From nobody@FreeBSD.org  Thu Sep 26 10:35:48 2002
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1640837B401
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 26 Sep 2002 10:35:48 -0700 (PDT)
Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AB35343E65
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 26 Sep 2002 10:35:47 -0700 (PDT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.12.6/8.12.6) with ESMTP id g8QHZl7R016683
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 26 Sep 2002 10:35:47 -0700 (PDT)
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.12.6/8.12.6/Submit) id g8QHZlGu016682;
	Thu, 26 Sep 2002 10:35:47 -0700 (PDT)
Message-Id: <200209261735.g8QHZlGu016682@www.freebsd.org>
Date: Thu, 26 Sep 2002 10:35:47 -0700 (PDT)
From: al <bsdal@otterhole.ods.org>
To: freebsd-gnats-submit@FreeBSD.org
Subject: repeatable kernel panic in if_xl.c:xl_newbuf:MCLGET
X-Send-Pr-Version: www-1.0

>Number:         43396
>Category:       kern
>Synopsis:       repeatable kernel panic in if_xl.c:xl_newbuf:MCLGET
>Confidential:   no
>Severity:       critical
>Priority:       low
>Responsible:    silby
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Sep 26 10:40:08 PDT 2002
>Closed-Date:    Mon Aug 18 20:23:35 PDT 2003
>Last-Modified:  Mon Aug 18 20:23:35 PDT 2003
>Originator:     al
>Release:        4.7-RC Sep 24
>Organization:
>Environment:
FreeBSD XXXX 4.7-RC FreeBSD 4.7-RC #12: Tue Sep 24 13:30:20 EDT 2002 
 YYYY@XXXX:/play/obj/usr/src/sys/XXXX  i386 (not Generic)
xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0xb800-0xb87f mem
  0xf2800000-0xf280007f irq 9 at device 11.0 on pci2
>Description:
While running ping sweeps of a corporate network the host panics.
Panic does not occur while doing anything else, panic did not occur
2 or 3 months ago running same program under older version of -STABLE.

Problem has been around for at least a few weeks as I pointed to this
problem a while back runinng an earlier -STABLE
 http://docs.freebsd.org/cgi/getmsg.cgi?\
  fetch=109403+0+archive/2002/freebsd-stable/20020915.freebsd-stable

Might be related to http://www.FreeBSD.org/cgi/query-pr.cgi?pr=kern/30952

kgdb says panic occurs at
#6  0xc02a129c in xl_newbuf (sc=0xc1a5c000, c=0xc1a5c194) at /usr/src/sys/pci/if_xl.c:1727
1727            MCLGET(m_new, M_DONTWAIT);
kgdb) print m_new
$3 = (struct mbuf *) 0xc0e6f000
(kgdb) print m_new->m_hdr.mh_flags
$4 = 2
(kgdb) print m_new->m_hdr.mh_type
$5 = 1
(kgdb) print m_new->m_hdr.mh_len
$6 = 98
(kgdb) print m_new->m_hdr.mh_data
$7 = 0xc0e6f02c "" 

In the networking area, the kernel has IPF built-in (for Security),
and loads the kernel module for IPFW and DUMMYNET (for traffic shaping)
(come to think of it, a few months ago DUMMYNET was not being used,
 so I could check if the problem occurs without IPFW and DUMMYNET)
See above listed freebsd-stable posting for dmesg output.
>How-To-Repeat:
The bash script which can reliably generate panics generates
ping requests with an alias source address and a payload string
which includes the destination address.  The ping requests are
sent using individual instances of the ping command, due to the
unique payload.  The script forks about 1000 or 1500 pings, then
waits for them all to complete, then sends another 1000 or so.
After sending about about 1.2 million pings, the panic occurs,
although this could be coincidence, as it will sometimes occur
shortly after a reboot when picking up the scan where it left off
after the panic, but sometimes will continue on without problem.
The panic will always occur before the script completes, it is
repeatable.
>Fix:
      
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->silby 
Responsible-Changed-By: silby 
Responsible-Changed-When: Thu Sep 26 12:28:18 PDT 2002 
Responsible-Changed-Why:  
Send me the script which can repeat the problem via private 
e-mail, and I'll see if I can fix this. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=43396 

From: Dimitry Andric <dim@xs4all.nl>
To: freebsd-gnats-submit@FreeBSD.org, bsdal@otterhole.ods.org
Cc:  
Subject: Re: kern/43396: repeatable kernel panic in if_xl.c:xl_newbuf:MCLGET
Date: Tue, 17 Dec 2002 22:26:08 +0100

 Just had an identical panic as the original submitter, also in
 xl_newbuf, at exactly the same location. Note that I'm using neither
 ipfw nor dummynet, only ipfilter.
 
