Re: r248583 Kernel panic: negative refcount 0xfffffe0031b59168

From: Mateusz Guzik <mjguzik_at_gmail.com>
Date: Sun, 30 Jun 2013 13:18:36 +0200
On Sun, Jun 30, 2013 at 05:21:42PM +1000, Kubilay Kocak wrote:
> I'm seeing what I believe is related panic, reliably being generated by
> the Python regression test suite on a newly created FreeBSD 10-CURRENT
> buildbot.
> 
> Symptoms first seen in an freebsd.org FTP snapshot dated "Thu May 30
> 20:01:46 UTC 2013" and also reproducible on a freshly updated r252400
> 
> It is additionally reproducible after checking out pure upstream python
> sources, using the following steps:
> 
> hg clone http://hg.python.org/cpython
> cd cpython && configure && make buildbottest
> 
> An interesting possible correlation is that it seems to drop out
> during/around "test_socket"
> 

Turns out the bug is quite funny ;)

Try this:
diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
index 5d8e814..7a4db04 100644
--- a/sys/kern/uipc_usrreq.c
+++ b/sys/kern/uipc_usrreq.c
_at__at_ -1764,8 +1764,8 _at__at_ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
 			}
 			for (i = 0; i < newfds; i++, fdp++) {
 				fde = &fdesc->fd_ofiles[*fdp];
-				fde->fde_file = fdep[0]->fde_file;
-				filecaps_move(&fdep[0]->fde_caps,
+				fde->fde_file = fdep[i]->fde_file;
+				filecaps_move(&fdep[i]->fde_caps,
 				    &fde->fde_caps);
 				if ((flags & MSG_CMSG_CLOEXEC) != 0)
 					fde->fde_flags |= UF_EXCLOSE;
-- 
Mateusz Guzik <mjguzik gmail.com>
Received on Sun Jun 30 2013 - 09:18:43 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:39 UTC