Date: Mon, 15 Jul 2013 11:25:37 +0200 From: Mateusz Guzik <mjguzik@gmail.com> To: "Eugene M. Zheganin" <emz@norma.perm.ru> Cc: freebsd-current@freebsd.org Subject: Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168 Message-ID: <20130715092537.GA22424@dft-labs.eu> In-Reply-To: <51E3BDF5.7030602@norma.perm.ru> References: <51CFDC86.2040506@FreeBSD.org> <20130630111836.GB22492@dft-labs.eu> <20130701231011.GA1406@garage.freebsd.pl> <51E3BDF5.7030602@norma.perm.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jul 15, 2013 at 03:16:37PM +0600, Eugene M. Zheganin wrote:
> Hi.
>
> On 02.07.2013 05:10, Pawel Jakub Dawidek wrote:
> > On Sun, Jun 30, 2013 at 01:18:36PM +0200, Mateusz Guzik wrote:
> >>
> >> Turns out the bug is quite funny ;)
> >>
> >> Try this:
> >> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
> >> index 5d8e814..7a4db04 100644
> >> --- a/sys/kern/uipc_usrreq.c
> >> +++ b/sys/kern/uipc_usrreq.c
> >> @@ -1764,8 +1764,8 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
> >> }
> >> for (i = 0; i < newfds; i++, fdp++) {
> >> fde = &fdesc->fd_ofiles[*fdp];
> >> - fde->fde_file = fdep[0]->fde_file;
> >> - filecaps_move(&fdep[0]->fde_caps,
> >> + fde->fde_file = fdep[i]->fde_file;
> >> + filecaps_move(&fdep[i]->fde_caps,
> >> &fde->fde_caps);
> >> if ((flags & MSG_CMSG_CLOEXEC) != 0)
> >> fde->fde_flags |= UF_EXCLOSE;
> > Thanks for tracking it down before I had time to get to it!
> > The change looks good.
> >
> Guys, if this is working, why it's not commited to HEAD ? I'm still
> hitting this bug on r251990 and later ones.
>
The patch was committed in r252502. Is that kernel crashing for you? If
so, can you show backtrace?
--
Mateusz Guzik <mjguzik gmail.com>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130715092537.GA22424>