5.1-RELEASE panic, trace included

[Maxime Henrion]

Pawel Jakub Dawidek wrote:
> On Sat, Jun 14, 2003 at 02:28:33AM -0400, Robert Watson wrote:
> +> If you have the kernel.debug for this kernel, could you send the gdb -k
> +> output of: 
> +> 
> +> l *in6_pcbbind+0x2a7
> 
> I've looked at objdump -d kernel, and it looks like this is somewhere here:
> 
> 214:					t = in_pcblookup_local(pcbinfo,
> 215:						sin.sin_addr, lport,
> 216:						INPLOOKUP_WILDCARD);
> 217:					if (t &&
> 218:					    (so->so_cred->cr_uid !=
> 219:					     t->inp_socket->so_cred->cr_uid) &&
> 220:					    (ntohl(t->inp_laddr.s_addr) !=
> 221:					     INADDR_ANY ||
> 222:					     INP_SOCKAF(so) ==
> 223:					     INP_SOCKAF(t->inp_socket)))
> 224:						return (EADDRINUSE);
> 
> We're talking about this line:
> 
> 	test	%eax,%eax
> 	je	c03ac9c7 <in6_pcbbind+0x2e7>
> 	mov	0x64(%eax),%eax
> 	mov	%eax,0xffffffd0(%ebp)
> =>	mov	0xc4(%eax),%edx
> 	mov	0xc4(%esi),%eax
> 	mov	0x4(%eax),%eax
> 	cmp	0x4(%edx),%eax
> 	je	c03ac9c7 <in6_pcbbind+0x2e7>
> 
> We're loading inp_socket->so_cred to edx here.
> So it looks like inp_socket is NULL. Hmm, it is possible?

Yes, since jlemon's reduced TCP state work.  Olivier
(cognet at FreeBSD.org) has a fix for this, so I added him to the Cc: line.

Cheers,
Maxime