panic in RELENG_5 UMA
glebius at FreeBSD.org
Tue Jun 21 09:31:53 GMT 2005
On Tue, Jun 21, 2005 at 11:28:36AM +0200, Jeremie Le Hen wrote:
J> > IMHO, this looks like a race. The route is not locked, when
J> > its llinfo is edited.
J> > Probably the mbuf was freed when arp reply arrived and la_hold was send.
J> > Look into in_arpinput() near 736:
J> > (*ifp->if_output)(ifp, la->la_hold, rt_key(rt), rt);
J> > la->la_hold = 0;
J> > Yeah, I have just triggered another panic running 15 instances of this
J> > script on SMP box:
J> > (
J> > while (true); do
J> > arp -d 220.127.116.11 >/dev/null 2>&1;
J> > ping -c 1 -t 1 18.104.22.168 >/dev/null 2>&1;
J> > done
J> > ) &
J> > But my duplicate free is in fxp_txeof(). This means that output thread has
J> > won the race.
J> This explanation sounds good but my box is an UP with PREEMPTION.
J> Is is supposed to be also possible in this case ?
I guess yes, because of preemption.
Totus tuus, Glebius.
More information about the freebsd-stable