Re: next panic: blockable sleep lock

[Michael Harnois]

On Sun, 27 May 2001 21:30:59 +0200, [EMAIL PROTECTED] said:

> The ui_ref member in struct uidinfo is only 16 bits. This means
> that a fatal wraparound due to a missing call to uifree() can
> happen rather quickly.

Great! With your patch and the earlier one from Thomas I can build
world again. In fact I built world and mozilla+ipv6 simultaneously, a
pretty good workout.

-- 
Michael D. Harnois[EMAIL PROTECTED]
Redeemer Lutheran Church  Washburn, Iowa 
 Sed quis custodiet ipsos custodes? -- Juvenal

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message

Re: next panic: blockable sleep lock

[Tor . Egge]

> freeing uidinfo: uid = 0, sbsize = 3197224
> freeing uidinfo: uid = 0, proccnt = 86
[...]
> trap(c8d20018,c01d0010,c8cb0010,4,c0b3351c) at trap+0x5d0
> calltrap() at calltrap+0x5
> --- trap 0xc, eip = 0xc01ba652, esp = 0xc8d27ed4, ebp = 0xc8d27ee0 ---
> _mtx_lock_sleep(c0b3351c,0,c035076c,364) at mtx_lock_sleep+0x342
> chgproccnt(c0b33500,,0,c1280900,c03b0d40,c8d26bbc,c1280900) at 
>chgproccnt+0x67

The ui_ref member in struct uidinfo is only 16 bits.  This means that
a fatal wraparound due to a missing call to uifree() can happen rather
quickly.

Index: sys/kern/kern_prot.c
===
RCS file: /home/ncvs/src/sys/kern/kern_prot.c,v
retrieving revision 1.91
diff -u -r1.91 kern_prot.c
--- sys/kern/kern_prot.c2001/05/25 16:59:06 1.91
+++ sys/kern/kern_prot.c2001/05/27 07:10:10
@@ -1303,6 +1303,8 @@
 */
if (cr->cr_uidinfo != NULL)
uifree(cr->cr_uidinfo);
+   if (cr->cr_ruidinfo != NULL)
+   uifree(cr->cr_ruidinfo);
/*
 * Free a prison, if any.
 */


- Tor Egge

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message

next panic: blockable sleep lock

[Michael Harnois]

freeing uidinfo: uid = 0, sbsize = 3197224
freeing uidinfo: uid = 0, proccnt = 86
kernel trap 12 with interrupts disabled
panic: blockable sleep lock (sleep mutex) Giant @ ../../vm/vm_fault.c:213
Debugger("panic")
Stopped at Debugger+0x45: pushl %ebx
db> t
Debugger(c0350d9b) at Debugger+0x45
panic(c0353900, c034fd00,c0372434,c0368074,d5) at panic+0x70
witness_lock(co4230c0,8,c0368074,d5) at witness_lock+0x1b4
vm_fault(c040e2ec,deadc000,1,0,0) at vm_fault+0xb2
trap_pfault(c8d27e94,0,deadc2af,c8cbd200,c0b3351c) at trap_pfault+0x2d1
trap(c8d20018,c01d0010,c8cb0010,4,c0b3351c) at trap+0x5d0
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc01ba652, esp = 0xc8d27ed4, ebp = 0xc8d27ee0 ---
_mtx_lock_sleep(c0b3351c,0,c035076c,364) at mtx_lock_sleep+0x342
chgproccnt(c0b33500,,0,c1280900,c03b0d40,c8d26bbc,c1280900) at chgproccnt+0x67
wait1(c8cbd200,c8d27f80,0,c8d27fa0,c0323469) at wait1+0x765
wait4(c8cbd200,c8d27f80,8085c01,bfbfed04,c597) at wait4+0x12
syscall(2f,2f,2f,c597,bfbfed04) at syscall+0x695
syscall_with_err_pushed() at syscall_with_error_pushed+0x1b
db> show reg
cs  0x8
ds  0x8d20010
es  0x10
fs  0x18
ss  0x10
eax 0x12
edx 0xc0370e6f  db_lengths+0x1d7
ebx 0x202
esp 0xc8d27da4
ebp 0xc8d27db0
esi 0x100
edi 0xc8cbd200
eip 0xc0313d09
efl 0x46
Debugger+0x45:  pushl %ebx
db> show locks
exclusive (sleep mutex) Giant (0xc04230c0) locked @ ../../i386/i386/trap.c:1153
exclusive (spin mutex) sched lock (0xc0422f20) locked @ ../../kern/kern_mutex.c: 312

-- 
Michael D. Harnois[EMAIL PROTECTED]
Redeemer Lutheran Church  Washburn, Iowa 
 Earth has its boundaries, but human stupidity is limitless.
   -- Gustave Flaubert

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message