Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168

From: Gleb Kurtsou <gleb_at_freebsd.org>
Date: Sun, 30 Jun 2013 22:26:21 -0700
On (30/06/2013 13:18), Mateusz Guzik wrote:
> On Sun, Jun 30, 2013 at 05:21:42PM +1000, Kubilay Kocak wrote:
> > I'm seeing what I believe is related panic, reliably being generated by
> > the Python regression test suite on a newly created FreeBSD 10-CURRENT
> > buildbot.
> > 
> > Symptoms first seen in an freebsd.org FTP snapshot dated "Thu May 30
> > 20:01:46 UTC 2013" and also reproducible on a freshly updated r252400
> > 
> > It is additionally reproducible after checking out pure upstream python
> > sources, using the following steps:
> > 
> > hg clone http://hg.python.org/cpython
> > cd cpython && configure && make buildbottest
> > 
> > An interesting possible correlation is that it seems to drop out
> > during/around "test_socket"
> > 
> 
> Turns out the bug is quite funny ;)

Patch fixes chrome for me.

Thanks!

> 
> Try this:
> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
> index 5d8e814..7a4db04 100644
> --- a/sys/kern/uipc_usrreq.c
> +++ b/sys/kern/uipc_usrreq.c
> _at__at_ -1764,8 +1764,8 _at__at_ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
>  			}
>  			for (i = 0; i < newfds; i++, fdp++) {
>  				fde = &fdesc->fd_ofiles[*fdp];
> -				fde->fde_file = fdep[0]->fde_file;
> -				filecaps_move(&fdep[0]->fde_caps,
> +				fde->fde_file = fdep[i]->fde_file;
> +				filecaps_move(&fdep[i]->fde_caps,
>  				    &fde->fde_caps);
>  				if ((flags & MSG_CMSG_CLOEXEC) != 0)
>  					fde->fde_flags |= UF_EXCLOSE;
> -- 
> Mateusz Guzik <mjguzik gmail.com>
> _______________________________________________
> freebsd-current_at_freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe_at_freebsd.org"
Received on Mon Jul 01 2013 - 03:26:02 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:39 UTC