Date: Thu, 2 Jan 2014 23:53:59 +0000 From: "Gumpula, Suresh" <Suresh.Gumpula@netapp.com> To: Julian Elischer <julian@freebsd.org>, Alfred Perlstein <bright@mu.org>, "freebsd-hackers@freebsd.org" <freebsd-hackers@freebsd.org> Subject: RE: Reference count race window Message-ID: <D29CB80EBA4DEA4D91181928AAF51538438C0DF8@SACEXCMBX04-PRD.hq.netapp.com> In-Reply-To: <52C5F8A3.9000902@freebsd.org> References: <D29CB80EBA4DEA4D91181928AAF51538438C0D8B@SACEXCMBX04-PRD.hq.netapp.com> <52C5ED3E.4020805@mu.org> <52C5F8A3.9000902@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
>> Without changing the return-value semantics of refcount_acquire, we=20
>> have introduced a panic if we detected a race as below.
>> static __inline void
>> refcount_acquire(volatile u_int *count) {
>> u_int old;
>>
>> old =3D atomic_fetchadd_int(count, 1);
>> if (old =3D=3D 0) {
>> panic("refcount_acquire race condition detected!\n");
>> }
>>>>>so what is the stacktrace of the panic?
It's from the socket code calling crhold. It's a non debug build( NO INVA=
RIANTS )
#4 0xffffffff80331d34 in panic (fmt=3D0xffffffff805c1e60 "refcount_acquire=
race condition detected!\n") at ../../../../sys/kern/kern_shutdown.c:1009
#5 0xffffffff80326662 in refcount_acquire (count=3D<optimized out>) at ../=
../../../sys/sys/refcount.h:65
#6 crhold (cr=3D<optimized out>) at ../../../../sys/kern/kern_prot.c:1814
#7 0xffffffff803aa0d9 in socreate (dom=3D<optimized out>, aso=3D0xffffff80=
345c1b00, type=3D<optimized out>, proto=3D0, cred=3D0xffffff0017d7aa00, td=
=3D0xffffff000b294410)=20
at ../../../../sys/kern/uipc_socket.c:441
#8 0xffffffff803b2e5c in socket (td=3D0xffffff000b294410, uap=3D0xffffff80=
345c1be0) at ../../../../sys/kern/uipc_syscalls.c:201
#9 0xffffffff80539ecb in syscall (frame=3D0xffffff80345c1c80) at ../../../=
../sys/amd64/amd64/trap.c:1260
Thanks
Suresh
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?D29CB80EBA4DEA4D91181928AAF51538438C0DF8>