-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
r271093 GENERIC amd64. Received this panic in the tcp reassembly code:
Unread portion of the kernel message buffer:
panic: m_demote: m_nextpkt not NULL
cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfe011331b410
kdb_backtrace() at kdb_backtrace+0x39/frame 0xfe011331b4c0
vpanic() at vpanic+0x189/frame 0xfe011331b540
kassert_panic() at kassert_panic+0x139/frame 0xfe011331b5b0
m_demote() at m_demote+0x79/frame 0xfe011331b5e0
sbappendstream_locked() at sbappendstream_locked+0x4b/frame
0xfe011331b600
tcp_reass() at tcp_reass+0x3bd/frame 0xfe011331b660
tcp_do_segment() at tcp_do_segment+0x1b01/frame 0xfe011331b750
tcp_input() at tcp_input+0xf67/frame 0xfe011331b890
ip_input() at ip_input+0xce/frame 0xfe011331b8e0
netisr_dispatch_src() at netisr_dispatch_src+0x86/frame 0xfe011331b950
ether_demux() at ether_demux+0x141/frame 0xfe011331b980
ether_nh_input() at ether_nh_input+0x32a/frame 0xfe011331b9b0
netisr_dispatch_src() at netisr_dispatch_src+0x86/frame 0xfe011331ba20
ether_input() at ether_input+0x4f/frame 0xfe011331ba50
if_input() at if_input+0xa/frame 0xfe011331ba60
em_rxeof() at em_rxeof+0x2bd/frame 0xfe011331bae0
em_handle_que() at em_handle_que+0x40/frame 0xfe011331bb20
taskqueue_run_locked() at taskqueue_run_locked+0xf0/frame
0xfe011331bb80
taskqueue_thread_loop() at taskqueue_thread_loop+0x9b/frame
0xfe011331bbb0
fork_exit() at fork_exit+0x84/frame 0xfe011331bbf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfe011331bbf0
- --- trap 0, rip = 0, rsp = 0xfe011331bcb0, rbp = 0 ---
Uptime: 41m32s
Dumping 357 out of 3937
MB:..5%..14%..23%..32%..41%..54%..63%..72%..81%..95%
(kgdb) bt
#0 doadump (textdump=1) at pcpu.h:219
#1 0x8090d6b7 in kern_reboot (howto=260)
at /usr/src/sys/kern/kern_shutdown.c:447
#2 0x8090dc58 in vpanic (fmt=,
ap=) at /usr/src/sys/kern/kern_shutdown.c:746
#3 0x8090da89 in kassert_panic (fmt=)
at /usr/src/sys/kern/kern_shutdown.c:634
#4 0x80983b59 in m_demote (m0=0xf80067044c00,
all=) at /usr/src/sys/kern/uipc_mbuf.c:402
#5 0x8098b0ab in sbappendstream_locked (sb=0xf8009914c090,
m=0xf80067044c00) at /usr/src/sys/kern/uipc_sockbuf.c:532
#6 0x80ac15ed in tcp_reass (tp=0xf80099115000,
th=, tlenp=,
m=) at /usr/src/sys/netinet/tcp_reass.c:264
#7 0x80abbb41 in tcp_do_segment (m=0xf80067044c00,
th=0xf80067091022, so=0xf8009914c000, tp=,
drop_hdrlen=, tlen=1448, ti_locked=1)
at /usr/src/sys/netinet/tcp_input.c:2917
#8 0x80ab9667 in tcp_input (mp=,
offp=, proto=0)
at /usr/src/sys/netinet/tcp_input.c:1383
#9 0x80a4f6fe in ip_input (m=0x0)
at /usr/src/sys/netinet/ip_input.c:729
#10 0x809e9046 in netisr_dispatch_src (proto=,
source=, m=0xf80067044c00)
at /usr/src/sys/net/netisr.c:968
#11 0x809dfe91 in ether_demux (ifp=,
m=0xf80067044c00) at /usr/src/sys/net/if_ethersubr.c:775
#12 0x809e0bea in ether_nh_input (m=)
at /usr/src/sys/net/if_ethersubr.c:582
#13 0x809e9046 in netisr_dispatch_src (proto=,
source=, m=0xf80067044c00)
at /usr/src/sys/net/netisr.c:968
#14 0x809e019f in ether_input (ifp=0xf80002c08000, m=0x0)
at /usr/src/sys/net/if_ethersubr.c:683
#15 0x809dd1da in if_input (ifp=0x0, sendmp=0x0)
at /usr/src/sys/net/if.c:3909
#16 0x804dd51d in em_rxeof (count=99)
at /usr/src/sys/dev/e1000/if_em.c:4485
#17 0x804dce00 in em_handle_que (context=0xfed23000,
pending=) at /usr/src/sys/dev/e1000/if_em.c:1522
#18 0x80956bb0 in taskqueue_run_locked (queue=0xf80002957000)
at /usr/src/sys/kern/subr_taskqueue.c:356
#19 0x809576ab in taskqueue_thread_loop (arg=)
at /usr/src/sys/kern/subr_taskqueue.c:623
#20 0x808db5f4 in fork_exit (
callout=0x80957610 ,
arg=0xfed25738, frame=0xfe011331bc00)
at /usr/src/sys/kern/kern_fork.c:977
#21 0x80d0607e in fork_trampoline ()
at /usr/src/sys/amd64/amd64/exception.S:605
#22 0x in ?? ()
(kgdb) frame 4
#4 0x80983b59 in m_demote (m0=0xf80067044c00,
all=) at /usr/src/sys/kern/uipc_mbuf.c:402
402 KASSERT(m->m_nextpkt == NULL,
(kgdb) list
397 m_tag_delete_chain(m, NULL);
398 m->m_flags &= ~M_PKTHDR;
399 bzero(&m->m_pkthdr, sizeof(struct
pkthdr));
400 }
401 if (m != m0 && m->m_nextpkt != NULL) {
402 KASSERT(m->m_nextpkt == NULL,
403 ("%s: m_nextpkt not NULL", __func__));
404 m_freem(m->m_nextpkt);
405
