panic: bfe_start: attempted use of a free mbuf! (RELENG_5)
Ulrich Spoerlein
q at uni.de
Wed Sep 8 08:37:47 PDT 2004
On Fri, 30.07.2004 at 08:34:40 +0200, Ulrich Spoerlein wrote:
> panic: bfe_start: attempted use of a free mbuf!
> KDB: enter: panic
> [thread 100019]
> Stopped at kdb_enter+0x2a: leave
> > trace
> kdb_enter()
> panic()
> bfe_start()
> bfe_intr()
> ithread_loop()
> fork_exit()
> fork_trampoline()
> --- trap 0x1, eip=0, esp=0xdb0c6d7c, ebp=0 ---
This just happend again on a recent RELENG_5. I get an _instant reboot_,
when trying to move a file from my gbde-home to NFS-mounted
/usr/ports/distfiles (this is symliked three times... don't ask :)
I then tried to copy it from / to the NFS server directly (without the
three level symlinks) and got this panic (and dump! yay!)
panic: bfe_start: attempted use of a free mbuf!
(kgdb) bt
#0 doadump () at pcpu.h:159
#1 0xc048e14b in db_fncall (dummy1=-281335756, dummy2=0, dummy3=-281335856,
dummy4=0xef3b27cc "\036änÀ") at /usr/src/sys/ddb/db_command.c:531
#2 0xc048e4ec in db_command_loop () at /usr/src/sys/ddb/db_command.c:349
#3 0xc048fc71 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:221
#4 0xc057a355 in kdb_trap (type=3, code=0, tf=0xef3b28ec) at /usr/src/sys/kern/subr_kdb.c:418
#5 0xc06bb84f in trap (frame=
{tf_fs = -281346024, tf_es = -1068040176, tf_ds = -1066336240, tf_edi = 256, tf_esi = -1066397045, tf_ebp = -281335508, tf_isp = -281335528, tf_ebx = -281335468, tf_edx = 0, tf_ecx = -1066286908, tf_eax = -1066295100, tf_trapno = 3, tf_err = 0, tf_eip = -1067999226, tf_cs = 8, tf_eflags = 646, tf_esp = -281335480, tf_ss = -1068083641}) at /usr/src/sys/i386/i386/trap.c:576
#6 0xc06b04ca in calltrap () at /usr/src/sys/i386/i386/exception.s:140
#7 0xef3b0018 in ?? ()
#8 0xc0570010 in kern_timeout_callwheel_alloc (v=0x0) at /usr/src/sys/kern/kern_timeout.c:125
#9 0xc0565647 in panic (fmt=0xc070128b "%s: attempted use of a free mbuf!")
at /usr/src/sys/kern/kern_shutdown.c:536
#10 0xc04b4681 in bfe_start (ifp=0xc2419000) at /usr/src/sys/dev/bfe/if_bfe.c:1400
#11 0xc05c0309 in ether_output_frame (ifp=0xc2419000, m=0xc3393500)
at /usr/src/sys/net/if_ethersubr.c:377
#12 0xc05c0646 in ether_output (ifp=0xc2419000, m=0xc3393500, dst=0xef3b2a3c, rt0=0x0)
at /usr/src/sys/net/if_ethersubr.c:330
#13 0xc05e3ef5 in ip_output (m=0xc3393500, opt=0xc3393500, ro=0xef3b2a38, flags=0, imo=0x0,
inp=0xc28c52d0) at /usr/src/sys/netinet/ip_output.c:824
#14 0xc05f203b in udp_send (so=0x0, flags=0, m=0x0, addr=0x0, control=0x0, td=0xc32be840)
at /usr/src/sys/netinet/udp_usrreq.c:906
#15 0xc0595f8f in sosend (so=0xc28c3288, addr=0x0, uio=0x0, top=0xc3368200, control=0x0, flags=0,
td=0xc32be840) at /usr/src/sys/kern/uipc_socket.c:799
#16 0xc062b391 in nfs_send (so=0xc28c3288, nam=0xc252f7a0, top=0xc3368200, rep=0xc32a5a00)
at pcpu.h:156
---Type <return> to continue, or q <return> to quit---
#17 0xc062bd7d in nfs_request (vp=0xc32e6420, mrest=0xc32a5a00, procnum=7, td=0x0,
cred=0xc2a5c800, mrp=0xef3b2c54, mdp=0xef3b2c58, dposp=0xef3b2c5c)
at /usr/src/sys/nfsclient/nfs_socket.c:1002
#18 0xc063134f in nfs_writerpc (vp=0xc32e6420, uiop=0xef3b2ccc, cred=0xc2a5c800,
iomode=0xef3b2cbc, must_commit=0xef3b2cc0) at /usr/src/sys/nfsclient/nfs_vnops.c:1129
#19 0xc0628dd0 in nfs_doio (bp=0xd64b563c, cr=0xc2a5c800, td=0x0)
at /usr/src/sys/nfsclient/nfs_bio.c:1452
#20 0xc062e533 in nfssvc_iod (instance=0xc07c6538) at /usr/src/sys/nfsclient/nfs_nfsiod.c:262
#21 0xc0554326 in fork_exit (callout=0xc062e3e4 <nfssvc_iod>, arg=0xc07c6538, frame=0xef3b2d48)
at /usr/src/sys/kern/kern_fork.c:820
#22 0xc06b052c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:209
(kgdb) f 10
#10 0xc04b4681 in bfe_start (ifp=0xc2419000) at /usr/src/sys/dev/bfe/if_bfe.c:1400
1400 BPF_MTAP(ifp, m_head);
(kgdb) l
1395
1396 /*
1397 * If there's a BPF listener, bounce a copy of this frame
1398 * to him.
1399 */
1400 BPF_MTAP(ifp, m_head);
1401 }
1402
1403 sc->bfe_tx_prod = idx;
1404 /* Transmit - twice due to apparent hardware bug */
(kgdb) p *ifp
$1 = {if_softc = 0xc2419000, if_link = {tqe_next = 0xc243482c, tqe_prev = 0xc07b6b24},
if_xname = "bfe0", '\0' <repeats 11 times>, if_dname = 0xc22cd56c "bfe", if_dunit = 0,
if_addrhead = {tqh_first = 0xc2418200, tqh_last = 0xc28e1260}, if_klist = {kl_lock = 0xc078bea0,
kl_list = {slh_first = 0x0}}, if_pcount = 0, if_carp = 0x0, if_bpf = 0xc2431200, if_index = 1,
if_timer = 5, if_nvlans = 0, if_flags = 34883, if_capabilities = 8, if_capenable = 8,
if_linkmib = 0x0, if_linkmiblen = 0, if_data = {ifi_type = 6 '\006', ifi_physical = 0 '\0',
ifi_addrlen = 6 '\006', ifi_hdrlen = 18 '\022', ifi_link_state = 2 '\002',
ifi_recvquota = 0 '\0', ifi_xmitquota = 0 '\0', ifi_mtu = 1500, ifi_metric = 0,
ifi_baudrate = 100000000, ifi_ipackets = 640, ifi_ierrors = 0, ifi_opackets = 7145,
ifi_oerrors = 0, ifi_collisions = 0, ifi_ibytes = 128126, ifi_obytes = 10260512,
ifi_imcasts = 0, ifi_omcasts = 7, ifi_iqdrops = 0, ifi_noproto = 0, ifi_hwassist = 0,
ifi_unused = 0, ifi_lastchange = {tv_sec = 1094655632, tv_usec = 806107}}, if_multiaddrs = {
tqh_first = 0xc2530860, tqh_last = 0xc28bd500}, if_amcount = 0,
if_output = 0xc05c0314 <ether_output>, if_input = 0xc05c0903 <ether_input>,
if_start = 0xc04b4278 <bfe_start>, if_ioctl = 0xc04b5076 <bfe_ioctl>,
if_watchdog = 0xc04b501a <bfe_watchdog>, if_init = 0xc04b4b90 <bfe_init>,
if_resolvemulti = 0xc05c0d98 <ether_resolvemulti>, if_snd = {ifq_head = 0x0, ifq_tail = 0x0,
ifq_len = 0, ifq_maxlen = 256, ifq_drops = 0, ifq_mtx = {mtx_object = {lo_class = 0xc075dc44,
lo_name = 0xc241900c "bfe0", lo_type = 0xc0722ed9 "if send queue", lo_flags = 196608,
lo_list = {tqe_next = 0xc241827c, tqe_prev = 0xc2419204}, lo_witness = 0xc0792498},
mtx_lock = 4, mtx_recurse = 0}, ifq_drv_head = 0x0, ifq_drv_tail = 0x0, ifq_drv_len = 0,
ifq_drv_maxlen = 256, altq_type = 0, altq_flags = 1, altq_disc = 0x0, altq_ifp = 0xc2419000,
altq_enqueue = 0, altq_dequeue = 0, altq_request = 0, altq_clfier = 0x0, altq_classify = 0,
altq_tbr = 0x0, altq_cdnr = 0x0}, if_broadcastaddr = 0xc06e14a0 "ÿÿÿÿÿÿether_ipfw_chk",
lltables = 0x0, if_label = 0x0, if_prefixhead = {tqh_first = 0x0, tqh_last = 0xc2419154},
if_afdata = {0x0 <repeats 28 times>, 0xc2534730, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
if_afdata_initialized = 1, if_afdata_mtx = {mtx_object = {lo_class = 0xc075dc44,
lo_name = 0xc0722e9d "if_afdata", lo_type = 0xc0722e9d "if_afdata", lo_flags = 196608,
lo_list = {tqe_next = 0xc24190e8, tqe_prev = 0xc241b35c}, lo_witness = 0xc07924c0},
---Type <return> to continue, or q <return> to quit---
mtx_lock = 4, mtx_recurse = 0}, if_starttask = {ta_link = {stqe_next = 0x0}, ta_pending = 0,
ta_priority = 0, ta_func = 0xc05bf59c <if_start_deferred>, ta_context = 0xc2419000}}
(kgdb) p *m_head
$2 = {m_hdr = {mh_next = 0xc3393600, mh_nextpkt = 0x0, mh_data = 0xc3393532 "", mh_len = 34,
mh_flags = 43010, mh_type = 2}, M_dat = {MH = {MH_pkthdr = {rcvif = 0x0, len = 266,
header = 0x0, csum_flags = 0, csum_data = 0, tags = {slh_first = 0x0}}, MH_dat = {
MH_ext = {ext_buf = 0x1000e800---Can't read userspace from dump, or kernel process---
(kgdb) up
#11 0xc05c0309 in ether_output_frame (ifp=0xc2419000, m=0xc3393500)
at /usr/src/sys/net/if_ethersubr.c:377
377 IFQ_HANDOFF(ifp, m, error);
(kgdb) l
372
373 /*
374 * Queue message on interface, update output statistics if
375 * successful, and start output if interface not yet active.
376 */
377 IFQ_HANDOFF(ifp, m, error);
378 return (error);
379 }
380
381 #if defined(INET) || defined(INET6)
The system is running with giant-locked network stack, because of IPSec
FreeBSD 5.3-BETA3 #16: Tue Sep 7 16:23:16 CEST 2004
root at igor.q.local:/usr/obj/usr/src/sys/IGOR
WARNING: WITNESS option enabled, expect reduced performance.
WARNING: debug.mpsafenet forced to 0 as ipsec requires Giant
WARNING: MPSAFE network stack disabled, expect reduced performance.
I will now try with a GENERIC-Kernel and see if that helps.
Ulrich Spoerlein
--
PGP Key ID: F0DB9F44 Get it while it's hot!
PGP Fingerprint: F1CE D062 0CA9 ADE3 349B 2FE8 980A C6B5 F0DB 9F44
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety." -- Benjamin Franklin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20040908/91c284f7/attachment.bin
More information about the freebsd-current
mailing list