 This happened while having quite a lot of download traffic, but since
 it is through a DSL connection attached to xl0, it can't have been
 much more than ~7 Mbps. In my case there are 2 bpf clients, dhcpd and
 snort. The machine is also doing NAT for the LAN behind it, attached
 to xl1.
 
 This panic happens to me every once in a while, but it's not easily
 reproducible. I've had it since 4.6, somewhere...
 
 For reference, environment and NIC configs:
 FreeBSD tensor.xs4all.nl 4.7-STABLE FreeBSD 4.7-STABLE #0: Thu Dec 12 19:04:51 CET 2002     root@tensor.xs4all.nl:/usr/obj/usr/src/sys/TENSOR  i386
 xl0: <3Com 3c905B-TX Fast Etherlink XL> port 0x6100-0x617f mem 0xe4000000-0xe400007f irq 11 at device 15.0 on pci0
 xl1: <3Com 3c905B-TX Fast Etherlink XL> port 0x6200-0x627f mem 0xe4001000-0xe400107f irq 9 at device 17.0 on pci0
 

From: Al <bsdal@otterhole.ods.org>
To: Dimitry Andric <dim@xs4all.nl>
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: kern/43396: repeatable kernel panic in if_xl.c:xl_newbuf:MCLGET
Date: Wed, 18 Dec 2002 15:48:26 -0500

 I have not done a scan, the activity which will cause the problem in a
 reproducible fashion, for some time.  I agree that the problem first
 occurred somewhere in 4.6-STABLE, probably early on.   I do not do the
 scans often enough to know exactly when it started, nor have a I done a
 series of tests to determine exactly which build caused it to fail I did
 a series of tests last year to determine what date and time pccard
 support failed for another FreeBSD box, it takes a bit of time to narrow
 these things down, especially in this case as the scan will typically run
 for a few hours before panic.
 
 Interesting that you don't use ipfw or dummynet.
 
 al
 
 On Tue, Dec 17, 2002 at 10:26:08PM +0100, Dimitry Andric wrote:
 > Just had an identical panic as the original submitter, also in
 > xl_newbuf, at exactly the same location. Note that I'm using neither
 > ipfw nor dummynet, only ipfilter.
 > 
 > This happened while having quite a lot of download traffic, but since
 > it is through a DSL connection attached to xl0, it can't have been
 > much more than ~7 Mbps. In my case there are 2 bpf clients, dhcpd and
 > snort. The machine is also doing NAT for the LAN behind it, attached
 > to xl1.
 > 
 > This panic happens to me every once in a while, but it's not easily
 > reproducible. I've had it since 4.6, somewhere...
 > 
 > For reference, environment and NIC configs:
 > FreeBSD tensor.xs4all.nl 4.7-STABLE FreeBSD 4.7-STABLE #0: Thu Dec 12 19:04:51 CET 2002     root@tensor.xs4all.nl:/usr/obj/usr/src/sys/TENSOR  i386
 > xl0: <3Com 3c905B-TX Fast Etherlink XL> port 0x6100-0x617f mem 0xe4000000-0xe400007f irq 11 at device 15.0 on pci0
 > xl1: <3Com 3c905B-TX Fast Etherlink XL> port 0x6200-0x627f mem 0xe4001000-0xe400107f irq 9 at device 17.0 on pci0
State-Changed-From-To: open->closed 
State-Changed-By: silby 
State-Changed-When: Mon Aug 18 20:23:25 PDT 2003 
State-Changed-Why:  
The busdma'd driver recently MFC'd to 4.8-stable appears to solve this          
problem.  

http://www.freebsd.org/cgi/query-pr.cgi?pr=43396 
>Unformatted:
