From olgeni@FreeBSD.org  Mon Aug 15 14:13:33 2005
Return-Path: <olgeni@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9BE5416A42C
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 15 Aug 2005 14:13:33 +0000 (GMT)
	(envelope-from olgeni@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6652543D45
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 15 Aug 2005 14:13:33 +0000 (GMT)
	(envelope-from olgeni@FreeBSD.org)
Received: from freefall.freebsd.org (olgeni@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j7FEDX8Q036627
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 15 Aug 2005 14:13:33 GMT
	(envelope-from olgeni@freefall.freebsd.org)
Received: (from olgeni@localhost)
	by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j7FEDXq2036626;
	Mon, 15 Aug 2005 14:13:33 GMT
	(envelope-from olgeni)
Message-Id: <200508151413.j7FEDXq2036626@freefall.freebsd.org>
Date: Mon, 15 Aug 2005 14:13:33 GMT
From: Jimmy Olgeni <olgeni@freebsd.org>
Reply-To: Jimmy Olgeni <olgeni@freebsd.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: "panic: sbappendstream 1" while using net/mpd
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         84952
>Category:       kern
>Synopsis:       "panic: sbappendstream 1" while using net/mpd
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    glebius
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Aug 15 14:20:08 GMT 2005
>Closed-Date:    Fri Sep 09 06:18:44 GMT 2005
>Last-Modified:  Fri Sep 09 06:18:44 GMT 2005
>Originator:     Jimmy Olgeni
>Release:        FreeBSD 6.0-BETA2 i386
>Organization:
>Environment:
System: FreeBSD olgeni.olgeni 6.0-BETA2 FreeBSD 6.0-BETA2 #2: Sat Aug 13 22:03:12 CEST 2005 olgeni@olgeni.olgeni:/usr/obj/usr/src/sys/GENERIC i386
>Description:

While downloading data on a net/mpd GRE link, the following panic will occur:

#0  doadump () at pcpu.h:165
165	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc0631ea8 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:397
#2  0xc06321bd in panic (fmt=0xc085d9c7 "sbappendstream 1")
    at /usr/src/sys/kern/kern_shutdown.c:553
#3  0xc066e296 in sbappendstream_locked (sb=0xc27f2050, m=0xc222b600)
    at /usr/src/sys/kern/uipc_socket2.c:741
#4  0xc06c8880 in tcp_input (m=0xc222b600, off0=20)
    at /usr/src/sys/netinet/tcp_input.c:1280
#5  0xc06c1c91 in ip_input (m=0xc222b600)
    at /usr/src/sys/netinet/ip_input.c:776
#6  0xc06a0cd6 in netisr_processqueue (ni=0xc096f7b8)
    at /usr/src/sys/net/netisr.c:235
#7  0xc06a0eba in swi_net (dummy=0x0) at /usr/src/sys/net/netisr.c:348
#8  0xc061f9b8 in ithread_loop (arg=0xc1e33480)
    at /usr/src/sys/kern/kern_intr.c:545
#9  0xc061edec in fork_exit (callout=0xc061f89c <ithread_loop>, 
    arg=0xc1e33480, frame=0xd58d3d38) at /usr/src/sys/kern/kern_fork.c:789
#10 0xc07dc2dc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208

A similar panic ("sbdrop") occurs on recent RELENG_5.

>How-To-Repeat:

Running any verbose command over a ssh link ("find /") will panic the client side.

>Fix:

Using ppp over tcp between the same hosts does not trigger the panic.
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->glebius 
Responsible-Changed-By: glebius 
Responsible-Changed-When: Mon Aug 15 14:41:52 GMT 2005 
Responsible-Changed-Why:  
Take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=84952 

From: Gleb Smirnoff <glebius@FreeBSD.org>
To: Jimmy Olgeni <olgeni@FreeBSD.org>
Cc: FreeBSD-gnats-submit@FreeBSD.org
Subject: Re: kern/84952: "panic: sbappendstream 1" while using net/mpd
Date: Mon, 15 Aug 2005 18:42:43 +0400

 On Mon, Aug 15, 2005 at 02:13:33PM +0000, Jimmy Olgeni wrote:
 J> While downloading data on a net/mpd GRE link, the following panic will occur
 
 Is this reproducible with debug.mpsafenet=0 ?
 
