Re: kernel crash in tcp_subr.c:2386

> On Feb 12, 2024, at 10:36, Alexander Leidinger <alexleidingerde@gmail.com> wrote:
> 
> Hi,
> 
> I got a coredump with sources from 2024-02-10-144617 (GMT+0100):
Hi Alexander,

we are aware of this problem, but haven't found a way to reproduce it.
Do you know how to reproduce this?

Best regards
Michael
> ---snip---
> __curthread () at /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
> 57              __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct pcpu,
> (kgdb) #0  __curthread () at /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
>        td = <optimized out>
> #1  doadump (textdump=textdump@entry=1)
>    at /space/system/usr_src/sys/kern/kern_shutdown.c:403
>        error = 0
>        coredump = <optimized out>
> #2  0xffffffff8052fe85 in kern_reboot (howto=260)
>    at /space/system/usr_src/sys/kern/kern_shutdown.c:521
>        once = 0
>        __pc = <optimized out>
> #3  0xffffffff80530382 in vpanic (
>    fmt=0xffffffff808df476 "Assertion %s failed at %s:%d",
>    ap=ap@entry=0xfffffe08a079ebf0)
>    at /space/system/usr_src/sys/kern/kern_shutdownc:973
>        buf = "Assertion !callout_active(&tp->t_callout) failed at /space/system/usr_src/sys/netinet/tcp_subr.c:2386", '\000' <repeats 154 times>
>        __pc = <optimized out>
>        __pc = <optimized out>
>        __pc = <optimized out>
>        other_cpus = {__bits = {14680063, 0 <repeats 15 times>}}
>        td = 0xfffff8068ef99740
>        bootopt = <unavailable>
>        newpanic = <optimized out>
> #4  0xffffffff805301d3 in panic (fmt=<unavailable>)
>    at /space/system/usr_src/sys/kern/kern_shutdown.c:889
>        ap = {{gp_offset = 32, fp_offset = 48,
>            overflow_arg_area = 0xfffffe08a079ec20,
>            reg_save_area = 0xfffffe08a079ebc0}}
> #5  0xffffffff806c9d8c in tcp_discardcb (tp=tp@entry=0xfffff80af441ba80)
>    at /space/system/usr_src/sys/netinet/tcp_subr.c:2386
>        inp = 0xfffff80af441ba80
>        so = 0xfffff804d23d2780
>        m = <optimized out>
>        isipv6 = <optimized out>
> #6  0xffffffff806d6291 in tcp_usr_detach (so=0xfffff804d23d2780)
>    at /space/system/usr_src/sys/netinet/tcp_usrreq.c:214
>        inp = 0xfffff80af441ba80
>        tp = 0xfffff80af441ba80
> #7  0xffffffff805dba57 in sofree (so=0xfffff804d23d2780)
>    at /space/system/usr_src/sys/kern/uipc_socket.c:1205
>        pr = 0xffffffff80a8bd18 <tcp_protosw>
> #8  sorele_locked (so=so@entry=0xfffff804d23d2780)
>    at /space/system/usr_src/sys/kern/uipc_socket.c:1232
> No locals.
> #9  0xffffffff805dc8c0 in soclose (so=0xfffff804d23d2780)
>    at /space/system/usr_src/sys/kern/uipc_socket.c:1302
>        lqueue = {tqh_first = 0xfffff8068ef99740,
>          tqh_last = 0xfffffe08a079ed40}
>        error = 0
>        saved_vnet = 0x0
>        last = <optimized out>
>        listening = <optimized out>
> #10 0xffffffff804ccbd1 in fo_close (fp=0xfffff805f2dfc500, td=<unavailable>)
>    at /space/system/usr_src/sys/sys/file.h:390
> No locals.
> #11 _fdrop (fp=fp@entry=0xfffff805f2dfc500, td=<unavailable>,
>    td@entry=0xfffff8068ef99740)
>    at /space/system/usr_src/sys/kern/kern_descrip.c:3666
>        count = <unavailable>
>        error = <optimized out>
> #12 0xffffffff804d02f3 in closef (fp=fp@entry=0xfffff805f2dfc500,
>    td=td@entry=0xfffff8068ef99740)
>    at /space/system/usr_src/sys/kern/kern_descrip.c:2839
>        _error = 0
>        _fp = 0xfffff805f2dfc500
>        lf = {l_start = -8791759350504, l_len = -8791759350528, l_pid = 0,
>          l_type = 0, l_whence = 0, l_sysid = 0}
>        vp = <optimized out>
>        fdtol = <optimized out>
>        fdp = <optimized out>
> #13 0xffffffff804cd50c in closefp_impl (fdp=0xfffffe07afebf860, fd=19,
>    fp=0xfffff805f2dfc500, td=0xfffff8068ef99740, audit=<optimized out>)
>    at /space/system/usr_src/sys/kern/kern_descrip.c:1315
>        error = <optimized out>
> #14 closefp (fdp=0xfffffe07afebf860, fd=19, fp=0xfffff805f2dfc500,
>    td=0xfffff8068ef99740, holdleaders=true, audit=<optimized out>)
>    at /space/system/usr_src/sys/kern/kern_descrip.c:1372
> No locals.
> #15 0xffffffff808597d6 in syscallenter (td=0xfffff8068ef99740)
>    at /space/system/usr_src/sys/amd64/amd64/../../kern/subr_syscall.c:186
>        se = 0xffffffff80a48330 <sysent+192>
>        p = 0xfffffe07f29995c0
>        sa = 0xfffff8068ef99b30
>        error = <optimized out>
>        sy_thr_static = <optimized out>
>        traced = <optimized out>
> #16 amd64_syscall (td=0xfffff8068ef99740, traced=0)
>    at /space/system/usr_src/sys/amd64/amd64/trap.c:1192
>        ksi = {ksi_link = {tqe_next = 0xfffffe08a079ef30,
>            tqe_prev = 0xffffffff808588af <trap+2351>}, ksi_info = {
>            si_signo = 1, si_errno = 0, si_code = 2015268872, si_pid = -512,
>            si_uid = 2398721856, si_status = -2042,
>            si_addr = 0xfffffe08a079ef40, si_value = {sival_int = -1602621824,
>              sival_ptr = 0xfffffe08a079ee80, sigval_int = -1602621824,
>              sigval_ptr = 0xfffffe08a079ee80}, _reason = {_fault = {
>                _trapno = 1489045984}, _timer = {_timerid = 1489045984,
>                _overrun = 17999}, _mesgq = {_mqd = 1489045984}, _poll = {
>                _band = 77306605406688}, _capsicum = {_syscall = 1489045984},
>              __spare__ = {__spare1__ = 77306605406688, __spare2__ = {
>                  1489814048, 17999, 208, 0, 0, 0, 992191072}}}},
>          ksi_flags = 975329968, ksi_sigq = 0xffffffff8082f8f3 <Xinvlop+179>}
> #17 <signal handler called>
> No locals.
> #18 0x00003af13b17fc9a in ?? ()
> No symbol table info available.
> Backtrace stopped: Cannot access memory at address 0x3af13a225ab8
> ---snip---
> 
> Any ideas?
> 
> Due to another issue in userland, I updated to 2024-02-11-212006, but I have the above mentioned version and core still in a BE if needed
> 
> Bye,
> Alexander.