kern/101763: [panic] sodealloc(): so_count 1

[Gleb Kozyrev]

The following reply was made to PR kern/101763; it has been noted by GNATS.

From: "Gleb Kozyrev" <gkozyrev at gmail.com>
To: <bug-followup at FreeBSD.org>
Cc: <freebsd-current at FreeBSD.org>,
	"Robert Watson" <rwatson at FreeBSD.org>
Subject: kern/101763: [panic] sodealloc(): so_count 1
Date: Fri, 11 Aug 2006 11:41:50 +0300

 Gleb Kozyrev wrote to "Robert Watson" <rwatson at FreeBSD.org> on Thu, 10 Aug 2006 19:35:12 +0300:
 
 >>> i386 7.0-CURRENT #0: Sun Aug 6 repeatedly panics when doing some default
 >>> periodic jobs at 3 AM.
 
 RW>> Could you file a PR for this, and forward me the PR receipt?  I'd be
 RW>> happy to investigate this problem.  I've seen one or two other reports
 RW>> of so_count 1, but not in a way that's reproduceable.  The output of
 RW>> the following DDB commands would be most helpful:
 
 RW>>    show pcpu
 RW>>    show allpcpu
 RW>>    alltrace
 RW>>    show  alllocks
 
 GK> Here you are: kern/101763
 
 I'm sorry for misleading you.
 You see, for some reasons I forgot that there's a little jail on
 that machine. ;)
 It is ipfw in jail that triggers the panic invoked from
 /etc/periodic/security/500.ipfwdenied
 
 Today the coredump was successfully saved. So if it still matters..
 
 =========Beginning of the citation==============
 (kgdb) where
 #0  doadump () at pcpu.h:166
 #1  0xc06a3ee0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
 #2  0xc06a41f5 in panic (fmt=0xc092e717 "sodealloc(): so_count %d") at /usr/src/sys/kern/kern_shutdown.c:565
 #3  0xc06e45cc in sodealloc (so=0xc1a163e4) at /usr/src/sys/kern/uipc_socket.c:289
 #4  0xc06e4811 in socreate (dom=0, aso=0x0, type=3, proto=255, cred=0xc19f5180, td=0xc18ad510) at
 /usr/src/sys/kern/uipc_socket.c:370
 #5  0xc06e8985 in socket (td=0xc18ad510, uap=0xc853bd04) at /usr/src/sys/kern/uipc_syscalls.c:175
 #6  0xc08a0d7e in syscall (frame=
       {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = -1077943668, tf_esi = 136331264, tf_ebp = -1077943800, tf_isp = -934036124,
 tf_ebx = 54, tf_edx = 0, tf_ecx = 0, tf_eax = 97, tf_trapno = 12, tf_err = 2, tf_eip = 672368711, tf_cs = 51, tf_eflags = 582,
 tf_esp = -1077943844, tf_ss = 59})
     at /usr/src/sys/i386/i386/trap.c:1006
 #7  0xc088bb3f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:191
 #8  0x00000033 in ?? ()
 Previous frame inner to this frame (corrupt stack?)
 (kgdb) frame 3
 #3  0xc06e45cc in sodealloc (so=0xc1a163e4) at /usr/src/sys/kern/uipc_socket.c:289
 289             KASSERT(so->so_count == 0, ("sodealloc(): so_count %d", so->so_count));
 (kgdb) print *so
 $1 = {so_count = 1, so_type = 3, so_options = 0, so_linger = 0, so_state = 0, so_qstate = 0, so_pcb = 0x0, so_proto = 0xc09dbd5c,
 so_head = 0x0,
   so_incomp = {tqh_first = 0x0, tqh_last = 0xc1a16400}, so_comp = {tqh_first = 0x0, tqh_last = 0xc1a16408}, so_list = {tqe_next =
 0x0, tqe_prev = 0x0},
   so_qlen = 0, so_incqlen = 0, so_qlimit = 0, so_timeo = 0, so_error = 0, so_sigio = 0x0, so_oobmark = 0, so_aiojobq = {tqh_first =
 0x0,
     tqh_last = 0xc1a1642c}, so_rcv = {sb_sel = {si_thrlist = {tqe_next = 0x0, tqe_prev = 0x0}, si_thread = 0x0, si_note = {kl_list =
 {slh_first = 0x0},
         kl_lock = 0xc068a3f4 <knlist_mtx_lock>, kl_unlock = 0xc068a410 <knlist_mtx_unlock>, kl_locked = 0xc068a42c
 <knlist_mtx_locked>,
         kl_lockarg = 0xc1a16458}, si_flags = 0}, sb_mtx = {mtx_object = {lo_name = 0xc092b0f2 "so_rcv", lo_type = 0xc092b0f2
 "so_rcv", lo_flags = 16973824,
         lo_witness_data = {lod_list = {stqe_next = 0xc0a25fe8}, lod_witness = 0xc0a25fe8}}, mtx_lock = 4, mtx_recurse = 0}, sb_state
 = 0, sb_mb = 0x0,
     sb_mbtail = 0x0, sb_lastrecord = 0x0, sb_cc = 0, sb_hiwat = 0, sb_mbcnt = 0, sb_mbmax = 0, sb_ctl = 0, sb_lowat = 0, sb_timeo =
 0, sb_flags = 0},
   so_snd = {sb_sel = {si_thrlist = {tqe_next = 0x0, tqe_prev = 0x0}, si_thread = 0x0, si_note = {kl_list = {slh_first = 0x0},
         kl_lock = 0xc068a3f4 <knlist_mtx_lock>, kl_unlock = 0xc068a410 <knlist_mtx_unlock>, kl_locked = 0xc068a42c
 <knlist_mtx_locked>,
         kl_lockarg = 0xc1a164c4}, si_flags = 0}, sb_mtx = {mtx_object = {lo_name = 0xc092b0eb "so_snd", lo_type = 0xc092b0eb
 "so_snd", lo_flags = 16973824,
         lo_witness_data = {lod_list = {stqe_next = 0xc0a26010}, lod_witness = 0xc0a26010}}, mtx_lock = 4, mtx_recurse = 0}, sb_state
 = 0, sb_mb = 0x0,
     sb_mbtail = 0x0, sb_lastrecord = 0x0, sb_cc = 0, sb_hiwat = 0, sb_mbcnt = 0, sb_mbmax = 0, sb_ctl = 0, sb_lowat = 0, sb_timeo =
 0, sb_flags = 0},
   so_upcall = 0, so_upcallarg = 0x0, so_cred = 0xc19f5180, so_label = 0x0, so_peerlabel = 0x0, so_gencnt = 830, so_emuldata = 0x0,
 so_accf = 0x0}
 (
 =========The end of the citation================
 
 -- 
 With best regards, Gleb Kozyrev.