Date: Fri, 4 Nov 2005 18:35:26 +0200 From: Giorgos Keramidas <keramida@linux.gr> To: Andre Oppermann <andre@freebsd.org> Cc: glebius@freebsd.org, current@freebsd.org, Kris Kennaway <kris@obsecurity.org> Subject: Re: panic: mb_dtor_pack: ref_cnt != 1 Message-ID: <20051104163526.GC82727@flame.pc> In-Reply-To: <436B885B.6010609@freebsd.org> References: <20051104092724.GA33945@xor.obsecurity.org> <436B70FA.3080401@freebsd.org> <436B885B.6010609@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2005-11-04 17:12, Andre Oppermann <andre@freebsd.org> wrote:
> Ok, thanks to Danny Braniss and Peter Holm the KASSERT is working now.
Very fast fix. Thanks. I barely had the time to build a kernel and
read Peter's warning about a broken build, before the fix was ready :)
> Index: kern/uipc_mbuf.c
> ===================================================================
> RCS file: /home/ncvs/src/sys/kern/uipc_mbuf.c,v
> retrieving revision 1.156
> diff -u -p -r1.156 uipc_mbuf.c
> --- kern/uipc_mbuf.c 2 Nov 2005 16:20:35 -0000 1.156
> +++ kern/uipc_mbuf.c 4 Nov 2005 16:09:07 -0000
> @@ -215,9 +215,11 @@ mb_free_ext(struct mbuf *m)
>
> /* Free attached storage if this mbuf is the only reference to it.
> */
> if (*(m->m_ext.ref_cnt) == 1 ||
> - atomic_fetchadd_int(m->m_ext.ref_cnt, -1) == 1) {
> + atomic_fetchadd_int(m->m_ext.ref_cnt, -1) == 0) {
> switch (m->m_ext.ext_type) {
> - case EXT_CLUSTER:
> + case EXT_CLUSTER: /* The packet zone is special. */
> + if (*(m->m_ext.ref_cnt) == 0)
> + *(m->m_ext.ref_cnt) = 1;
> uma_zfree(zone_pack, m);
> return; /* Job done. */
> break;
> Index: kern/kern_mbuf.c
> ===================================================================
> RCS file: /home/ncvs/src/sys/kern/kern_mbuf.c,v
> retrieving revision 1.12
> diff -u -p -r1.12 kern_mbuf.c
> --- kern/kern_mbuf.c 2 Nov 2005 16:20:35 -0000 1.12
> +++ kern/kern_mbuf.c 4 Nov 2005 16:09:07 -0000
> @@ -395,11 +395,10 @@ mb_ctor_clust(void *mem, int size, void
> static void
> mb_dtor_clust(void *mem, int size, void *arg)
> {
> - u_int *refcnt;
>
> - refcnt = uma_find_refcnt(zone_clust, mem);
> - KASSERT(*refcnt == 1, ("%s: refcnt incorrect %u", __func__,
> *refcnt));
> - *refcnt = 0;
> + KASSERT(*(uma_find_refcnt(zone_clust, mem)) <= 1,
> + ("%s: refcnt incorrect %u", __func__,
> + *(uma_find_refcnt(zone_clust, mem))) );
> #ifdef INVARIANTS
> trash_dtor(mem, size, arg);
> #endif
> _______________________________________________
> freebsd-current@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051104163526.GC82727>