Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 15 Dec 2004 16:08:24 +0100
From:      Pawel Malachowski <pawmal-posting@freebsd.lublin.pl>
To:        freebsd-ipfw@freebsd.org
Subject:   Panic with dummynet, RELENG_4 (dummynet: heap_extract).
Message-ID:  <20041215150824.GA34851@shellma.zin.lublin.pl>

next in thread | raw e-mail | index | archive | help
Hello,

	It hit me some time ago. 4.10-STABLE, perfectly stable, no
configuration changes for months (only xl(4) replaced with dc(4)),
works rock solid for years. IPFW2, kernel Tue Sep 28 16:04:43 CEST 2004.

	This is direct call to panic(9) so probaly this is something
that Should Never Happen. Question: how could it happen?! :)


Details:

panic: dummynet: heap_extract

syncing disks... 2
done
Uptime: 56d3h32m3s

dumping to dev #ad/0x30001, offset 1572992
dump ata0: resetting devices .. done
(kgdb) bt
#0  dumpsys () at ../../kern/kern_shutdown.c:487
#1  0xc023c76f in boot (howto=256) at ../../kern/kern_shutdown.c:316
#2  0xc023cb94 in poweroff_wait (junk=0xc04160b6, howto=-1069457280)
    at ../../kern/kern_shutdown.c:595
#3  0xc0293af9 in heap_extract (h=0xc77df138, obj=0xc7251a00)
    at ../../netinet/ip_dummynet.c:297
#4  0xc0294df0 in dummynet_io (m=0xc1137b00, pipe_nr=412, dir=1, fwa=0xd8675dd8)
    at ../../netinet/ip_dummynet.c:1222
#5  0xc029c8cd in ip_output (m0=0xc1137b00, opt=0x0, ro=0xc04cb7a4, flags=1,
    imo=0x0, inp=0x0) at ../../netinet/ip_output.c:1007
#6  0xc029bc82 in ip_forward (m=0xc1137b00, srcrt=0, next_hop=0x0)
    at ../../netinet/ip_input.c:1865
#7  0xc029aa87 in ip_input (m=0xc1137b00) at ../../netinet/ip_input.c:699
#8  0xc029ae0f in ipintr () at ../../netinet/ip_input.c:955
#9  0xc03ac1b9 in swi_net_next ()
#10 0xc0242845 in softclock () at ../../kern/kern_timeout.c:131
#11 0xc03ac173 in doreti_swi ()
#12 0x8049edf in ?? ()
#13 0x804a5e6 in ?? ()
#14 0x804b530 in ?? ()
#15 0x2807ae89 in ?? ()
#16 0x2807a9db in ?? ()
#17 0x80498b6 in ?? ()
#18 0x804926d in ?? ()
(kgdb) up 3
#3  0xc0293af9 in heap_extract (h=0xc77df138, obj=0xc7251a00)
    at ../../netinet/ip_dummynet.c:297
297                 panic("dummynet: heap_extract");
(kgdb) l
292                 panic("dummynet: heap_extract from middle not supported
on this heap!!!\n");
293             father = *((int *)((char *)obj + h->offset)) ;
294             if (father < 0 || father >= h->elements) {
295                 printf("dummynet: heap_extract, father %d out of bound
0..%d\n",
296                     father, h->elements);
297                 panic("dummynet: heap_extract");
298             }
299         }
300         RESET_OFFSET(h, father);
301         child = HEAP_LEFT(father) ;         /* left child */


Sources:

static void
heap_extract(struct dn_heap *h, void *obj)
{
    int child, father, max = h->elements - 1 ;

    if (max < 0) {
        printf("dummynet: warning, extract from empty heap 0x%p\n", h);
        return ;
    }
    father = 0 ; /* default: move up smallest child */
    if (obj != NULL) { /* extract specific element, index is at offset */
        if (h->offset <= 0)
            panic("dummynet: heap_extract from middle not supported on this heap!!!
        father = *((int *)((char *)obj + h->offset)) ;
        if (father < 0 || father >= h->elements) {
            printf("dummynet: heap_extract, father %d out of bound 0..%d\n",
                father, h->elements);
            panic("dummynet: heap_extract");
        }
    }


So: (father < 0 || father >= h->elements) was true.

pipe_nr=412 is a queue, configured like this:

q00412: weight 99 pipe 4  8 KB 512 queues (512 buckets) droptail
    mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
q00410: weight 1 pipe 4  8 KB 0 queues (512 buckets) droptail
    mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
q00411: weight 1 pipe 4  8 KB 515 queues (512 buckets) droptail
    mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
00004:   1.800 Mbit/s    0 ms  12 KB 0 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000



-- 
Paweł Małachowski



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041215150824.GA34851>