NetBSD Problem Report #47881

From kardel@gateway.kardel.name  Mon Jun  3 07:39:02 2013
Return-Path: <kardel@gateway.kardel.name>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id EE10C70D3B
	for <gnats-bugs@gnats.NetBSD.org>; Mon,  3 Jun 2013 07:39:01 +0000 (UTC)
Message-Id: <20130603073856.96D3B571713@gateway.kardel.name>
Date: Mon,  3 Jun 2013 07:38:56 +0000 (UTC)
From: kardel@netbsd.org
Reply-To: kardel@netbsd.org
To: gnats-bugs@NetBSD.org
Subject: diagnostic panic in6_delmulti()
X-Send-Pr-Version: 3.95

>Number:         47881
>Category:       kern
>Synopsis:       kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 03 07:40:00 +0000 2013
>Closed-Date:    Mon Dec 29 20:49:48 +0000 2014
>Last-Modified:  Mon Dec 29 20:49:48 +0000 2014
>Originator:     Frank Kardel
>Release:        NetBSD 6.99.20
>Organization:

>Environment:


System: NetBSD gateway.kardel.name 6.99.20 NetBSD 6.99.20 (GATEWAY) #3: Sat May 25 15:10:16 CEST 2013 kardel@pip.kardel.name:/fs/raid1a/src/NetBSD/cur/src/obj.amd64/sys/arch/amd64/compile/GATEWAY amd64
Architecture: x86_64
Machine: amd64
>Description:
	While running an IPv6 tunnel (freenet6) occasionally the kernel crashe with following panic.

	  #0  0xffffffff805a32d3 in cpu_reboot (howto=260, bootstr=<optimized out>) at /fs/raid1a/src/NetBSD/cur/src/sys/arch/amd64/amd64/machdep.c:705
	  #1  0xffffffff80795bcd in vpanic (fmt=0xffffffff80b677d8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=0xffff80005be338e0) at /fs/raid1a/src/NetBSD/cur/src/sys/kern/subr_prf.c:284
	  #2  0xffffffff80914c98 in kern_assert (fmt=<unavailable>) at /fs/raid1a/src/NetBSD/cur/src/sys/lib/libkern/kern_assert.c:50
	  #3  0xffffffff80546a87 in callout_destroy (cs=0xffff800006e83398) at /fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_timeout.c:313
	  #4  0xffffffff805c6e21 in in6_delmulti (in6m=0xffff800006e83348) at /fs/raid1a/src/NetBSD/cur/src/sys/netinet6/mld6.c:744
	  #5  0xffffffff805c6f91 in in6_leavegroup (imm=0xffff800006d7b428) at /fs/raid1a/src/NetBSD/cur/src/sys/netinet6/mld6.c:777
	  #6  0xffffffff804946fe in ip6_freemoptions (im6o=0xffff800006c19fa8) at /fs/raid1a/src/NetBSD/cur/src/sys/netinet6/ip6_output.c:2589
	  #7  0xffffffff8047936d in in6_pcbdetach (in6p=0xffff800005451570) at /fs/raid1a/src/NetBSD/cur/src/sys/netinet6/in6_pcb.c:610
	  #8  0xffffffff8080f4cb in udp6_usrreq (so=0xffff80000e9e4b70, req=<optimized out>, m=0x0, addr6=0x0, control=0x0, l=<optimized out>) at /fs/raid1a/src/NetBSD/cur/src/sys/netinet6/udp6_usrreq.c:410
	  #9  0xffffffff8047a46a in udp6_usrreq_wrapper (a=0xffff80000e9e4b70, b=1, c=0x0, d=0x0, e=<optimized out>, f=<optimized out>) at /fs/raid1a/src/NetBSD/cur/src/sys/netinet6/in6_proto.c:139
	  #10 0xffffffff8083bb5f in soclose (so=0xffff80000e9e4b70) at /fs/raid1a/src/NetBSD/cur/src/sys/kern/uipc_socket.c:743
	  #11 0xffffffff807b08c5 in soo_close (fp=0xffff800006ada340) at /fs/raid1a/src/NetBSD/cur/src/sys/kern/sys_socket.c:257
	  #12 0xffffffff8050e803 in closef (fp=0xffff800006ada340) at /fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_descrip.c:824
	  #13 0xffffffff8050eae5 in fd_close (fd=11) at /fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_descrip.c:709
	  #14 0xffffffff807a4641 in sys_close (l=0xffff8000069e70c0, uap=0xffff80005be33c80, retval=<optimized out>) at /fs/raid1a/src/NetBSD/cur/src/sys/kern/sys_descrip.c:488
	  #15 0xffffffff807b0dc1 in sy_call (rval=0xffff80005be33c30, uap=0xffff80005be33c80, l=0xffff8000069e70c0, sy=0xffffffff80ec3ca0) at /fs/raid1a/src/NetBSD/cur/src/sys/sys/syscallvar.h:61
	  #16 syscall (frame=0xffff80005be33c80) at /fs/raid1a/src/NetBSD/cur/src/sys/arch/x86/x86/syscall.c:161
	  #17 0xffffffff801006a1 in do_syscall ()
	  #18 0x000000000000000b in ?? ()
	  #19 0x0000000000000000 in ?? ()
	  (gdb) print panicstr
	  $1 = 0xffffffff80f6f7c0 "kernel diagnostic assertion \"c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c\" failed: file \"/fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_timeout.c\", line 313 "
>How-To-Repeat:
	run 6.99.20 with a freenet6 tunnel (gogoc tunnelbroker client).
>Fix:

>Release-Note:

>Audit-Trail:
From: "Ryota Ozaki" <ozaki-r@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47881 CVS commit: src/sys/netinet6
Date: Wed, 12 Nov 2014 03:24:25 +0000

 Module Name:	src
 Committed By:	ozaki-r
 Date:		Wed Nov 12 03:24:25 UTC 2014

 Modified Files:
 	src/sys/netinet6: mld6.c

 Log Message:
 Ensure callout isn't running and pending before callout_destroy

 Call callout_halt before callout_destroy. And also let callout (mld_timeo)
 not call callout_schedule when we already called callout_halt.

 This fixes PR 47881.


 To generate a diff of this commit:
 cvs rdiff -u -r1.60 -r1.61 src/sys/netinet6/mld6.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: ozaki-r@NetBSD.org
State-Changed-When: Sun, 16 Nov 2014 14:27:25 +0000
State-Changed-Why:
Fix committed. Can you test?


From: Frank Kardel <kardel@netbsd.org>
To: gnats-bugs@NetBSD.org, kern-bug-people@netbsd.org, netbsd-bugs@netbsd.org,
        gnats-admin@netbsd.org, ozaki-r@NetBSD.org
Cc: 
Subject: Re: kern/47881 (kernel diagnostic assertion "c->c_cpu->cc_lwp ==
 curlwp || c->c_cpu->cc_active != c" failed)
Date: Sat, 22 Nov 2014 17:03:25 +0100

 On 11/16/14 15:27, ozaki-r@NetBSD.org wrote:
 > Synopsis: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed
 >
 > State-Changed-From-To: open->feedback
 > State-Changed-By: ozaki-r@NetBSD.org
 > State-Changed-When: Sun, 16 Nov 2014 14:27:25 +0000
 > State-Changed-Why:
 > Fix committed. Can you test?
 >
 >
 I have been running 6.99.40 for quite a while without the panic and thus 
 cannot tell whether something else already
 fixed it.
 An attempt to run an MROUTING enabled -current kernel of today paniced. 
 See kern/49410 for that issue.
 So once that is fixed I can try to check again. The system is one of the 
 active routers, thus not freely configurable.

 Thanks for spotting and fixing that.

State-Changed-From-To: feedback->pending-pullups
State-Changed-By: ozaki-r@NetBSD.org
State-Changed-When: Mon, 29 Dec 2014 11:18:07 +0000
State-Changed-Why:
The submitter (and I) has no panic for a month with the fix.
I think we can pull it up and close the PR.


From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47881 CVS commit: [netbsd-6] src/sys/netinet6
Date: Mon, 29 Dec 2014 15:45:45 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Mon Dec 29 15:45:45 UTC 2014

 Modified Files:
 	src/sys/netinet6 [netbsd-6]: mld6.c

 Log Message:
 Pull up following revision(s) (requested by ozaki-r in ticket #1224):
 	sys/netinet6/mld6.c: revision 1.61
 Ensure callout isn't running and pending before callout_destroy
 Call callout_halt before callout_destroy. And also let callout (mld_timeo)
 not call callout_schedule when we already called callout_halt.
 This fixes PR 47881.


 To generate a diff of this commit:
 cvs rdiff -u -r1.55 -r1.55.4.1 src/sys/netinet6/mld6.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47881 CVS commit: [netbsd-7] src/sys/netinet6
Date: Mon, 29 Dec 2014 17:33:49 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Mon Dec 29 17:33:49 UTC 2014

 Modified Files:
 	src/sys/netinet6 [netbsd-7]: mld6.c

 Log Message:
 Pull up following revision(s) (requested by ozaki-r in ticket #360):
 	sys/netinet6/mld6.c: revision 1.61
 Ensure callout isn't running and pending before callout_destroy
 Call callout_halt before callout_destroy. And also let callout (mld_timeo)
 not call callout_schedule when we already called callout_halt.
 This fixes PR 47881.


 To generate a diff of this commit:
 cvs rdiff -u -r1.59 -r1.59.2.1 src/sys/netinet6/mld6.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: pending-pullups->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 29 Dec 2014 20:49:48 +0000
State-Changed-Why:
pulled up. thanks, all


>Unformatted:

Home	PR Database Search