Date: Fri, 2 Jun 2006 01:52:38 +0800 (KRAST) From: Eugene Grosbein <eugen@kuzbass.ru> To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/98298: panic: mutex gif softc not owned at /usr/src/sys/kern/kern_mutex.c:312 Message-ID: <200606011752.k51Hqcac001147@grosbein.pp.ru> Resent-Message-ID: <200606011800.k51I0TFc061509@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 98298
>Category: kern
>Synopsis: panic: mutex gif softc not owned at /usr/src/sys/kern/kern_mutex.c:312
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Jun 01 18:00:28 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Eugene Grosbein
>Release: FreeBSD 6.1-STABLE i386
>Organization:
Svyaz Serivice JSC
>Environment:
System: FreeBSD grosbein.pp.ru 6.1-STABLE FreeBSD 6.1-STABLE #31: Thu May 25 21:56:26 KRAST 2006 eu@grosbein.pp.ru:/mnt/usr/local/obj6/usr/src/sys/GENERIC i386
GENERIC kernel config plus options INVARIANTS and INVARIANT_SUPPORT
>Description:
GENERIC kernel panices just after gif(4) recursion is detected
>How-To-Repeat:
1. Build the kernel using GENERIC kernel config plus
options INVARIANTS and INVARIANT_SUPPORT (without these options
panic occures too, but just for 'page not present').
2. Build this kernel to single user mode and run the commands:
ifconfig gif0 create tunnel 1.1.1.1 2.2.2.2
ifconfig gif0 inet 10.10.10.10 20.20.20.20 netmask 255.255.255.252 mtu 1500 up
route add default 20.20.20.20
A second later the panic occures. Here is kgdb backtrace:
panic: mutex gif softc not owned at /usr/src/sys/kern/kern_mutex.c:312
Uptime: 50s
Dumping 575 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 575MB (147184 pages) 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
#0 doadump () at pcpu.h:165
165 __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt full
#0 doadump () at pcpu.h:165
No locals.
#1 0xc06b824a in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:402
first_buf_printf = 1
#2 0xc06b857d in panic (fmt=0xc0964d07 "mutex %s not owned at %s:%d")
at /usr/src/sys/kern/kern_shutdown.c:558
td = (struct thread *) 0xc3709a80
bootopt = 260
newpanic = 0
ap = 0xd65939b0 "ºß\226À®K\226À8\001"
buf = "mutex gif softc not owned at /usr/src/sys/kern/kern_mutex.c:312", '\0' <repeats 192 times>
#3 0xc06ae8c7 in _mtx_assert (m=0xc3ab4c84, what=0,
file=0xc0964bae "/usr/src/sys/kern/kern_mutex.c", line=312)
at /usr/src/sys/kern/kern_mutex.c:754
No locals.
#4 0xc06ae3d0 in _mtx_unlock_flags (m=0xc3ab4c84, opts=0,
file=0xc096dfc4 "/usr/src/sys/net/if_gif.c", line=479)
at /usr/src/sys/kern/kern_mutex.c:312
No locals.
#5 0xc073af10 in gif_output (ifp=0xc39a3800, m=0xc3a61b00, dst=0xd6593bd8,
rt=0x0) at /usr/src/sys/net/if_gif.c:479
sc = (struct gif_softc *) 0xc3ab4c80
mtag = (struct m_tag *) 0x0
error = 5
gif_called = 5
af = 28
#6 0xc07a0bd5 in nd6_output (ifp=0xc39a3800, origifp=0x0, m0=0xc3a61b00,
dst=0xd6593bd8, rt0=0x32) at /usr/src/sys/netinet6/nd6.c:2125
m = (struct mbuf *) 0xc3a61b00
rt = (struct rtentry *) 0x0
gw6 = (struct sockaddr_in6 *) 0xffffffff
ln = (struct llinfo_nd6 *) 0x0
error = 50
#7 0xc07998eb in ip6_output (m0=0x0, opt=0xc0a4dea0, ro=0xd6593bd4, flags=0,
im6o=0xd6593c3c, ifpp=0xd6593c28, inp=0x0)
at /usr/src/sys/netinet6/ip6_output.c:994
ia6 = (struct in6_ifaddr *) 0x0
ip6 = (struct ip6_hdr *) 0xc3a61bd8
mhip6 = (struct ip6_hdr *) 0xc0a4dea0
ifp = (struct ifnet *) 0xc39a3800
origifp = (struct ifnet *) 0xc39a3800
m = (struct mbuf *) 0xc3a61b00
hlen = -1016035804
tlen = 72
len = 26487543
off = -579701800
ip6route = {ro_rt = 0x0, ro_dst = {sin6_len = 28 '\034',
sin6_family = 28 '\034', sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {
__u6_addr = {
__u6_addr8 = "ÿ\002\000\005\000\000\000\000\000\000\000\001ÿ\211\225\037", __u6_addr16 = {767, 1280, 0, 0, 0, 256, 35327, 8085}, __u6_addr32 = {
83886847, 0, 16777216, 529893887}}}, sin6_scope_id = 0}}
rt = (struct rtentry *) 0x0
dst = (struct sockaddr_in6 *) 0xd6593bd8
src_sa = {sin6_len = 28 '\034', sin6_family = 28 '\034',
sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__u6_addr = {
__u6_addr8 = "þ\200\000\000\000\000\000\000\002 Éÿþ\211\225\037",
__u6_addr16 = {33022, 0, 0, 0, 40962, 65481, 35326, 8085},
__u6_addr32 = {33022, 0, 4291403778, 529893886}}}, sin6_scope_id = 5}
dst_sa = {sin6_len = 28 '\034', sin6_family = 28 '\034',
sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__u6_addr = {
__u6_addr8 = "ÿ\002\000\000\000\000\000\000\000\000\000\001ÿ\211\225\037", __u6_addr16 = {767, 0, 0, 0, 0, 256, 35327, 8085}, __u6_addr32 = {767, 0,
16777216, 529893887}}}, sin6_scope_id = 5}
odst = {__u6_addr = {__u6_addr8 = "\000\000\000\000 ;YÖ*¾lÀ \027¤À",
__u6_addr16 = {0, 0, 15264, 54873, 48682, 49260, 6048, 49316},
__u6_addr32 = {0, 3596172192, 3228352042, 3231979424}}}
error = 0
ia = (struct in6_ifaddr *) 0x0
mtu = 1280
alwaysfrag = 0
dontfrag = 0
optlen = 0
plen = 0
unfragpartlen = 48
exthdrs = {ip6e_ip6 = 0xc3a61b00, ip6e_hbh = 0xc3a61900,
ip6e_dest1 = 0x0, ip6e_rthdr = 0x0, ip6e_dest2 = 0x0}
finaldst = {__u6_addr = {
__u6_addr8 = "ÿ\002\000\005\000\000\000\000\000\000\000\001ÿ\211\225\037",
__u6_addr16 = {767, 1280, 0, 0, 0, 256, 35327, 8085}, __u6_addr32 = {
83886847, 0, 16777216, 529893887}}}
src0 = {__u6_addr = {
__u6_addr8 = "þ\200\000\005\000\000\000\000\002 Éÿþ\211\225\037",
__u6_addr16 = {33022, 1280, 0, 0, 40962, 65481, 35326, 8085},
__u6_addr32 = {83919102, 0, 4291403778, 529893886}}}
dst0 = {__u6_addr = {
__u6_addr8 = "ÿ\002\000\005\000\000\000\000\000\000\000\001ÿ\211\225\037",
__u6_addr16 = {767, 1280, 0, 0, 0, 256, 35327, 8085}, __u6_addr32 = {
83886847, 0, 16777216, 529893887}}}
zone = 5
ro_pmtu = (struct route_in6 *) 0xd6593bd4
hdrsplit = 1
needipsec = 0
#8 0xc079dfee in mld6_sendpkt (in6m=0xc3a70d80, type=131, dst=0x0)
at /usr/src/sys/netinet6/mld6.c:525
mh = (struct mbuf *) 0xc3a61b00
md = (struct mbuf *) 0xc3a61a00
mldh = (struct mld_hdr *) 0xd6593c3c
ip6 = (struct ip6_hdr *) 0x0
im6o = {im6o_multicast_ifp = 0xc39a3800,
im6o_multicast_hlim = 1 '\001', im6o_multicast_loop = 0 '\0',
im6o_memberships = {lh_first = 0x0}}
ia = (struct in6_ifaddr *) 0xd6593c3c
ifp = (struct ifnet *) 0xc39a3800
outif = (struct ifnet *) 0xc39a3800
#9 0xc079d62c in mld_timeo (in6m=0xc3a70d80)
at /usr/src/sys/netinet6/mld6.c:181
No locals.
#10 0xc06c69a3 in softclock (dummy=0x0) at /usr/src/sys/kern/kern_timeout.c:290
c_func = (void (*)(void *)) 0xc079d5e0 <mld_timeo>
c_arg = (void *) 0xc3a70d80
c_mtx = (struct mtx *) 0xc0a417e0
c_flags = 6
c = (struct callout *) 0x0
bucket = (struct callout_tailq *) 0xcf0d8430
curticks = 49604
steps = -1062987808
depth = 1
mpcalls = 0
mtxcalls = 0
gcalls = 1
wakeup_cookie = -1062987808
#11 0xc06a0848 in ithread_execute_handlers (p=0xc3708624, ie=0xc3706480)
at /usr/src/sys/kern/kern_intr.c:684
ih = (struct intr_handler *) 0xc3739700
ihn = (struct intr_handler *) 0xc389ac40
#12 0xc06a09d3 in ithread_loop (arg=0xc36ec720)
at /usr/src/sys/kern/kern_intr.c:767
intr_event = (struct intr_thread *) 0xc36ec720
ie = (struct intr_event *) 0xc3706480
td = (struct thread *) 0xc3709a80
p = (struct proc *) 0xc3708624
__func__ = "ithread_loop"
#13 0xc069f591 in fork_exit (callout=0xc06a0950 <ithread_loop>, arg=0x0,
frame=0x0) at /usr/src/sys/kern/kern_fork.c:805
p = (struct proc *) 0xc3708624
td = (struct thread *) 0x0
#14 0xc08e3adc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
No locals.
>Fix:
Unknown for me.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200606011752.k51Hqcac001147>