Re: panic: sbdrop

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

On Thu, Apr 02, 2009 at 10:33:46PM +0200, Manuel Bouyer wrote:
> Hi again,
> on this netbsd-5 box (test NFS server with 2 fast linux clients) I got
> (after fixing m_split() to handle 0 len, see previous mail):
> 
> panic: sbdrop
> fatal breakpoint trap in supervisor mode
> trap type 1 code 0 eip c03faa4c cs 8 eflags 246 cr2 cdb59000 ilevel 4
> Stopped in pid 0.3 (system) at  netbsd:breakpoint+0x4:  popl    %ebp
> db{0}> tr
> breakpoint(c065149e,cd13bbac,c06adc00,c0361439,6,c3c14500,cd13bba0,c0388770,50435051,ffffffff)
>  at netbsd:breakpoint+0x4
> panic(c0655801,c3c14500,ffffffff,c035dc93,50435851,c06adc00,0,e8,c3ba07e0,c3c14400)
>  at netbsd:panic+0x1b0
> sbdrop(c3ba07e0,e8,c3c1446c,14,20,0,c3b40d00,14,cd13bca8,ce320030) at 
> netbsd:sbdrop+0x2f8
> tcp_input(c3c14400,14,6,1,c01280ea,cbf87a00,0,0,14,cbf87a00) at 
> netbsd:tcp_input+0x24b7
> ip_input(c3c14400,0,7,cbf87a00,cd137154,cd1371ec,cd13bd80,c03433ed,0,cd130010)
>  at netbsd:ip_input+0x61f
> ipintr(0,cd130010,cbf80030,cbf80010,c2da0010,0,f87c80,c2da3780,0,cd13bda0) at 
> netbsd:ipintr+0x4d
> softint_dispatch(cbf87c80,4,0,0,0,0,cd13bd90,cd13ba68,cd13bac0,18) at 
> netbsd:softint_dispatch+0xcd
> DDB lost frame for netbsd:Xsoftintr+0x3d, trying 0xcd13bd88
> Xsoftintr() at netbsd:Xsoftintr+0x3d
> 
> I have a core dump and netbsd.gdb

Here's what I could gather from the core:
#10 0xc0392d28 in sbdrop (sb=0xc3ba07e0, len=216)
    at ../../../../kern/uipc_socket2.c:1239
1239    ../../../../kern/uipc_socket2.c: No such file or directory.
        in ../../../../kern/uipc_socket2.c
(gdb) print sb
$1 = (struct sockbuf *) 0xc3ba07e0
(gdb) print *sb
$2 = {sb_sel = {sel_klist = {slh_first = 0x0}, sel_cpu = 0x0, sel_lwp = 0x0, 
    sel_chain = {sle_next = 0x0}, sel_collision = 0, sel_reserved = {0, 0, 
      0}}, sb_mowner = 0xc06a1840, sb_so = 0xc3ba0788, sb_cv = {cv_opaque = {
      0x0, 0xc3ba0808}, cv_wmesg = 0xc06557e5 "netio"}, sb_cc = 216, 
  sb_hiwat = 65944, sb_mbcnt = 512, sb_mbmax = 131888, sb_lowat = 2048, 
  sb_mb = 0xc3c14500, sb_mbtail = 0xc3b46c00, sb_lastrecord = 0xc3c14500, 
  sb_flags = 2048, sb_timeo = 0, sb_overflowed = 0}

notice that len=216 same as sb->sb_cc

I've printed sc->sb_mb below but I'm not sure it's interesting as the
first while() loop has probably altered it already.

-- 
Manuel Bouyer <bouyer%antioche.eu.org@localhost>
     NetBSD: 26 ans d'experience feront toujours la difference
--