kern/113548: [dummynet] system hangs with dummynet queues

Alexey Illarionov littlesavage at orionet.ru
Mon Jun 11 00:50:04 UTC 2007


>Number:         113548
>Category:       kern
>Synopsis:       [dummynet] system hangs with dummynet queues
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jun 11 00:50:03 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Alexey Illarionov
>Release:        6.2-STABLE
>Organization:
>Environment:
FreeBSD ftp.orionet.ru 6.2-STABLE FreeBSD 6.2-STABLE #5: Mon Jun 11 02:31:15 MSD 2007     littlesavage at ftp.orionet.ru:/usr/obj/usr/src/sys/FTP  i386
>Description:
I got some system freezes and kernel panicks when i tried to use queues in ipfw. It occurs 1-2 times a day.

That is my rules:
..
02100 queue 105 ip from any to me in via vlan204
02200 queue 150 tag 1 ip from 10.100.1.6 to any not tagged 1 out via vlan204
02300 queue 140 tag 1 ip from me 8767,6667,411,4111,22 to any not tagged 1 out via vlan204
02400 queue 130 tag 1 ip from me 80 to any not tagged 1 out via vlan204
02500 queue 120 tag 1 ip from me to any not tagged 1 out via vlan204
02600 queue 110 tag 1 ip from any to any not tagged 1 out via vlan204
..

When i use rule 2100 only, the kernel panics. When i use rules rules 2200-2600, its freezes. When i use all that rules, its panics and freezes. 

 # ipfw pipe show
00001:  32.000 Kbit/s    0 ms   50 sl. 1 queues (64 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0xffffffff/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  5 ip           0.0.0.0/0        10.100.39.13/0        6      288  0    0   0
00002:  32.000 Kbit/s    0 ms   50 sl. 0 queues (64 buckets) droptail
00100:  50.000 Mbit/s    0 ms   50 sl. 0 queues (1 buckets) droptail
00105:  50.000 Mbit/s    0 ms   50 sl. 0 queues (1 buckets) droptail
q00140: weight 80 pipe 100   50 sl. 0 queues (1 buckets) droptail
q00110: weight 10 pipe 100   50 sl. 0 queues (1 buckets) droptail
q00130: weight 70 pipe 100   50 sl. 0 queues (1 buckets) droptail
q00150: weight 100 pipe 100   50 sl. 0 queues (1 buckets) droptail
q00120: weight 10 pipe 100   50 sl. 1 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
q00105: weight 50 pipe 105   50 sl. 1 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000

Once I could reproduce the same kernel panic on different machine with the following configuration:

dmesg:
FreeBSD switch1.orionet.ru 6.2-STABLE FreeBSD 6.2-STABLE #0: Thu Jun  7 21:27:46 MSD 2007     littlesavage at switch1.orionet.ru:/usr/obj/usr/src/sys/VOIP  i386
# dmesg
Copyright (c) 1992-2007 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 6.2-STABLE #0: Thu Jun  7 21:27:46 MSD 2007
    littlesavage at switch1.orionet.ru:/usr/obj/usr/src/sys/VOIP
WARNING: WITNESS option enabled, expect reduced performance.
module_register: module g_concat already exists!
Module g_concat failed to register: 17
module_register: module g_label already exists!
Module g_label failed to register: 17
ACPI APIC Table: <DELL   WS 420 >
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel Pentium III (930.96-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x686  Stepping = 6
  Features=0x383fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE>
real memory  = 536469504 (511 MB)
avail memory = 515223552 (491 MB)
FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
 cpu0 (BSP): APIC ID:  0
 cpu1 (AP): APIC ID:  1
ioapic0: Changing APIC ID to 2
ioapic0 <Version 2.0> irqs 0-23 on motherboard
kbd1 at kbdmux0
acpi0: <DELL WS 420 > on motherboard
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
cpu0: <ACPI CPU> on acpi0
cpu1: <ACPI CPU> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1: <display, VGA> at device 0.0 (no driver attached)
pcib2: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci2: <ACPI PCI bus> on pcib2
xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0xec80-0xecff mem 0xf9fffc00-0xf9fffc7f irq 16 at device 4.0 on pci2
miibus0: <MII bus> on xl0
xlphy0: <3c905C 10/100 internal PHY> on miibus0
xlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
xl0: Ethernet address: 00:b0:d0:3e:37:0e
pci2: <network> at device 9.0 (no driver attached)
pcib3: <PCI-PCI bridge> at device 14.0 on pci2
pci3: <PCI bus> on pcib3
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH UDMA66 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xffa0-0xffaf at device 31.1 on pci0
ata0: <ATA channel 0> on atapci0
ata1: <ATA channel 1> on atapci0
uhci0: <Intel 82801AA (ICH) USB controller> port 0xff80-0xff9f irq 19 at device 31.2 on pci0
uhci0: [GIANT-LOCKED]
usb0: <Intel 82801AA (ICH) USB controller> on uhci0
usb0: USB revision 1.0
uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
pci0: <serial bus, SMBus> at device 31.3 (no driver attached)
fdc0: <floppy drive controller> port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0
fdc0: does not respond
device_attach: fdc0 attach returned 6
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A
sio1: <16550A-compatible COM port> port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
ppc0: <ECP parallel printer port> port 0x378-0x37f,0x778-0x77f irq 7 on acpi0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
ppbus0: <Parallel port bus> on ppc0
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
fdc0: <floppy drive controller> port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0
fdc0: does not respond
device_attach: fdc0 attach returned 6
pmtimer0 on isa0
orm0: <ISA Option ROMs> at iomem 0xc0000-0xc97ff,0xc9800-0xcbfff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounters tick every 1.000 msec
ipfw2 initialized, divert enabled, rule-based forwarding enabled, default to deny, logging limited to 100 packets/entry by default
The GEOM class CONCAT is already loaded.
The GEOM class LABEL is already loaded.
ad0: 58643MB <IC35L060AVV207 0 V22OA66A> at ata0-master UDMA66
acd0: CDROM <Lite-On LTN483S 48x Max/PD02> at ata1-master PIO4
SMP: AP CPU #1 Launched!

