FreeBSD 7-STABLE mbuf corruption

[Ryan Stone]

On Tue, Sep 13, 2011 at 2:36 PM, Arnaud Lacombe <lacombar at gmail.com> wrote:
> It did not crash, yet. The only downside is that after 3h30 and ~4h,
> igb(4) queues' handler started spinning infinitely, breaking network
> connectivity.

I saw a similar issue on HEAD last week.  The attached patch fix the
problem for me.  The problem was that if a struct task's ta_pending
field overflows, the task will be inserted into a list when it is
already in that list, causing a cycle in the list of tasks to be run.
This causes the taskqueue thread to spin indefinitely as it looks over
the cycle again and again.

In case the list eats the patch, it was:

Index: sys/kern/subr_taskqueue.c
===================================================================
--- sys/kern/subr_taskqueue.c   (revision 225537)
+++ sys/kern/subr_taskqueue.c   (working copy)
@@ -173,7 +173,8 @@
         * Count multiple enqueues.
         */
        if (task->ta_pending) {
-               task->ta_pending++;
+               if (task->ta_pending < UINT16_MAX)
+                       task->ta_pending++;
                return (0);
        }
-------------- next part --------------
A non-text attachment was scrubbed...
Name: taskqueue.patch
Type: application/octet-stream
Size: 381 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20110913/08bac8c2/taskqueue.obj