0) at /server/SRC/RELENG_6_1/sys/netinet/ip_dummynet.c:753 > #12 0xc04edc97 in softclock (dummy=0x0) at /server/SRC/RELENG_6_1/sys/kern/kern_timeout.c:290 > #13 0xc04cc391 in ithread_execute_handlers (p=0xc1d97830, ie=0xc1d95600) > at /server/SRC/RELENG_6_1/sys/kern/kern_intr.c:684 > #14 0xc04cc4a8 in ithread_loop (arg=0xc1d83780) at /server/SRC/RELENG_6_1/sys/kern/kern_intr.c:767 > #15 0xc04cb300 in fork_exit (callout=0xc04cc454 , arg=0xc1d83780, frame=0xcbd36d38) > at /server/SRC/RELENG_6_1/sys/kern/kern_fork.c:805 > #16 0xc061541c in fork_trampoline () at /server/SRC/RELENG_6_1/sys/i386/i386/exception.s:208 > (kgdb) up 7 > #7 0xc0516ffb in m_copym (m=0x0, off0=1500, len=1480, wait=1) > at /server/SRC/RELENG_6_1/sys/kern/uipc_mbuf.c:400 > 400 if (off < m->m_len) > (kgdb) list > 395 MBUF_CHECKSLEEP(wait); > 396 if (off == 0 && m->m_flags & M_PKTHDR) > 397 copyhdr = 1; > 398 while (off > 0) { > 399 KASSERT(m != NULL, ("m_copym, offset > size of mbuf chain")); > 400 if (off < m->m_len) > 401 break; > 402 off -= m->m_len; > 403 m = m->m_next; > 404 } > (kgdb) quit > > > > -- > WBR, > Davidenko Alexandr > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" As i can see kernel dies trying to fit packet into interface with negative mtu. Would be fine to dump ro->ro_rt->rt_ifp structure. (Do some 'up' commands until you are in ip_output, then print ro->ro_rt->rt_ifp). -- Oleg. ================================================================ === Oleg Bulyzhin -- OBUL-RIPN -- OBUL-RIPE -- oleg@rinet.ru === ================================================================