Date: Fri, 6 Aug 2004 15:55:12 -0400 From: Alex Hoff <ahoff@sandvine.com> To: "'freebsd-net@freebsd.org'" <freebsd-net@freebsd.org> Subject: Panic in Freebsd 4.7 (m_copydata/tcp_output) Message-ID: <A8535F8D62F3644997E91F4F66E341FC0E8169@exchange.sandvine.com>
next in thread | raw e-mail | index | archive | help
Hi,=20 I had a freebsd 4-7 stable system panic while i was running low on = mbufs.=20 Can someone provide me with some background info so I can debug this = some more? How would I get into the situation where the socket has no mbuf = allocated to it?=20 Where does this allocation usually take place? How/why did send acknowledge count be greater then the send next count? = Is -1 a valid offset? Saw a few similar postings where m_copy data ran in to the same args = from tcp_output http://www.google.ca/search?q=3Dcache:s7uT8Qeei-0J:www.geocrawler.com/ma= il/msg .php3%3Fmsg_id%3D657553+freebsd+tcp_output+sb_mb&hl=3Den and an old bug=20 http://www.freebsd.org/cgi/query-pr.cgi?pr=3D1013 Any pointers to get me going on this would be appreciated. Thanks in advance. (kgdb) bt #0 dumpsys () at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/kern/kern_shutdow= n .c:492 #1 0xc01c5978 in boot (howto=3D256) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/kern/kern_shutdow= n .c:321 #2 0xc01c5ea1 in panic (fmt=3D0xc034945e "%s") at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/kern/kern_shutdow= n .c:607 #3 0xc02ef324 in trap_fatal (frame=3D0xf2eca92c, eva=3D0) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/i386/i386/trap.c:= 9 92 #4 0xc02eef4d in trap_pfault (frame=3D0xf2eca92c, usermode=3D0, = eva=3D12) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/i386/i386/trap.c:= 885 #5 0xc02ee9ef in trap (frame=3D{tf_fs =3D -828506088, tf_es =3D = -828506096, tf_ds =3D 116129808, tf_edi =3D 1, tf_esi =3D 0, tf_ebp =3D = -219371144, tf_isp =3D -219371176, tf_ebx =3D -307373120, tf_edx =3D -1, tf_ecx =3D -334664960, tf_eax =3D -1, tf_trapno =3D 12, tf_err = =3D 0, tf_eip =3D -1071748160, tf_cs =3D 8, tf_eflags =3D 66050, tf_esp = =3D -307373120, tf_ss =3D 12}) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/i386/i386/trap.c:= 484 #6 0xc01e6bc0 in m_copydata (m=3D0x0, off=3D-1, len=3D1, cp=3D0xc5b30a74 = "~=F1\202,\200\205R\001=F2P\a=F7;=AA=EFI=C5+6=ABd\eh\17708.172.128.222 (<a h ref=3D\"http://www.footprint.net\">Footprint 3.0/FPMCP</a>)\n</BODY></HTML>\n") at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/kern/uipc_mbuf.c:= 1002 #7 0xc022f0ce in tcp_output (tp=3D0xedaddbc0) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/netinet/tcp_outpu= t.c: 608 #8 0xc022e0bf in tcp_input (m=3D0xc5b30a00, off0=3D20, proto=3D6) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/netinet/tcp_input= .c:2 252 #9 0xc02256bf in ip_input (m=3D0xc5b30a00) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/netinet/ip_input.= c:88 1 #10 0xc0225747 in ipintr () at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/netinet/ip_input.= c:90 2 #11 0xc02dde61 in swi_net_next () #12 0xc0207100 in spec_write (ap=3D0x37) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/miscfs/specfs/spe= c _vnops.c:283 #13 0xc0292d10 in ufsspec_write (ap=3D0xf2ecae70) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/ufs/ufs/ufs_vnops= . c:1873 #14 0xc0293465 in ufs_vnoperatespec (ap=3D0x0) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/ufs/ufs/ufs_vnops= . c:2440 #15 0xc0202996 in vn_write (fp=3D0xd7e676c0, uio=3D0xf2ecaedc, = cred=3D0xd7a32880, flags=3D0, p=3D0xf2c43ee0) at vnode_if.h:363 #16 0xc01d767e in dofilewrite (p=3D0xf2c43ee0, fp=3D0xd7e676c0, fd=3D0, = buf=3D0x0, nbyte=3D4075597532, offset=3D-942185962111238144, flags=3D0) at = /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/sys/file.h:162 #17 0xc01d751b in write (p=3D0xf2c43ee0, uap=3D0xf2ecaf80) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/kern/sys_generic.