kern/101763: [panic] sodealloc(): so_count 1

Gleb Kozyrev wrote to "Robert Watson" <rwatson_at_FreeBSD.org> on Thu, 10 Aug 2006 19:35:12 +0300:

>>> i386 7.0-CURRENT #0: Sun Aug 6 repeatedly panics when doing some default
>>> periodic jobs at 3 AM.

RW>> Could you file a PR for this, and forward me the PR receipt?  I'd be
RW>> happy to investigate this problem.  I've seen one or two other reports
RW>> of so_count 1, but not in a way that's reproduceable.  The output of
RW>> the following DDB commands would be most helpful:

RW>>    show pcpu
RW>>    show allpcpu
RW>>    alltrace
RW>>    show  alllocks

GK> Here you are: kern/101763

I'm sorry for misleading you.
You see, for some reasons I forgot that there's a little jail on
that machine. ;)
It is ipfw in jail that triggers the panic invoked from
/etc/periodic/security/500.ipfwdenied

Today the coredump was successfully saved. So if it still matters..

=========Beginning of the citation==============
(kgdb) where
#0  doadump () at pcpu.h:166
#1  0xc06a3ee0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc06a41f5 in panic (fmt=0xc092e717 "sodealloc(): so_count %d") at /usr/src/sys/kern/kern_shutdown.c:565
#3  0xc06e45cc in sodealloc (so=0xc1a163e4) at /usr/src/sys/kern/uipc_socket.c:289
#4  0xc06e4811 in socreate (dom=0, aso=0x0, type=3, proto=255, cred=0xc19f5180, td=0xc18ad510) at
/usr/src/sys/kern/uipc_socket.c:370
#5  0xc06e8985 in socket (td=0xc18ad510, uap=0xc853bd04) at /usr/src/sys/kern/uipc_syscalls.c:175
#6  0xc08a0d7e in syscall (frame=
      {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = -1077943668, tf_esi = 136331264, tf_ebp = -1077943800, tf_isp = -934036124,
tf_ebx = 54, tf_edx = 0, tf_ecx = 0, tf_eax = 97, tf_trapno = 12, tf_err = 2, tf_eip = 672368711, tf_cs = 51, tf_eflags = 582,
tf_esp = -1077943844, tf_ss = 59})
    at /usr/src/sys/i386/i386/trap.c:1006
#7  0xc088bb3f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:191
#8  0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) frame 3
#3  0xc06e45cc in sodealloc (so=0xc1a163e4) at /usr/src/sys/kern/uipc_socket.c:289
289             KASSERT(so->so_count == 0, ("sodealloc(): so_count %d", so->so_count));
(kgdb) print *so
$1 = {so_count = 1, so_type = 3, so_options = 0, so_linger = 0, so_state = 0, so_qstate = 0, so_pcb = 0x0, so_proto = 0xc09dbd5c,
so_head = 0x0,
  so_incomp = {tqh_first = 0x0, tqh_last = 0xc1a16400}, so_comp = {tqh_first = 0x0, tqh_last = 0xc1a16408}, so_list = {tqe_next =
0x0, tqe_prev = 0x0},
  so_qlen = 0, so_incqlen = 0, so_qlimit = 0, so_timeo = 0, so_error = 0, so_sigio = 0x0, so_oobmark = 0, so_aiojobq = {tqh_first =
0x0,
    tqh_last = 0xc1a1642c}, so_rcv = {sb_sel = {si_thrlist = {tqe_next = 0x0, tqe_prev = 0x0}, si_thread = 0x0, si_note = {kl_list =
{slh_first = 0x0},
        kl_lock = 0xc068a3f4 <knlist_mtx_lock>, kl_unlock = 0xc068a410 <knlist_mtx_unlock>, kl_locked = 0xc068a42c
<knlist_mtx_locked>,
        kl_lockarg = 0xc1a16458}, si_flags = 0}, sb_mtx = {mtx_object = {lo_name = 0xc092b0f2 "so_rcv", lo_type = 0xc092b0f2
"so_rcv", lo_flags = 16973824,
        lo_witness_data = {lod_list = {stqe_next = 0xc0a25fe8}, lod_witness = 0xc0a25fe8}}, mtx_lock = 4, mtx_recurse = 0}, sb_state
= 0, sb_mb = 0x0,
    sb_mbtail = 0x0, sb_lastrecord = 0x0, sb_cc = 0, sb_hiwat = 0, sb_mbcnt = 0, sb_mbmax = 0, sb_ctl = 0, sb_lowat = 0, sb_timeo =
0, sb_flags = 0},
  so_snd = {sb_sel = {si_thrlist = {tqe_next = 0x0, tqe_prev = 0x0}, si_thread = 0x0, si_note = {kl_list = {slh_first = 0x0},
        kl_lock = 0xc068a3f4 <knlist_mtx_lock>, kl_unlock = 0xc068a410 <knlist_mtx_unlock>, kl_locked = 0xc068a42c
<knlist_mtx_locked>,
        kl_lockarg = 0xc1a164c4}, si_flags = 0}, sb_mtx = {mtx_object = {lo_name = 0xc092b0eb "so_snd", lo_type = 0xc092b0eb
"so_snd", lo_flags = 16973824,
        lo_witness_data = {lod_list = {stqe_next = 0xc0a26010}, lod_witness = 0xc0a26010}}, mtx_lock = 4, mtx_recurse = 0}, sb_state
= 0, sb_mb = 0x0,
    sb_mbtail = 0x0, sb_lastrecord = 0x0, sb_cc = 0, sb_hiwat = 0, sb_mbcnt = 0, sb_mbmax = 0, sb_ctl = 0, sb_lowat = 0, sb_timeo =
0, sb_flags = 0},
  so_upcall = 0, so_upcallarg = 0x0, so_cred = 0xc19f5180, so_label = 0x0, so_peerlabel = 0x0, so_gencnt = 830, so_emuldata = 0x0,
so_accf = 0x0}
(
=========The end of the citation================

-- 
With best regards, Gleb Kozyrev.