Date: Wed, 17 Jan 2007 22:40:18 GMT From: Oleg Bulyzhin <oleg@freebsd.org> To: freebsd-ipfw@FreeBSD.org Subject: Re: kern/106534: [ipfw] [panic] ipfw + dummynet Message-ID: <200701172240.l0HMeIVN046886@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/106534; it has been noted by GNATS.
From: Oleg Bulyzhin <oleg@freebsd.org>
To: Olexandr Davydenko <o.davydenko@gmail.com>
Cc: freebsd-ipfw@freebsd.org
Subject: Re: kern/106534: [ipfw] [panic] ipfw + dummynet
Date: Wed, 17 Jan 2007 02:00:39 +0300
On Mon, Jan 15, 2007 at 12:40:23PM +0000, Olexandr Davydenko wrote:
> The following reply was made to PR kern/106534; it has been noted by GNATS.
>
> From: Olexandr Davydenko <o.davydenko@gmail.com>
> To: bug-followup@FreeBSD.org
> Cc:
> Subject: Re: kern/106534: [ipfw] [panic] ipfw + dummynet
> Date: Mon, 15 Jan 2007 14:20:22 +0200
>
> Similar problem with ipfw + dummynet and 132 pipes for traffic shaping:
> sometimes panic when trafshow run and put interface in promiscuous
> mode or in any another time.
>
> FreeBSD 6.1-RELEASE-p10 #1: Wed Oct 4 12:46:05 EEST 2006
> root@xxx:/server/OBJ/server/SRC/RELENG_6_1/sys/xxx
>
> # ifconfig
> fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> options=48<VLAN_MTU,POLLING>
> ether 00:90:27:10:33:b4
> media: Ethernet autoselect (100baseTX <full-duplex>)
> status: active
> fxp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> options=48<VLAN_MTU,POLLING>
> ether 00:30:48:22:58:79
> media: Ethernet 100baseTX <full-duplex>
> status: active
> fxp2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> options=48<VLAN_MTU,POLLING>
> ether 00:30:48:22:58:7a
> media: Ethernet autoselect (100baseTX <full-duplex>)
> status: active
> lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
> inet 127.0.0.1 netmask 0xff000000
>
> kgdb output:
> GNU gdb 6.1.1 [FreeBSD]
> Copyright 2004 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and you are
> welcome to change it and/or distribute copies of it under certain conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB. Type "show warranty" for details.
> This GDB was configured as "i386-marcel-freebsd".
>
> Unread portion of the kernel message buffer:
>
>
> Fatal trap 12: page fault while in kernel mode
> fault virtual address = 0xc
> fault code = supervisor read, page not present
> instruction pointer = 0x20:0xc0516ffb
> stack pointer = 0x28:0xcbd36b60
> frame pointer = 0x28:0xcbd36b84
> code segment = base 0x0, limit 0xfffff, type 0x1b
> = DPL 0, pres 1, def32 1, gran 1
> processor eflags = interrupt enabled, resume, IOPL = 0
> current process = 12 (swi4: clock sio)
> trap number = 12
> panic: page fault
> Uptime: 29d17h3m30s
> Dumping 254 MB (2 chunks)
> chunk 0: 1MB (159 pages) ... ok
> chunk 1: 254MB (65024 pages) 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
>
> #0 doadump () at pcpu.h:165
> in pcpu.h
> (kgdb) bt
> #0 doadump () at pcpu.h:165
> #1 0xc04e1b65 in boot (howto=260) at /server/SRC/RELENG_6_1/sys/kern/kern_shutdown.c:402
> #2 0xc04e1dfc in panic (fmt=0xc063e3b0 "%s") at /server/SRC/RELENG_6_1/sys/kern/kern_shutdown.c:558
