From owner-freebsd-hackers@FreeBSD.ORG  Thu Jan  2 23:54:01 2014
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 75D4C6CB;
 Thu,  2 Jan 2014 23:54:01 +0000 (UTC)
Received: from mx11.netapp.com (mx11.netapp.com [216.240.18.76])
 (using TLSv1 with cipher RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 55E641077;
 Thu,  2 Jan 2014 23:54:01 +0000 (UTC)
X-IronPort-AV: E=Sophos;i="4.95,593,1384329600"; d="scan'208";a="93338555"
Received: from vmwexceht06-prd.hq.netapp.com ([10.106.77.104])
 by mx11-out.netapp.com with ESMTP; 02 Jan 2014 15:54:00 -0800
Received: from SACEXCMBX04-PRD.hq.netapp.com ([169.254.6.58]) by
 vmwexceht06-prd.hq.netapp.com ([10.106.77.104]) with mapi id 14.03.0123.003;
 Thu, 2 Jan 2014 15:54:00 -0800
From: "Gumpula, Suresh" <Suresh.Gumpula@netapp.com>
To: Julian Elischer <julian@freebsd.org>, Alfred Perlstein <bright@mu.org>,
 "freebsd-hackers@freebsd.org" <freebsd-hackers@freebsd.org>
Subject: RE: Reference count race window
Thread-Topic: Reference count race window
Thread-Index: AQHPCA0ePlCdkUTb2Eq8swVe1xATjJpynbOA//98gUA=
Date: Thu, 2 Jan 2014 23:53:59 +0000
Message-ID: <D29CB80EBA4DEA4D91181928AAF51538438C0DF8@SACEXCMBX04-PRD.hq.netapp.com>
References: <D29CB80EBA4DEA4D91181928AAF51538438C0D8B@SACEXCMBX04-PRD.hq.netapp.com>
 <52C5ED3E.4020805@mu.org> <52C5F8A3.9000902@freebsd.org>
In-Reply-To: <52C5F8A3.9000902@freebsd.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [10.106.53.51]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers/>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Jan 2014 23:54:01 -0000

>> Without changing the return-value semantics of refcount_acquire, we=20
>> have introduced a panic if we detected a race as below.
>> static __inline void
>> refcount_acquire(volatile u_int *count) {
>>          u_int old;
>>
>>          old =3D atomic_fetchadd_int(count, 1);
>>          if (old =3D=3D 0) {
>>            panic("refcount_acquire race condition detected!\n");
>>          }

>>>>>so what is the stacktrace of the panic?

It's from the socket code calling crhold.   It's a non debug build( NO INVA=
RIANTS )

#4  0xffffffff80331d34 in panic (fmt=3D0xffffffff805c1e60 "refcount_acquire=
 race condition detected!\n") at ../../../../sys/kern/kern_shutdown.c:1009
#5  0xffffffff80326662 in refcount_acquire (count=3D<optimized out>) at ../=
../../../sys/sys/refcount.h:65
#6  crhold (cr=3D<optimized out>) at ../../../../sys/kern/kern_prot.c:1814
#7  0xffffffff803aa0d9 in socreate (dom=3D<optimized out>, aso=3D0xffffff80=
345c1b00, type=3D<optimized out>, proto=3D0, cred=3D0xffffff0017d7aa00, td=
=3D0xffffff000b294410)=20
at ../../../../sys/kern/uipc_socket.c:441
#8  0xffffffff803b2e5c in socket (td=3D0xffffff000b294410, uap=3D0xffffff80=
345c1be0) at ../../../../sys/kern/uipc_syscalls.c:201
#9  0xffffffff80539ecb in syscall (frame=3D0xffffff80345c1c80) at ../../../=
../sys/amd64/amd64/trap.c:1260


Thanks
Suresh