Date: Tue, 21 Jun 2005 13:31:50 +0400 From: Gleb Smirnoff <glebius@FreeBSD.org> To: Jeremie Le Hen <jeremie@le-hen.org> Cc: freebsd-stable@FreeBSD.org Subject: Re: panic in RELENG_5 UMA Message-ID: <20050621093150.GA35316@cell.sick.ru> In-Reply-To: <20050621092836.GD738@obiwan.tataz.chchile.org> References: <20050621070427.GA738@obiwan.tataz.chchile.org> <20050621090701.GB34406@cell.sick.ru> <20050621092836.GD738@obiwan.tataz.chchile.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jun 21, 2005 at 11:28:36AM +0200, Jeremie Le Hen wrote: J> > IMHO, this looks like a race. The route is not locked, when J> > its llinfo is edited. J> > J> > Probably the mbuf was freed when arp reply arrived and la_hold was send. J> > Look into in_arpinput() near 736: J> > J> > (*ifp->if_output)(ifp, la->la_hold, rt_key(rt), rt); J> > la->la_hold = 0; J> > J> > Yeah, I have just triggered another panic running 15 instances of this J> > script on SMP box: J> > J> > ( J> > while (true); do J> > arp -d 81.19.64.111 >/dev/null 2>&1; J> > ping -c 1 -t 1 81.19.64.111 >/dev/null 2>&1; J> > done J> > ) & J> > J> > But my duplicate free is in fxp_txeof(). This means that output thread has J> > won the race. J> J> This explanation sounds good but my box is an UP with PREEMPTION. J> Is is supposed to be also possible in this case ? I guess yes, because of preemption. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050621093150.GA35316>