Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168

On Sun, Jun 30, 2013 at 01:18:36PM +0200, Mateusz Guzik wrote:
> On Sun, Jun 30, 2013 at 05:21:42PM +1000, Kubilay Kocak wrote:
> > I'm seeing what I believe is related panic, reliably being generated by
> > the Python regression test suite on a newly created FreeBSD 10-CURRENT
> > buildbot.
> > 
> > Symptoms first seen in an freebsd.org FTP snapshot dated "Thu May 30
> > 20:01:46 UTC 2013" and also reproducible on a freshly updated r252400
> > 
> > It is additionally reproducible after checking out pure upstream python
> > sources, using the following steps:
> > 
> > hg clone http://hg.python.org/cpython
> > cd cpython && configure && make buildbottest
> > 
> > An interesting possible correlation is that it seems to drop out
> > during/around "test_socket"
> > 
> 
> Turns out the bug is quite funny ;)
> 
> Try this:
> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
> index 5d8e814..7a4db04 100644
> --- a/sys/kern/uipc_usrreq.c
> +++ b/sys/kern/uipc_usrreq.c
> _at__at_ -1764,8 +1764,8 _at__at_ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
>  			}
>  			for (i = 0; i < newfds; i++, fdp++) {
>  				fde = &fdesc->fd_ofiles[*fdp];
> -				fde->fde_file = fdep[0]->fde_file;
> -				filecaps_move(&fdep[0]->fde_caps,
> +				fde->fde_file = fdep[i]->fde_file;
> +				filecaps_move(&fdep[i]->fde_caps,
>  				    &fde->fde_caps);
>  				if ((flags & MSG_CMSG_CLOEXEC) != 0)
>  					fde->fde_flags |= UF_EXCLOSE;

Thanks for tracking it down before I had time to get to it!
The change looks good.

-- 
Pawel Jakub Dawidek                       http://www.wheelsystems.com
FreeBSD committer                         http://www.FreeBSD.org
Am I Evil? Yes, I Am!                     http://mobter.com