-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, Two days ago I had the fourth kernel panic - again in tcp_input - same statement. It looks like the running 5.5 kernel does no longer survive than a couple of days .. This time I have full kernel dump. However, it looks a bit wired to me. So here the details:
tcp_input patched: 643 } 644 } 645 // XXX PH: add panic instead of KASSERT 646 // KASSERT(sotoinpcb(inp->inp_socket) == inp); 647 // KASSERT(intotcpcb(inp)->t_inpcb == inp); 648 649 if (sotoinpcb(inp->inp_socket) != inp) { 650 panic("%s:%d: %p != %p", __func__, __LINE__, inp->inp_socket, inp); 651 } 652 if (intotcpcb(inp)->t_inpcb != inp) { 653 panic("%s:%d: %p != %p", __func__, __LINE__, intotcpcb(inp)->t_inpcb, inp); 654 } 655 /* Check the minimum TTL for socket. */ May 30 07:11:29 savecore: reboot after panic: tcp_input:650: 0xfffffe852c102790 != 0xfffffe851758a050 struct inpcb => 0xfffffe851758a050 inpcb->inp_socket => 0xfffffe852c102790 in gdb: (gdb) bt #0 0xffffffff8131a954 in dumpsys () at ../../../../arch/amd64/amd64/machdep.c:993 #1 0xffffffff8131aaa7 in boot (howto=256) at ../../../../arch/amd64/amd64/machdep.c:787 #2 0xffffffff811a7af6 in panic (fmt=0xffffffff817df223 "%s:%d: %p != %p") at ../../../../kern/subr_prf.c:220 #3 0xffffffff812530ce in tcp_input (m=0xfffffe80a6686100) at ../../../../netinet/tcp_input.c:650 #4 0xffffffff812475e1 in ip_ours (m=0xfffffe80a6686100) at ../../../../netinet/ip_input.c:641 #5 0xffffffff81247a67 in ipv4_input (m=0xfffffe80a6686100) at ../../../../netinet/ip_input.c:411 #6 0xffffffff81247bff in ipintr () at ../../../../netinet/ip_input.c:214 #7 0xffffffff81203375 in netintr (unused=Variable "unused" is not available. ) at ../../../../net/netisr.c:49 #8 0xffffffff81324fdd in softintr_dispatch (which=Variable "which" is not available. ) at ../../../../arch/amd64/amd64/softintr.c:96 #9 0xffffffff8133decd in Xsoftnet () #10 0xffffffff81daf280 in cpuset_infos () #11 0x0000000000000001 in ?? () #12 0xffff800000130300 in ?? () #13 0x0000000000000000 in ?? () ==> print inpcb at 0xfffffe851758a050 (gdb) p {struct inpcb} 0xfffffe851758a050 $3 = {inp_hash = {le_next = 0xfffffe852c0ae8b0, le_prev = 0xffff8000005ac790}, inp_lhash = {le_next = 0xfffffe852c0aece8, le_prev = 0xfffffe852c699450}, inp_queue = {tqe_next = 0xfffffe84eb5cc490, tqe_prev = 0xfffffe852c699460}, inp_table = 0xffffffff81dd3380, inp_faddru = {iau_addr6 = {__u6_addr = {__u6_addr8 = '\0' <repeats 12 times>, "Õ¼ Õ", __u6_addr16 = {0, 0, 0, 0, 0, 0, 48341, 54560}, __u6_addr32 = {0, 0, 0, 3575692501}}}, iau_a4u = {pad = '\0' <repeats 11 times>, inaddr = { s_addr = 3575692501}}}, inp_laddru = {iau_addr6 = {__u6_addr = {__u6_addr8 = '\0' <repeats 12 times>, "Õ¼ -", __u6_addr16 = {0, 0, 0, 0, 0, 0, 48341, 11552}, __u6_addr32 = {0, 0, 0, 757120213}}}, iau_a4u = {pad = '\0' <repeats 11 times>, inaddr = { s_addr = 757120213}}}, inp_fport = 52715, inp_lport = 20480, inp_socket = 0xfffffe852c102790, inp_ppcb = 0xfffffe852b69c6a8 "", inp_ru = {ru_route = {ro_rt = 0xfffffe84f4ac4190, ro_tableid = 0, ro_dst = {sa_len = 16 '\020', sa_family = 2 '\002', sa_data = "\000\000Õ¼ Õ\000\000\000\000\000\000\000"}}, ru_route6 = {ro_rt = 0xfffffe84f4ac4190, ro_tableid = 0, ro_dst = { sin6_len = 16 '\020', sin6_family = 2 '\002', sin6_port = 0, sin6_flowinfo = 3575692501, sin6_addr = {__u6_addr = { __u6_addr8 = '\0' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, sin6_scope_id = 0}}}, inp_flags = 