 -- 
 Totus tuus, Glebius.
 GLEBIUS-RIPN GLEB-RIPE

From: Jimmy Olgeni <olgeni@FreeBSD.org>
To: Gleb Smirnoff <glebius@FreeBSD.org>
Cc: FreeBSD-gnats-submit@FreeBSD.org
Subject: Re: kern/84952: "panic: sbappendstream 1" while using net/mpd
Date: Tue, 16 Aug 2005 00:12:31 +0200 (CEST)

 On Mon, 15 Aug 2005, Gleb Smirnoff wrote:
 
 > Is this reproducible with debug.mpsafenet=0 ?
 
 I just checked with mpsafenet=0 and got this:
 
 #0  doadump () at pcpu.h:165
 #1  0xc0631ea8 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:397
 #2  0xc06321bd in panic (fmt=0xc085d9c7 "sbappendstream 1")
      at /usr/src/sys/kern/kern_shutdown.c:553
 #3  0xc066e296 in sbappendstream_locked (sb=0xc22cf050, m=0xc223b100)
      at /usr/src/sys/kern/uipc_socket2.c:741
 #4  0xc06c737e in tcp_reass (tp=0xc229bc94, th=0xc2245048, tlenp=0xd58d3c04,
      m=0xc223b100) at /usr/src/sys/netinet/tcp_input.c:372
 #5  0xc06c9fb6 in tcp_input (m=0xc223b100, off0=20)
      at /usr/src/sys/netinet/tcp_input.c:2350
 #6  0xc06c1c91 in ip_input (m=0xc223b100)
      at /usr/src/sys/netinet/ip_input.c:776
 #7  0xc06a0cd6 in netisr_processqueue (ni=0xc096f7b8)
      at /usr/src/sys/net/netisr.c:235
 #8  0xc06a0e84 in swi_net (dummy=0x0) at /usr/src/sys/net/netisr.c:342
 #9  0xc061f9b8 in ithread_loop (arg=0xc1e33480)
      at /usr/src/sys/kern/kern_intr.c:545
 #10 0xc061edec in fork_exit (callout=0xc061f89c <ithread_loop>,
      arg=0xc1e33480, frame=0xd58d3d38) at /usr/src/sys/kern/kern_fork.c:789
 #11 0xc07dc2dc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
 
 -- 
 jimmy

From: Gleb Smirnoff <glebius@FreeBSD.org>
To: Jimmy Olgeni <olgeni@FreeBSD.org>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/84952: "panic: sbappendstream 1" while using net/mpd
Date: Tue, 23 Aug 2005 17:46:10 +0400

   Jimmy,
 
 how often do you experience the panic?
 
 Can you please backout ng_ksocket.c to revision 1.53, and confirm/decline
 that your box is now more stable?
 
 -- 
 Totus tuus, Glebius.
 GLEBIUS-RIPN GLEB-RIPE

From: Jimmy Olgeni <olgeni@FreeBSD.org>
To: Gleb Smirnoff <glebius@FreeBSD.org>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/84952: "panic: sbappendstream 1" while using net/mpd
Date: Wed, 24 Aug 2005 20:29:09 +0200 (CEST)

 Hi,
 
 On Tue, 23 Aug 2005, Gleb Smirnoff wrote:
 
 > how often do you experience the panic?
 
 Always, and immediately, as soon as the transfer starts.
 
 > Can you please backout ng_ksocket.c to revision 1.53, and confirm/decline
 > that your box is now more stable?
 
 With 1.53 it never crashed, running multiple transfers, even after a
 couple of hours. Looks fine!
 
 -- 
 jimmy
State-Changed-From-To: open->analyzed 
State-Changed-By: glebius 
State-Changed-When: Thu Aug 25 07:23:20 GMT 2005 
State-Changed-Why:  
It seems that problem lives outside ng_ksocket, but the last change 
to ng_ksocket exposed it. It was backed out until I find the cause 
of the problem. 

Also note that PR kern/82413 is similar to this one. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=84952 
State-Changed-From-To: analyzed->patched 
State-Changed-By: glebius 
State-Changed-When: Tue Sep 6 17:16:57 GMT 2005 
State-Changed-Why:  
Fixed in HEAD. You are encouranged to merge revision 1.57 of ng_ksocket.c 
into your kernel and report whether this fixes your problems. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=84952 
State-Changed-From-To: patched->closed 
State-Changed-By: glebius 
State-Changed-When: Fri Sep 9 06:18:27 GMT 2005 
State-Changed-Why:  
Fixed in RELENG_[56]. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=84952 
>Unformatted:
