panic: sbflush_locked on 5.4-p5/i386

[Robert Watson]

On Mon, 25 Jul 2005, Rong-En Fan wrote:

> I have a 5.4-p5 running on i386. Got a panic: panic: sbflush_locked: cc 
> 0 || mb 0xc33bf000 || mbcnt 4294967040 It is an web server running 
> Apache and Postfix as a backup MX. I'm using gmirror on all partitions 
> and thus cannot get a dump (swap is on gmirror). Some ddb outputs are 
> below.

Is this system an SMP and/or HTT system?

If this problem is reproduceable, could I ask you to capture the following 
serial console output from DDB:

show pcpu
show pcpu 0
show pcpu 1
show pcpu 2
show pcpu 3                 # continue until out of CPU's
ps

And then traces of interesting threads -- in particular, threads mentioned 
in the pcpu output, the current thread, and threads of network-related 
processors (most importantly, the netisr thread, but also other active 
threads -- i.e., without a wchan listed).

This sounds like a race between two threads in the TCP code, but to 
diagnose it further, I'll need to know what else is running.  If you have 
access to serial gdb, I'd be quite interested in seeing the output of "l 
*so" in the sofree() frame, *tp in a tcp-related frame, and *inp if it's 
available in one of those frames, likely the in_pcbdetach() frame or 
tcp_close() frame if it's there.

Would it be possible to add an extra ATA disk to use for swap and 
capturing a core dump?

Robert N M Watson


>
> Google told me that 
> http://lists.freebsd.org/pipermail/freebsd-current/2004-December/044535.html 
> looks related. But the code path is different. Note that the patch in 
> that mail is already in 5.4.
>
> If needed, I can provide kernel conf. I also tuned following sysctls:
> vfs.hirunningspace=2097152
> kern.ipc.somaxconn=4096
> kern.maxfiles=30000
> kern.maxfilesperproc=30000
> net.inet.ip.random_id=1
> machdep.hyperthreading_allowed=1
>
> The DDB messages go here:
> cpuid = 3
> KDB: enter: panic
> [thread pid 61 tid 100061 ]
> Stopped at      kdb_enter+0x2b: nop
> db> wh
> Tracing pid 61 tid 100061 td 0xc311e180
> kdb_enter(c05f3bc6) at kdb_enter+0x2b
> panic(c05f6f09,0,c33bf000,ffffff00,c3a1970c) at panic+0x127
> sbflush_locked(c3a1970c,c3a19654,e74aeba4,c04e4cb4,c3a1970c) at
> sbflush_locked+0x6f
> sbrelease_locked(c3a1970c,c3a19654) at sbrelease_locked+0xd
> sofree(c3a19654) at sofree+0x26c
> in_pcbdetach(c371d870,c3e996f0,c3e996f0,e74aec9c,c05355df) at in_pcbdetach+0xb6
> tcp_close(c3e996f0,1,1,1042e,1) at tcp_close+0x16
> tcp_input(c4513400,14,1c1e708c,0,0) at tcp_input+0x2297
> ip_input(c4513400) at ip_input+0x4f1
> netisr_processqueue(c0643298) at netisr_processqueue+0xa3
> swi_net(0) at swi_net+0xf2
> ithread_loop(c3094c80,e74aed48) at ithread_loop+0x159
> fork_exit(c049c138,c3094c80,e74aed48) at fork_exit+0x75
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0x1, eip = 0, esp = 0xe74aed7c, ebp = 0 ---
> db> ps
>   61 c311ce20    0     0     0 0000204 [CPU 3] swi1: net
>
> Regards,
> Rong-En Fan
> _______________________________________________
> freebsd-stable at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe at freebsd.org"
>