= c :329 #18 0xc02ef67d in syscall2 (frame=3D{tf_fs =3D -1068957649, tf_es =3D = 47, tf_ds =3D 136314927, tf_edi =3D 1, tf_esi =3D 1747982016, tf_ebp =3D -1079200356, tf_isp =3D -219369516, tf_ebx =3D = 1748019148, tf_edx =3D 136388608, tf_ecx =3D 1876638720, tf_eax =3D 4, = tf_trapno =3D 22, tf_err =3D 2, tf_eip =3D 1747725928, tf_cs =3D 31, tf_eflags =3D = 646, tf_esp =3D -1079200416, tf_ss =3D 47}) at /d3/builds/swbuild_swbuild_plt_proton5_FREEBSD/src/sys/i386/i386/trap.c:= 1 193 #19 0xc02d9d6b in Xint0x80_syscall () #20 0x682b8981 in ?? () (kgdb) p *tp $7 =3D {t_segq =3D {lh_first =3D 0x0}, t_dupacks =3D 0, unused =3D 0x0, tt_rexmt =3D 0xedaddca4, tt_persist =3D 0xedaddcbc, tt_keep =3D = 0xedaddcd4, tt_2msl =3D 0xedaddcec, tt_delack =3D 0xedaddd04, t_inpcb =3D = 0xedaddb00, t_state =3D 4, t_flags =3D 33249, t_force =3D 0, snd_una =3D = 1726825387, snd_max =3D 1726825387, snd_nxt =3D 1726825386, snd_up =3D = 1726825386, snd_wl1 =3D 3607398008, snd_wl2 =3D 1726825387, iss =3D 1726825386, irs =3D 3607398007, rcv_nxt =3D 3607398008, rcv_adv =3D 3607455928, rcv_wnd =3D 57920, rcv_up =3D 3607398008, snd_wnd =3D 65535, snd_cwnd = =3D 1448, snd_bwnd =3D 1073725440, snd_ssthresh =3D 2904, snd_bandwidth =3D 0, snd_recover =3D 1726825387, t_maxopd =3D 1460, t_rcvtime =3D = 280063744, t_starttime =3D 280063744, t_rtttime =3D 0, t_rtseq =3D 1726825386, t_bw_rtttime =3D 280054231, t_bw_rtseq =3D 1726825386, t_rxtcur =3D = 24464, t_maxseg =3D 1448, t_srtt =3D 255616, t_rttvar =3D 63904, t_rxtshift = =3D 0, t_rttmin =3D 2500, t_rttbest =3D 319520, t_rttupdated =3D 1, = max_sndwnd =3D 65535, t_softerror =3D 0, t_oobflags =3D 0 '\000', t_iobc =3D 0 '\000', snd_scale =3D 1 '\001', rcv_scale =3D 0 '\000', request_r_scale =3D 0 = '\000', requested_s_scale =3D 1 '\001', ts_recent =3D 289118643, ts_recent_age =3D 280063744, last_ack_sent =3D 0, cc_send =3D 100631, = cc_recv =3D 0, snd_cwnd_prev =3D 1073725440, snd_ssthresh_prev =3D 1073725440, t_badrxtwin =3D 280063257} (kgdb) (kgdb) p *inp $8 =3D {inp_hash =3D {le_next =3D 0x0, le_prev =3D 0xcc28d9d4}, = inp_list =3D { le_next =3D 0xedadd8e0, le_prev =3D 0xc0412480}, inp_flow =3D 0, = inp_inc =3D { inc_flags =3D 0 '\000', inc_len =3D 0 '\000', inc_pad =3D 0, inc_ie = =3D { ie_fport =3D 40861, ie_lport =3D 51976, ie_dependfaddr =3D = {ie46_foreign =3D { ia46_pad32 =3D {0, 0, 0}, ia46_addr4 =3D {s_addr =3D = 2120346432}}, ie6_foreign =3D {__u6_addr =3D { __u6_addr8 =3D '\000' <repeats 12 times>, "@=EBa~", = __u6_addr16 =3D {0, 0, 0, 0, 0, 0, 60224, 32353}, __u6_addr32 =3D {0, 0, 0, 2120346432}}}}, ie_dependladdr =3D {ie46_local =3D = {ia46_pad32 =3D {0, 0, 0}, ia46_addr4 =3D {s_addr =3D 181044696}}, ie6_local = =3D { __u6_addr =3D {__u6_addr8 =3D '\000' <repeats 12 times>, = "O\205E\n", __u6_addr16 =3D {0, 0, 0, 0, 0, 0, 34264, 2762}, = __u6_addr32 =3D {0, 0, 0, 181044696}}}}}, inc_dependroute =3D {inc4_route =3D = { ro_rt =3D 0xd7b63300, ro_dst =3D {sa_len =3D 16 '\020', sa_family =3D 2 '\002', sa_data =3D "\000\000@=EBa~\000\000\000\000\000\000\000"}}, inc6_route =3D {ro_rt =3D 0xd7b63300, ro_dst =3D {sin6_len =3D 16 = '\020', sin6_family =3D 2 '\002', sin6_port =3D 0, sin6_flowinfo =3D = 2120346432, sin6_addr =3D {__u6_addr =3D {__u6_addr8 =3D '\000' <repeats = 15 times>, __u6_addr16 =3D {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 =3D = {0, 0, 0, 0}}}, sin6_scope_id =3D 0}}}}, inp_ppcb =3D 0xedaddbc0 = "", inp_primecb =3D 0x0, inp_pcbinfo =3D 0xc04125e0, inp_socket =3D = 0xec0d6b00, inp_flags =3D 64, inp_sp =3D 0x0, inp_vflag =3D 1 '\001', inp_ip_ttl = =3D 64 '@', inp_ip_p =3D 0 '\000', inp_depend4 =3D {inp4_ip_tos =3D 0 '\000', inp4_options =3D 0x0, inp4_moptions =3D 0x0}, inp_depend6 =3D { inp6_options =3D 0x0, inp6_outputopts =3D 0x0, inp6_moptions =3D = 0x0, inp6_icmp6filt =3D 0x0, inp6_cksum =3D 0, inp6_ifindex =3D 0, = inp6_hops =3D 0, inp6_hlim =3D 0 '\000'}, inp_portlist =3D {le_next =3D 0x0, le_prev =3D 0xcc40bad8}, inp_phd =3D 0xcc40bad0, inp_gencnt =3D = 531468} (kgdb)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?A8535F8D62F3644997E91F4F66E341FC0E8169>