>Number:         25073
>Category:       kern
>Synopsis:       something apparently in or related to sorecive() panics
>Confidential:   yes
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Apr 06 14:18:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Paul Shupak
>Release:        NetBSD 2.0x -- anything after the ip-filter 4.1.1 integration
>Organization:
>Environment:
	
NetBSD 2.0C (COBALT-$Revision: 1.4 $) #421: Mon Apr  5 18:28:24 PDT 2004
        root@svcs:/sys/arch/i386/compile/COBALT
Architecture: i386
Machine: i386
>Description:
		Below are two example panics occurred while /etc/rc was
	still running. The tracebacks are:

	...
wsdisplay0: screen 4 added (80x25, vt100 emulation)
panic: receive 1a
Begin traceback...
soreceive(c21b7190,cffa2e98,cffa2ea4,0,0) at netbsd:soreceive+0x88b
recvit(ce446b30,5,cffa2f14,bfbff7c0,cffa2f5c) at netbsd:recvit+0xfa
sys_recvfrom(ce38bdec,cffa2f64,cffa2f5c,0,cffa2fa4) at netbsd:sys_recvfrom+0x5e
syscall_plain() at netbsd:syscall_plain+0x7e
--- syscall (number 29) ---
0x480e4b6f:
End traceback...
syncing disks... 
dumping to dev 0,1 offset 3911591
dump 1535 1534 1533 1532 1531 1530 1529 1528 1527 1526 1525 1524 1523 1522 1521
	...
and:

	...
wsdisplay0: screen 4 added (80x25, vt100 emulation)
panic: receive 1
Begin traceback...
soreceive(c2cfcbb8,d154ce98,d154cea4,0,0) at netbsd:soreceive+0x8d7
recvit(ce4c1b34,3,d154cf14,bfbff44c,d154cf5c) at netbsd:recvit+0xfa
sys_recvfrom(ce4c3424,d154cf64,d154cf5c,0,c02f3136) at netbsd:sys_recvfrom+0x5e
syscall_plain() at netbsd:syscall_plain+0x7e
--- syscall (number 29) ---
0x480f0b6f:
End traceback...
syncing disks... panic: ip_output no HDR
Begin traceback...
ip_output(c2194100,0,c2dd8390,0,0) at netbsd:ip_output+0xa27
udp_output(c2ddea00,c2dd8360,c2ddea00,c23b4000,c2d4d800) at netbsd:udp_output+0x
146
udp_usrreq(c2d4e0cc,9,c2ddea00,0,0) at netbsd:udp_usrreq+0x1fc
nfs_timer(0,d154cc14,0,ce4c1b34,d154cc40) at netbsd:nfs_timer+0x22c
softclock(0,d154cc34,c02e836e,d154cc40,d154cc44) at netbsd:softclock+0x259
softintr_dispatch(0,10,30,10,10) at netbsd:softintr_dispatch+0x73
Xsoftclock() at netbsd:Xsoftclock+0x25
--- interrupt ---
ltsleep(c2cfa210,11,c03f492c,0,0) at netbsd:ltsleep+0x22c
lfs_segunlock(c2cfa000,d2604000,ce4e8000,d2604000,0) at netbsd:lfs_segunlock+0x1
18
lfs_segwrite(c21fd000,5,c080b444,ce4c3424,c21ffc18) at netbsd:lfs_segwrite+0x348
lfs_sync(c21fd000,2,c2195e80,ce4c1b34,d154cd9c) at netbsd:lfs_sync+0x4f
sys_sync(ce4c3424,0,0,0,100) at netbsd:sys_sync+0xba
vfs_shutdown(c03f75db,0,d154cdfc,c028cd9c,100) at netbsd:vfs_shutdown+0x5f
cpu_reboot(100,0,d154cdfc,c02a00c5,c2cfcbb8) at netbsd:cpu_reboot+0x155
panic(c03f75db,3,ce37de38,d154ce5c,16) at netbsd:panic+0x108
soreceive(c2cfcbb8,d154ce98,d154cea4,0,0) at netbsd:soreceive+0x8d7
recvit(ce4c1b34,3,d154cf14,bfbff44c,d154cf5c) at netbsd:recvit+0xfa
sys_recvfrom(ce4c3424,d154cf64,d154cf5c,0,c02f3136) at netbsd:sys_recvfrom+0x5e
syscall_plain() at netbsd:syscall_plain+0x7e
--- syscall (number 29) ---
0x480f0b6f:
End traceback...

dumping to dev 0,1 offset 3911591
dump 1535 1534 1533 1532 1531 1530 1529 1528 1527 1526 1525 1524 1523 1522 1521
	...

>How-To-Repeat:
		It seem to be: Try to use any machine ( at least i386 )
	with option IPFILTER_DEFAULT_BLOCK enabled - you can't/won't reach
	a multi-user prompt. The process running when the system dies is
	usually but not always network related ( route and ifconfig are
	common points at which the machines die, but I've seen several
	deaths where the current porcess was lfs_cleanerd and even once
	was /bin/sh.
	
>Fix:
	Don't know; but I can make available kernels and core dumps for the
two crashes above ( including a "-g" kernel for the second ).  Warning: After
compression the kernels and core dumps are a 49M download, expanded they're
over 3G.
>Release-Note:
>Audit-Trail:
>Unformatted: