r248583 Kernel panic: negative refcount 0xfffffe0031b59168

[Mateusz Guzik]

On Mon, Jul 15, 2013 at 03:16:37PM +0600, Eugene M. Zheganin wrote:
> Hi.
> 
> On 02.07.2013 05:10, Pawel Jakub Dawidek wrote:
> > On Sun, Jun 30, 2013 at 01:18:36PM +0200, Mateusz Guzik wrote:
> >>
> >> Turns out the bug is quite funny ;)
> >>
> >> Try this:
> >> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
> >> index 5d8e814..7a4db04 100644
> >> --- a/sys/kern/uipc_usrreq.c
> >> +++ b/sys/kern/uipc_usrreq.c
> >> @@ -1764,8 +1764,8 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
> >>  			}
> >>  			for (i = 0; i < newfds; i++, fdp++) {
> >>  				fde = &fdesc->fd_ofiles[*fdp];
> >> -				fde->fde_file = fdep[0]->fde_file;
> >> -				filecaps_move(&fdep[0]->fde_caps,
> >> +				fde->fde_file = fdep[i]->fde_file;
> >> +				filecaps_move(&fdep[i]->fde_caps,
> >>  				    &fde->fde_caps);
> >>  				if ((flags & MSG_CMSG_CLOEXEC) != 0)
> >>  					fde->fde_flags |= UF_EXCLOSE;
> > Thanks for tracking it down before I had time to get to it!
> > The change looks good.
> >
> Guys, if this is working, why it's not commited to HEAD ? I'm still
> hitting this bug on r251990 and later ones.
> 

The patch was committed in r252502. Is that kernel crashing for you? If
so, can you show backtrace?

-- 
Mateusz Guzik <mjguzik gmail.com>