Re: KASSERT() in kern_timeout.c

[Andrew Doran <ad%NetBSD.org@localhost>]

On Fri, Mar 19, 2010 at 12:38:12PM +0100, Manuel Bouyer wrote:
> Hi,
> last night I got the panic below on a fairly busy ftp/http server
> (serving static content). The kernel is 5.0_STABLE from Jan, 19.
> Does it ring a bell to someone ?

I'll bet that c->c_cpu is from curcpu and that the callout is running,
nested below the softnet handler.  General solution: callout_halt() before
callout_destroy().  This may be tricky because it may need to drop the
mutex that you hold (in this instance softnet_lock).  See other instances of
callout_halt() in the TCP code.  I haven't checked the code to verify that
this is what's happening and I can't remember if the syncache code is already
using callout_halt().

> panic: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || 
> c->c_cpu->cc_active != c" failed: file 
> "/home/src/src-5/src/sys/kern/kern_timeout.c", line 310
> fatal breakpoint trap in supervisor mode
> trap type 1 code 0 rip ffffffff803dab85 cs 8 rflags 246 cr2  ffff8000b2615000 
> cpl 4 rsp ffff8000a3b66840
> Stopped in pid 0.3 (system) at  netbsd:breakpoint+0x5:  leave
> db{0}>
> db{0}> tr
> breakpoint() at netbsd:breakpoint+0x5
> panic() at netbsd:panic+0x24d
> __kernassert() at netbsd:__kernassert+0x2d
> callout_destroy() at netbsd:callout_destroy+0xa7
> syn_cache_get() at netbsd:syn_cache_get+0x936
> tcp_input() at netbsd:tcp_input+0x11fb
> ip_input() at netbsd:ip_input+0x5c7
> ipintr() at netbsd:ipintr+0x6a
> softint_dispatch() at netbsd:softint_dispatch+0xe7
> DDB lost frame for netbsd:Xsoftintr+0x50, trying 0xffff8000a3b66d70
> Xsoftintr() at netbsd:Xsoftintr+0x50
> --- interrupt ---
> 0:
> db{0}> mach cpu 1
> using CPU 1
> db{0}> tr
> mutex_vector_enter() at netbsd:mutex_vector_enter+0xf6
> do_sys_getsockname() at netbsd:do_sys_getsockname+0x6f
> sys_getsockname() at netbsd:sys_getsockname+0x23
> syscall() at netbsd:syscall+0xb6
> db{0}> mach cpu 2
> using CPU 2
> db{0}> tr
> x86_pause() at netbsd:x86_pause+0x2
> cv_timedwait_sig() at netbsd:cv_timedwait_sig+0x132
> sowait() at netbsd:sowait+0x52
> do_sys_accept() at netbsd:do_sys_accept+0x146
> sys_accept() at netbsd:sys_accept+0x28
> syscall() at netbsd:syscall+0xb6
> db{0}> mach cpu 3
> using CPU 3
> db{0}> tr
> ffs_sync() at netbsd:ffs_sync+0xda
> VFS_SYNC() at netbsd:VFS_SYNC+0x33
> sync_fsync() at netbsd:sync_fsync+0x85
> VOP_FSYNC() at netbsd:VOP_FSYNC+0x71
> sched_sync() at netbsd:sched_sync+0x15d
> db{0}> mach cpu 4
> using CPU 4
> db{0}> tr
> x86_pause() at netbsd:x86_pause+0x2
> cv_timedwait_sig() at netbsd:cv_timedwait_sig+0x132
> sowait() at netbsd:sowait+0x52
> do_sys_accept() at netbsd:do_sys_accept+0x146
> sys_accept() at netbsd:sys_accept+0x28
> syscall() at netbsd:syscall+0xb6
> db{0}> mach cpu 5
> using CPU 5
> db{0}> tr
> mutex_vector_enter() at netbsd:mutex_vector_enter+0xf1
> cv_timedwait_sig() at netbsd:cv_timedwait_sig+0x132
> sowait() at netbsd:sowait+0x52
> do_sys_accept() at netbsd:do_sys_accept+0x146
> sys_accept() at netbsd:sys_accept+0x28
> syscall() at netbsd:syscall+0xb6
> db{0}> mach cpu 6
> using CPU 6
> db{0}> tr
> x86_pause() at netbsd:x86_pause+0x2
> sosend() at netbsd:sosend+0x2eb
> soo_write() at netbsd:soo_write+0x2d
> dofilewrite() at netbsd:dofilewrite+0x81
> sys_write() at netbsd:sys_write+0x72
> syscall() at netbsd:syscall+0xb6
> db{0}> mach cpu 7
> using CPU 7
> db{0}> tr
> x86_pause() at netbsd:x86_pause
> mutex_vector_enter() at netbsd:mutex_vector_enter+0xf6
> cv_timedwait_sig() at netbsd:cv_timedwait_sig+0x132
> sowait() at netbsd:sowait+0x52
> do_sys_accept() at netbsd:do_sys_accept+0x146
> sys_accept() at netbsd:sys_accept+0x28
> syscall() at netbsd:syscall+0xb6
> 
> -- 
> Manuel Bouyer <bouyer%antioche.eu.org@localhost>
>      NetBSD: 26 ans d'experience feront toujours la difference
> --