ifconfig:
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=9<RXCSUM,VLAN_MTU>
        inet 10.100.6.7 netmask 0xffffff00 broadcast 10.100.6.255
        ether 00:b0:d0:3e:37:0e
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active

ipfw rules:
00010 allow ip from 10.100.1.1 to me
00011 allow ip from me to 10.100.1.1
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to any dst-port 135-139,445
00500 deny log logamount 100 ip from any to 0.0.0.0/8
00600 deny log logamount 100 ip from any to 169.254.0.0/16
00700 deny log logamount 100 ip from any to 192.0.2.0/24
00800 deny log logamount 100 ip from any to 198.18.0.0/15
00900 deny log logamount 100 ip from any to 224.0.0.0/4
01000 deny log logamount 100 ip from any to 240.0.0.0/4
01700 queue 105 ip from any to me in via xl0
01800 queue 150 tag 1 ip from 10.100.1.6 to any not tagged 1 out via xl0
01900 queue 140 tag 1 ip from me 8767,6667,411,4111,22 to any not tagged 1 out via xl0
02000 queue 130 tag 1 ip from me 80 to any not tagged 1 out via xl0
02100 queue 120 tag 1 ip from me to any not tagged 1 out via xl0
02200 queue 110 tag 1 ip from any to any not tagged 1 out via xl0
02300 allow ip from any to me
02400 allow ip from me to any

pipes:

00100:  50.000 Mbit/s    0 ms  100 sl. 0 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
00105:  50.000 Mbit/s    0 ms  100 sl. 0 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
q00140: weight 80 pipe 100  100 sl. 1 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
q00110: weight 1 pipe 100  100 sl. 0 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
q00130: weight 70 pipe 100  100 sl. 0 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
q00150: weight 100 pipe 100  100 sl. 0 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
q00120: weight 10 pipe 100  100 sl. 1 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
q00105: weight 50 pipe 105  100 sl. 1 queues (1 buckets) 
          GRED w_q 0.001999 min_th 10 max_th 30 max_p 0.099991
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000

kgdb:
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:

dummynet: 1657171 q:  0 dummynet: avg: 0 dummynet: waking up pipe 105 at 1

dummynet: 1657171 q:  0 dummynet: avg: 0 dummynet: waking up pipe 105 at 1
Limiting icmp ping response from 275 to 200 packets/sec

dummynet: 1657171 q:  0 dummynet: avg: 0 dummynet: waking up pipe 100 at 8

dummynet: 1657243 q:  7 dummynet: avg: 0 
dummynet: 1657243 q:  0 dummynet: avg: 0 dummynet: waking up pipe 105 at 1

dummynet: 1657243 q:  8 dummynet: avg: 0 panic: packet on dummynet queue w/o dummynet tag!
cpuid = 0
KDB: stack backtrace:
kdb_backtrace(100,c3314600,25,0,0,...) at kdb_backtrace+0x29
panic(c078e685,de7cac90,c060463c,c3be4700,d398b380,...) at panic+0x114
dn_tag_get(c3be4700,d398b380,0,c05a3fea,c0860e78,...) at dn_tag_get+0x24
ready_event_wfq(c34fba00,de7cacac,de7cacb0) at ready_event_wfq+0x4a4
dummynet_task(0,1) at dummynet_task+0x23f
taskqueue_run(c358be80) at taskqueue_run+0xc8
taskqueue_thread_loop(c08a1070,de7cad38,c08a1070,c05a0514,0,...) at taskqueue_thread_loop+0x4a
fork_exit(c05a0514,c08a1070,de7cad38) at fork_exit+0xa0
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xde7cad6c, ebp = 0 ---
Uptime: 27m38s
Dumping 511 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 511MB (130718 pages) 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:165
165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));

bt
#0  doadump () at pcpu.h:165
#1  0xc0580738 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc0580a4d in panic (fmt=0xc078e685 "packet on dummynet queue w/o dummynet tag!")
    at /usr/src/sys/kern/kern_shutdown.c:565
#3  0xc0603ea8 in dn_tag_get (m=0x0) at /usr/src/sys/netinet/ip_dummynet.c:437
#4  0xc060463c in ready_event_wfq (p=0xc34fba00, head=0xde7cacac, tail=0xde7cacb0) at /usr/src/sys/netinet/ip_dummynet.c:703
#5  0xc06048ef in dummynet_task (context=0x0, pending=0) at /usr/src/sys/netinet/ip_dummynet.c:803
#6  0xc05a01d4 in taskqueue_run (queue=0xc358be80) at /usr/src/sys/kern/subr_taskqueue.c:257
#7  0xc05a055e in taskqueue_thread_loop (arg=0x0) at /usr/src/sys/kern/subr_taskqueue.c:376
#8  0xc056b8c4 in fork_exit (callout=0xc05a0514 <taskqueue_thread_loop>, arg=0xc08a1070, frame=0xde7cad38)
    at /usr/src/sys/kern/kern_fork.c:821
#9  0xc072af7c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
(kgdb) up 4
#4  0xc060463c in ready_event_wfq (p=0xc34fba00, head=0xde7cacac, tail=0xde7cacb0) at /usr/src/sys/netinet/ip_dummynet.c:703
703             dn_tag_get(p->tail)->output_time += t ;
(kgdb) p *p
$1 = {next = {sle_next = 0x0}, pipe_nr = 100, bandwidth = 50000000, delay = 0, head = 0x0, tail = 0xc3be4700, 
  scheduler_heap = {size = 16, elements = 1, offset = 0, p = 0xc39eca00}, not_eligible_heap = {size = 16, elements = 0, 
    offset = 0, p = 0xc3721e00}, idle_heap = {size = 16, elements = 0, offset = 124, p = 0xc39ece00}, V = 550502, sum = 10, 
  numbytes = -1840590592, sched_time = 1657235, if_name = '\0' <repeats 15 times>, ifp = 0x0, ready = 0, fs = {next = {
      sle_next = 0x0}, fs_nr = 0, flags_fs = 6, pipe = 0xc34fba00, parent_nr = 0, weight = 0, qsize = 100, plr = 0, 
    flow_mask = {dst_ip = 0, src_ip = 0, dst_port = 0, src_port = 0, proto = 0 '\0', flags = 0 '\0', addr_type = 0 '\0', 
      dst_ip6 = {__u6_addr = {__u6_addr8 = '\0' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {
            0, 0, 0, 0}}}, src_ip6 = {__u6_addr = {__u6_addr8 = '\0' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 
            0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, flow_id6 = 0, frag_id6 = 0}, rq_size = 1, rq_elements = 0, 
    rq = 0xc3603840, last_expired = 0, backlogged = 0, w_q = 131, max_th = 1966080, min_th = 655360, max_p = 6553, 
    c_1 = 327, c_2 = 3270, c_3 = 1966, c_4 = 52430, w_q_lookup = 0xc34da400, lookup_depth = 256, lookup_step = 1, 
    lookup_weight = 65274, avg_pkt_size = 512, max_pkt_size = 1500}}

But the main problem is the system with following configuration:
# dmesg
Copyright (c) 1992-2007 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 6.2-STABLE #5: Mon Jun 11 02:31:15 MSD 2007
    littlesavage at ftp.orionet.ru:/usr/obj/usr/src/sys/FTP
WARNING: WITNESS option enabled, expect reduced performance.
ACPI APIC Table: <Nvidia AWRDACPI>
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: AMD Athlon(tm) 64 Processor 3200+ (2009.18-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x20ff0  Stepping = 0
  Features=0x78bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2>
  Features2=0x1<SSE3>
  AMD Features=0xe2500800<SYSCALL,NX,MMX+,FFXSR,LM,3DNow+,3DNow>
  AMD Features2=0x1<LAHF>
real memory  = 536805376 (511 MB)
avail memory = 515809280 (491 MB)
ioapic0 <Version 1.1> irqs 0-23 on motherboard
kbd1 at kbdmux0
acpi0: <Nvidia AWRDACPI> on motherboard
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x4008-0x400b on acpi0
cpu0: <ACPI CPU> on acpi0
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff,0xcf0-0xcf3 on acpi0
pci0: <ACPI PCI bus> on pcib0
isab0: <PCI-ISA bridge> at device 1.0 on pci0
isa0: <ISA bus> on isab0
pci0: <serial bus, SMBus> at device 1.1 (no driver attached)
atapci0: <nVidia nForce3 Pro UDMA133 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xf000-0xf00f at device 8.0 on pci0
ata0: <ATA channel 0> on atapci0
ata1: <ATA channel 1> on atapci0
atapci1: <nVidia nForce3 Pro SATA150 controller> port 0x9f0-0x9f7,0xbf0-0xbf3,0x970-0x977,0xb70-0xb73,0xe000-0xe00f,0xe400-0xe47f irq 20 at device 10.0 on pci0
ata2: <ATA channel 0> on atapci1
ata3: <ATA channel 1> on atapci1
pcib1: <ACPI PCI-PCI bridge> at device 11.0 on pci0
pci1: <ACPI PCI bus> on pcib1
pcib2: <ACPI PCI-PCI bridge> at device 14.0 on pci0
pci2: <ACPI PCI bus> on pcib2
atapci2: <VIA 6421 SATA150 controller> port 0xa000-0xa00f,0xa400-0xa40f,0xa800-0xa80f,0xac00-0xac0f,0xb000-0xb01f,0xb400-0xb4ff irq 19 at device 7.0 on pci2
ata4: <ATA channel 0> on atapci2
ata5: <ATA channel 1> on atapci2
skc0: <D-Link DGE-530T Gigabit Ethernet> port 0xb800-0xb8ff mem 0xf1000000-0xf1003fff irq 18 at device 10.0 on pci2
skc0: DGE-530T Gigabit Ethernet Adapter rev. (0x9)
sk0: <Marvell Semiconductor, Inc. Yukon> on skc0
sk0: Ethernet address: 00:17:9a:06:16:43
miibus0: <MII bus> on sk0
e1000phy0: <Marvell 88E1011 Gigabit PHY> on miibus0
e1000phy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX-FDX, auto
acpi_tz0: <Thermal Zone> on acpi0
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A, console
sio1: <16550A-compatible COM port> port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
pmtimer0 on isa0
orm0: <ISA Option ROM> at iomem 0xc8000-0xccfff on isa0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
ppc0: parallel port not found.
Timecounter "TSC" frequency 2009175908 Hz quality 800
Timecounters tick every 1.000 msec
ipfw2 initialized, divert enabled, rule-based forwarding enabled, default to deny, logging limited to 100 packets/entry by default

ifconfig:
sk0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=b<RXCSUM,TXCSUM,VLAN_MTU>
        inet 10.100.2.9 netmask 0xffffff00 broadcast 10.100.2.255
        ether 00:17:9a:06:16:43
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active
vlan204: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet 10.100.14.9 netmask 0xffffff00 broadcast 10.100.14.255
        ether 00:17:9a:06:16:43
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active
        vlan: 204 parent interface: sk0

kernel config:
machine         i386
#cpu            I486_CPU
#cpu            I586_CPU
cpu             I686_CPU
ident           FTP

makeoptions     DEBUG=-g                # Build kernel with gdb(1) debug symbols 
options         KDB
options         DDB
options         BREAK_TO_DEBUGGER
options         KDB_TRACE
options         KDB_UNATTENDED
options         DEVICE_POLLING
options         WITNESS
#options         WITNESS_SKIPSPIN
options         INVARIANTS
options         INVARIANT_SUPPORT
options         GEOM_LABEL
options         GEOM_CONCAT
options         SCHED_4BSD
options         HZ=2000

I try to use the following patch (don't know how it correct). Kernel panics end off, but freezes are not.

--- ip_dummynet.c_orig  Sun Jun 10 20:19:33 2007
+++ ip_dummynet.c       Mon Jun 11 03:56:54 2007
@@ -490,7 +490,8 @@
                 * whole pipe p and hoping in the future we are more successful.
                 */
                heap_insert(&extract_heap, pkt->output_time, pipe);
-       }
+       }else
+               pipe->tail = NULL;
 }
 
 /*
@@ -700,7 +701,8 @@
 
        if (p->bandwidth > 0)
            t = ( p->bandwidth -1 - p->numbytes) / p->bandwidth ;
-       dn_tag_get(p->tail)->output_time += t ;
+       if (p->head != NULL)
+               dn_tag_get(p->tail)->output_time += t ;
        p->sched_time = curr_time ;
        heap_insert(&wfq_ready_heap, curr_time + t, (void *)p);
        /* XXX should check errors on heap_insert, and drain the whole

When i use only pipes and not use queues, every tings work fine.

>How-To-Repeat:
Make 1-2 queues in 50Mbit/s pipe, load it with some traffic and wait one day.
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted:


More information about the freebsd-bugs mailing list