> #3 0xc06254fc in trap_fatal (frame=0xcbd36b20, eva=12) at /server/SRC/RELENG_6_1/sys/i386/i386/trap.c:836
> #4 0xc0625263 in trap_pfault (frame=0xcbd36b20, usermode=0, eva=12)
> at /server/SRC/RELENG_6_1/sys/i386/i386/trap.c:744
> #5 0xc0624ec1 in trap (frame=
> {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -1014294700, tf_esi = 320, tf_ebp = -875336828, tf_isp = -875336884, tf_ebx = -1014294784, tf_edx = 0, tf_ecx = -1026586592, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1068404741, tf_cs = 32, tf_eflags = 590338, tf_esp = 0, tf_ss = -875336824})
> at /server/SRC/RELENG_6_1/sys/i386/i386/trap.c:434
> #6 0xc06153ba in calltrap () at /server/SRC/RELENG_6_1/sys/i386/i386/exception.s:139
> #7 0xc0516ffb in m_copym (m=0x0, off0=1500, len=1480, wait=1)
> at /server/SRC/RELENG_6_1/sys/kern/uipc_mbuf.c:400
> #8 0xc056bff8 in ip_fragment (ip=0xc2cf8820, m_frag=0xcbd36c3c, mtu=-1014294784, if_hwassist_flags=0,
> sw_csum=1) at /server/SRC/RELENG_6_1/sys/netinet/ip_output.c:975
> #9 0xc056bc9e in ip_output (m=0xc33a1c00, opt=0xc1d8e000, ro=0xcbd36c08, flags=1, imo=0x0, inp=0x0)
> at /server/SRC/RELENG_6_1/sys/netinet/ip_output.c:804
> #10 0xc055ef71 in dummynet_send (m=0xc33a1c00) at /server/SRC/RELENG_6_1/sys/netinet/ip_dummynet.c:771
> #11 0xc055ef04 in dummynet (unused=0x0) at /server/SRC/RELENG_6_1/sys/netinet/ip_dummynet.c:753
> #12 0xc04edc97 in softclock (dummy=0x0) at /server/SRC/RELENG_6_1/sys/kern/kern_timeout.c:290
> #13 0xc04cc391 in ithread_execute_handlers (p=0xc1d97830, ie=0xc1d95600)
> at /server/SRC/RELENG_6_1/sys/kern/kern_intr.c:684
> #14 0xc04cc4a8 in ithread_loop (arg=0xc1d83780) at /server/SRC/RELENG_6_1/sys/kern/kern_intr.c:767
> #15 0xc04cb300 in fork_exit (callout=0xc04cc454 <ithread_loop>, arg=0xc1d83780, frame=0xcbd36d38)
> at /server/SRC/RELENG_6_1/sys/kern/kern_fork.c:805
> #16 0xc061541c in fork_trampoline () at /server/SRC/RELENG_6_1/sys/i386/i386/exception.s:208
> (kgdb) up 7
> #7 0xc0516ffb in m_copym (m=0x0, off0=1500, len=1480, wait=1)
> at /server/SRC/RELENG_6_1/sys/kern/uipc_mbuf.c:400
> 400 if (off < m->m_len)
> (kgdb) list
> 395 MBUF_CHECKSLEEP(wait);
> 396 if (off == 0 && m->m_flags & M_PKTHDR)
> 397 copyhdr = 1;
> 398 while (off > 0) {
> 399 KASSERT(m != NULL, ("m_copym, offset > size of mbuf chain"));
> 400 if (off < m->m_len)
> 401 break;
> 402 off -= m->m_len;
> 403 m = m->m_next;
> 404 }
> (kgdb) quit
>
>
>
> --
> WBR,
> Davidenko Alexandr
> _______________________________________________
> freebsd-ipfw@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
As i can see kernel dies trying to fit packet into interface with negative mtu.
Would be fine to dump ro->ro_rt->rt_ifp structure. (Do some 'up' commands until
you are in ip_output, then print ro->ro_rt->rt_ifp).
--
Oleg.
================================================================
=== Oleg Bulyzhin -- OBUL-RIPN -- OBUL-RIPE -- oleg@rinet.ru ===
================================================================
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200701172240.l0HMeIVN046886>