From owner-freebsd-ipfw@FreeBSD.ORG Wed Dec 15 15:07:26 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 616E416A4CE for ; Wed, 15 Dec 2004 15:07:26 +0000 (GMT) Received: from shellma.zin.lublin.pl (shellma.zin.lublin.pl [212.182.126.68]) by mx1.FreeBSD.org (Postfix) with ESMTP id 840B543D48 for ; Wed, 15 Dec 2004 15:07:25 +0000 (GMT) (envelope-from pawmal-posting@freebsd.lublin.pl) Received: by shellma.zin.lublin.pl (Postfix, from userid 1018) id C21D5347116; Wed, 15 Dec 2004 16:08:24 +0100 (CET) Date: Wed, 15 Dec 2004 16:08:24 +0100 From: Pawel Malachowski To: freebsd-ipfw@freebsd.org Message-ID: <20041215150824.GA34851@shellma.zin.lublin.pl> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.4.2i Subject: Panic with dummynet, RELENG_4 (dummynet: heap_extract). X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Dec 2004 15:07:26 -0000 Hello, It hit me some time ago. 4.10-STABLE, perfectly stable, no configuration changes for months (only xl(4) replaced with dc(4)), works rock solid for years. IPFW2, kernel Tue Sep 28 16:04:43 CEST 2004. This is direct call to panic(9) so probaly this is something that Should Never Happen. Question: how could it happen?! :) Details: panic: dummynet: heap_extract syncing disks... 2 done Uptime: 56d3h32m3s dumping to dev #ad/0x30001, offset 1572992 dump ata0: resetting devices .. done (kgdb) bt #0 dumpsys () at ../../kern/kern_shutdown.c:487 #1 0xc023c76f in boot (howto=256) at ../../kern/kern_shutdown.c:316 #2 0xc023cb94 in poweroff_wait (junk=0xc04160b6, howto=-1069457280) at ../../kern/kern_shutdown.c:595 #3 0xc0293af9 in heap_extract (h=0xc77df138, obj=0xc7251a00) at ../../netinet/ip_dummynet.c:297 #4 0xc0294df0 in dummynet_io (m=0xc1137b00, pipe_nr=412, dir=1, fwa=0xd8675dd8) at ../../netinet/ip_dummynet.c:1222 #5 0xc029c8cd in ip_output (m0=0xc1137b00, opt=0x0, ro=0xc04cb7a4, flags=1, imo=0x0, inp=0x0) at ../../netinet/ip_output.c:1007 #6 0xc029bc82 in ip_forward (m=0xc1137b00, srcrt=0, next_hop=0x0) at ../../netinet/ip_input.c:1865 #7 0xc029aa87 in ip_input (m=0xc1137b00) at ../../netinet/ip_input.c:699 #8 0xc029ae0f in ipintr () at ../../netinet/ip_input.c:955 #9 0xc03ac1b9 in swi_net_next () #10 0xc0242845 in softclock () at ../../kern/kern_timeout.c:131 #11 0xc03ac173 in doreti_swi () #12 0x8049edf in ?? () #13 0x804a5e6 in ?? () #14 0x804b530 in ?? () #15 0x2807ae89 in ?? () #16 0x2807a9db in ?? () #17 0x80498b6 in ?? () #18 0x804926d in ?? () (kgdb) up 3 #3 0xc0293af9 in heap_extract (h=0xc77df138, obj=0xc7251a00) at ../../netinet/ip_dummynet.c:297 297 panic("dummynet: heap_extract"); (kgdb) l 292 panic("dummynet: heap_extract from middle not supported on this heap!!!\n"); 293 father = *((int *)((char *)obj + h->offset)) ; 294 if (father < 0 || father >= h->elements) { 295 printf("dummynet: heap_extract, father %d out of bound 0..%d\n", 296 father, h->elements); 297 panic("dummynet: heap_extract"); 298 } 299 } 300 RESET_OFFSET(h, father); 301 child = HEAP_LEFT(father) ; /* left child */ Sources: static void heap_extract(struct dn_heap *h, void *obj) { int child, father, max = h->elements - 1 ; if (max < 0) { printf("dummynet: warning, extract from empty heap 0x%p\n", h); return ; } father = 0 ; /* default: move up smallest child */ if (obj != NULL) { /* extract specific element, index is at offset */ if (h->offset <= 0) panic("dummynet: heap_extract from middle not supported on this heap!!! father = *((int *)((char *)obj + h->offset)) ; if (father < 0 || father >= h->elements) { printf("dummynet: heap_extract, father %d out of bound 0..%d\n", father, h->elements); panic("dummynet: heap_extract"); } } So: (father < 0 || father >= h->elements) was true. pipe_nr=412 is a queue, configured like this: q00412: weight 99 pipe 4 8 KB 512 queues (512 buckets) droptail mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000 q00410: weight 1 pipe 4 8 KB 0 queues (512 buckets) droptail mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000 q00411: weight 1 pipe 4 8 KB 515 queues (512 buckets) droptail mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000 00004: 1.800 Mbit/s 0 ms 12 KB 0 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 -- Paweł Małachowski