Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 21 Jun 2005 13:07:01 +0400
From:      Gleb Smirnoff <glebius@FreeBSD.org>
To:        Jeremie Le Hen <jeremie@le-hen.org>
Cc:        freebsd-stable@FreeBSD.org
Subject:   Re: panic in RELENG_5 UMA
Message-ID:  <20050621090701.GB34406@cell.sick.ru>
In-Reply-To: <20050621070427.GA738@obiwan.tataz.chchile.org>
References:  <20050621070427.GA738@obiwan.tataz.chchile.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jun 21, 2005 at 09:04:27AM +0200, Jeremie Le Hen wrote:
J> #25 0xc05a0a0b in m_freem (mb=0x0) at uma.h:304
J> No locals.
J> #26 0xc05ee0d5 in arpresolve (ifp=0xc1a5b000, rt0=0xc1d44000, m=0xc1be7200,
J>     dst=0xd6d3fa94, desten=0xd6d3fa2c "/??]??????w??")
J>     at ../../../netinet/if_ether.c:442
J>         la = (struct llinfo_arp *) 0xc1a75a00
J>         sdl = (struct sockaddr_dl *) 0xc2128910
J>         error = -1038972656
J>         rt = (struct rtentry *) 0xc1d44000

IMHO, this looks like a race. The route is not locked, when
its llinfo is edited.

Probably the mbuf was freed when arp reply arrived and la_hold was send.
Look into in_arpinput() near 736:

                        (*ifp->if_output)(ifp, la->la_hold, rt_key(rt), rt);
                        la->la_hold = 0;

Yeah, I have just triggered another panic running 15 instances of this script on
SMP box:

(
while (true); do
	arp -d 81.19.64.111  >/dev/null 2>&1;
	ping -c 1 -t 1 81.19.64.111 >/dev/null 2>&1;
done
) &

But my duplicate free is in fxp_txeof(). This means that output thread has
won the race.

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050621090701.GB34406>