0, inp_hu = {hu_ip = {ip_hl = 0, ip_v = 0, ip_tos = 0 '\0', ip_len = 0, ip_id = 0, ip_off = 0, ip_ttl = 64 '@', ip_p = 0 '\0', ip_sum = 0, ip_src = {s_addr = 0}, ip_dst = {s_addr = 0}}, hu_ipv6 = {ip6_ctlun = {ip6_un1 = { ip6_un1_flow = 0, ip6_un1_plen = 0, ip6_un1_nxt = 0 '\0', ip6_un1_hlim = 0 '\0'}, ip6_un2_vfc = 0 '\0'}, ip6_src = { __u6_addr = {__u6_addr8 = "@", '\0' <repeats 14 times>, __u6_addr16 = {64, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {64, 0, 0, 0}}}, ip6_dst = {__u6_addr = {__u6_addr8 = '\0' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}}}, inp_options = 0x0, inp_outputopts6 = 0x0, inp_hops = -1, inp_mou = {mou_mo = 0x0, mou_mo6 = 0x0}, inp_seclevel = "\001\001\001\001", inp_secrequire = 0, inp_secresult = 0, inp_ip_minttl = 0 '\0', inp_tdb_in_next = {tqe_next = 0x0, tqe_prev = 0x0}, inp_tdb_out_next = {tqe_next = 0x0, tqe_prev = 0x0}, inp_tdb_in = 0x0, inp_tdb_out = 0x0, inp_ipo = 0x0, inp_ipsec_remotecred = 0x0, inp_ipsec_remoteauth = 0x0, inp_cksum6 = -1, inp_icmp6filt = 0x0, inp_pf_sk = 0xfffffe852c092c48, inp_rtableid = 0, inp_pipex = 0, inp_divertfl = 0} so inp_socket is at 0xfffffe852c102790 ==> print inpcb->inp_socket at 0xfffffe852c102790 (gdb) p {struct socket} 0xfffffe852c102790 $4 = {so_type = 1, so_options = 4, so_linger = 0, so_state = 387, so_pcb = 0xfffffe851758a050, so_proto = 0xffffffff81a54790, so_head = 0xfffffe852c752780, so_onq = 0xfffffe852c7527b8, so_q0 = {tqh_first = 0x0, tqh_last = 0x0}, so_q = {tqh_first = 0x0, tqh_last = 0x0}, so_qe = {tqe_next = 0xfffffe84f677e6a8, tqe_prev = 0xfffffe852c7527b8}, so_q0len = 0, so_qlen = 0, so_qlimit = 0, so_timeo = 0, so_error = 0, so_pgid = 0, so_siguid = 0, so_sigeuid = 0, so_oobmark = 0, so_splice = 0x0, so_spliceback = 0x0, so_splicelen = 0, so_splicemax = 0, so_idletv = {tv_sec = 0, tv_usec = 0}, so_idleto = {to_list = {next = 0x0, prev = 0x0}, to_func = 0, to_arg = 0x0, to_time = 0, to_flags = 0}, so_rcv = {sb_cc = 205, sb_datacc = 205, sb_hiwat = 17520, sb_wat = 16384, sb_mbcnt = 2304, sb_mbmax = 35040, sb_lowat = 1, sb_mb = 0xfffffe80ac88b200, sb_mbtail = 0xfffffe80ac88b200, sb_lastrecord = 0xfffffe80ac88b200, sb_sel = {si_selpid = 0, si_note = {slh_first = 0x0}, si_flags = 0}, sb_flagsintr = 0, sb_flags = 0, sb_timeo = 0}, so_snd = {sb_cc = 0, sb_datacc = 0, sb_hiwat = 17520, sb_wat = 16384, sb_mbcnt = 0, sb_mbmax = 35040, sb_lowat = 2048, sb_mb = 0x0, sb_mbtail = 0x0, sb_lastrecord = 0x0, sb_sel = {si_selpid = 0, si_note = {slh_first = 0x0}, si_flags = 0}, sb_flagsintr = 0, sb_flags = 0, sb_timeo = 0}, so_upcall = 0, so_upcallarg = 0x0, so_euid = 0, so_ruid = 0, so_egid = 0, so_rgid = 0, so_cpid = 5271} Her I see so_pcb at 0xfffffe851758a050 which is exactly what was expected: struct inpcb => 0xfffffe851758a050 So for my understanding sotoinpcb(inp->inp_socket) == inp and therefore the panic should not have happen - theoretically! Obviously at the time of the check - the two were not identical, but in the dump they are. According to this fact I decided to remove the panics and replace them with logs, so I see, when it would have happen again. The KASSERTS where introduced in 5.5. However, any help is appreciated. If someone needs any further information from the core, let me know. I'd happily will provide them. Regards - Peter Comment: GPGTools - http://gpgtools.org iD8DBQFTi2Q+ZFR7Ae3oDfYRArunAJ9g2RS5j4CxOUHrzaSUBPC5cKE22wCgj6nK O0PBYaP0j9pMqlfM5L5dh9U= =2mcR -----END PGP SIGNATURE-----