From fortin@zap.zap.qc.ca  Sat Feb 11 18:47:00 1995
Received: from zap.zap.qc.ca (ppp.zap.qc.ca [198.168.127.8]) by freefall.cdrom.com (8.6.9/8.6.6) with ESMTP id SAA03458 for <FreeBSD-gnats-submit@freebsd.org>; Sat, 11 Feb 1995 18:46:57 -0800
Received: (from fortin@localhost) by zap.zap.qc.ca (8.6.9/8.6.6) id RAA05455; Sat, 11 Feb 1995 17:49:51 -0500
Message-Id: <199502112249.RAA05455@zap.zap.qc.ca>
Date: Sat, 11 Feb 1995 17:49:51 -0500
From: fortin@zap.qc.ca
Reply-To: fortin@zap.qc.ca
To: FreeBSD-gnats-submit@freebsd.org
Subject: Multiple crashes per day: found a track
X-Send-Pr-Version: 3.2

>Number:         212
>Category:       kern
>Synopsis:       Major instability traced to ttyclose() [kern/tty_subr.c]
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs (FreeBSD bugs mailing list)
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Feb 11 18:50:01 1995
>Closed-Date:    Sun Mar 19 22:29:04 PST 1995
>Last-Modified:
>Originator:     Denis Fortin
>Release:        FreeBSD 2.1.0-Development i386
>Organization:
DMR Group Inc
>Environment:

	FreeBSD 2.1.0-Development #0: Fri Jan 20 23:31:13 EST 1995
	    lamarcjp@poterne.mtl.dmr.ca:/usr/src/sys/compile/DMR
	CPU: i386DX (386-class CPU)
	real memory  = 7995392 (1952 pages)
	avail memory = 6828032 (1667 pages)
	Probing for devices on the ISA bus:
	sc0 at 0x60-0x6f irq 1 on motherboard
	sc0: VGA color <12 virtual consoles, flags=0>
	ed0 at 0x280-0x29f irq 5 on isa
	ed0: address 00:00:1b:4a:89:27, type NE2000 (16 bit) 
	sio0 at 0x3f8-0x3ff irq 4 on isa
	sio0: type 16450
	sio1 at 0x2f8-0x2ff irq 3 on isa
	sio1: type 16450
	sio2 at 0x3e8-0x3ef irq 10 on isa
	sio2: type 16550A
	sio3 at 0x2e8-0x2ef irq 11 on isa
	sio3: type 16550A
	sio4 at 0x338-0x33f irq 9 on isa
	sio4: type 16450
	lpt0 at 0x378-0x37f irq 7 on isa
	lpt0: Interrupt-driven port
	lp0: TCP/IP capable interface
	fdc0 at 0x3f0-0x3f7 irq 6 drq 2 on isa
	fdc0: (NEC 765) [0: fd0: 1.44MB 3.5in]
	wdc0 at 0x1f0-0x1f7 irq 14 on isa
	wdc0: unit 0 (wd0): <Maxtor 7420 AV>
	wd0: 400MB (820352 total sec), 986 cyl, 16 head, 52 sec, bytes/sec 512
	npx0 on motherboard
	npx0: 387 emulator
	
>Description:

	As has been reported previously by myself and Jean-Pierre Lamarche,
	our Internet gateway, which provides 4 incoming SLIP lines, has 
	been crashing between 1-5 times *daily* since we've gone to 2.0R,
	mostly (it seems) when people log off.

	At some point, Jordan suggested we try the 950112 snapshot to see
	if the problem had been solved, but that didn't help.

	Recently, we've built a kernel with "option DODUMP" and a 
	"tail -100 /var/crash/vmcore.0 | strings | grep panic" shows:
***
***		panic: freeing active clist cblocks
***
	which can be traced to /sys/kern/tty_subr.c:
	-------------------------------------------
	void
	clist_free_cblocks(clistp)
		struct clist *clistp;
	{
		if (clistp->c_cbcount != 0)
***>			panic("freeing active clist cblocks");
		cblock_free_cblocks(clistp->c_cbreserved);
		clistp->c_cbmax = 0;
		clistp->c_cbreserved = 0;
	}
	-------------------------------------------
	which is in turn called from ttyclose in /sys/kern/tty.c
	-------------------------------------------
	int
	ttyclose(tp)
		register struct tty *tp;
	{
		extern struct tty *constty;	/* Temporary virtual console. */
		int s;
	
		s = spltty();
		if (constty == tp)
			constty = NULL;
	
		ttyflush(tp, FREAD | FWRITE);
***		clist_free_cblocks(&tp->t_canq);
***		clist_free_cblocks(&tp->t_outq);
***		clist_free_cblocks(&tp->t_rawq);
		[...]
	-------------------------------------------
	So this seems to indicate that one of the three clists isn't
	empty, even after the call to ttyflush().

	I'd appreciate some feedback from the tty gurus out there.
		
>How-To-Repeat:

	Run our Internet gateway for a few days :-)

	Actually, it seems to happen when people close their SLIP
	connections right in the middle of doing something.  

>Fix:
	
	The only workaround we can think of is going back to 1.1.5.1
	and we'd like to avoid that :-)
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: ache 
State-Changed-When: Sun Mar 19 22:29:04 PST 1995 
State-Changed-Why:  
Fixed. 
>Unformatted:



