Re: PF LOR and panic

On Monday 23 August 2004 14:04, Christian Brueffer wrote:
> Hi,
>
> got this LOR and panic with a 5.3-BETA1 kernel from yesterday on a SMP
> machine.  Can't say how much time there was between them.  A dump is
> available.

Good. Keep it in a warm and save place, I'll find you on IRC (I hope).

> lock order reversal
>  1st 0xc0739f20 pf task mtx (pf task mtx) _at_
> /usr/home/build/src/sys/contrib/pf/net/pf.c:5828
>  2nd 0xc103a4c4 user map (user map) _at_
> /usr/home/build/src/sys/vm/vm_map.c:2997
> KDB: stack backtrace:
> kdb_backtrace(0,ffffffff,c074a9d8,c074bb08,c071a56c) at
> kdb_backtrace+0x29
> witness_checkorder(c103a4c4,9,c06f826b,bb5) at witness_checkorder+0x540
> _sx_xlock(c103a4c4,c06f826b,bb5) at _sx_xlock+0x50
> _vm_map_lock_read(c103a480,c06f826b,bb5,2000000,c) at
> _vm_map_lock_read+0x3b
> vm_map_lookup(d41f7a8c,d21f7000,2,d41f7a90,d41f7a80) at
> vm_map_lookup+0x26
> vm_fault(c103a000,d21f7000,2,0,c1969160) at vm_fault+0x6a
> trap_pfault(d41f7b54,0,d21f7bac) at trap_pfault+0x11c
> trap(18,10,10,c3e24850,c1aa3c00) at trap+0x321
> calltrap() at calltrap+0x5
> --- trap 0xc, eip = 0xc0459c46, esp = 0xd41f7b94, ebp = 0xd41f7c58 ---

The LOR is a result of the trap so we can forget about it for the moment.

> pf_test(1,c1a38800,d41f7c8c,c1f42820,c0771fe0) at pf_test+0x3c6
> pf_check_in(0,d41f7c8c,c1a38800,1,c3e24800) at pf_check_in+0x32
> pfil_run_hooks(c0771fe0,d41f7cd4,c1a38800,1) at pfil_run_hooks+0xac
> ip_input(c3e24800) at ip_input+0x25f
> netisr_processqueue(c076fcb8) at netisr_processqueue+0x6e
> swi_net(0) at swi_net+0x89
> ithread_loop(c1962b80,d41f7d48,c1962b80,c0500660,0) at
> ithread_loop+0x126
> fork_exit(c0500660,c1962b80,d41f7d48) at fork_exit+0xa8
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0x1, eip = 0, esp = 0xd41f7d7c, ebp = 0 ---
>
>
> Fatal trap 12: page fault while in kernel mode
> cpuid = 1; apic id = 01
> fault virtual address   = 0xd21f7bac
> fault code              = supervisor write, page not present
> instruction pointer     = 0x8:0xc0459c46
> stack pointer           = 0x10:0xd41f7b94
> frame pointer           = 0x10:0xd41f7c58
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 38 (swi1: net)
> [thread 100012]
> Stopped at      pf_test+0x3c6:  movl    %edx,-0xac(%ebp)
> db> tr
> pf_test(1,c1a38800,d41f7c8c,c1f42820,c0771fe0) at pf_test+0x3c6

hmmm ... pf_test+0x3c6 is something *very* different on my objects right now. 
Can you sent me your pf.o (possibly with debugging symbols).

> pf_check_in(0,d41f7c8c,c1a38800,1,c3e24800) at pf_check_in+0x32
> pfil_run_hooks(c0771fe0,d41f7cd4,c1a38800,1) at pfil_run_hooks+0xac
> ip_input(c3e24800) at ip_input+0x25f
> netisr_processqueue(c076fcb8) at netisr_processqueue+0x6e
> swi_net(0) at swi_net+0x89
> ithread_loop(c1962b80,d41f7d48,c1962b80,c0500660,0) at
> ithread_loop+0x126
> fork_exit(c0500660,c1962b80,d41f7d48) at fork_exit+0xa8
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0x1, eip = 0, esp = 0xd41f7d7c, ebp = 0 ---

Thanks in advance.

-- 
/"\  Best regards,   | mlaier_at_freebsd.org
\ /  Max Laier    | ICQ #67774661
 X   http://pf4freebsd.love2party.net/ | mlaier_at_EFnet
/ \  ASCII Ribbon Campaign  | Against HTML Mail and News