Discussion:
Panic on shutdown @r328436: "Unholding 6 with cnt = -559038242"
(too old to reply)
David Wolfskill
2018-01-26 12:29:47 UTC
Permalink
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)

I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.

I then issued "sudo shutdown -p now", and serial console shows:

FreeBSD/amd64 (freebeast.catwhisker.org) (ttyu0)

login: Jan 26 12:11:03 Stopping sshd.
Waiting for PIDS: 681.
Stopping rsyncd.
Waiting for PIDS: 652.
Stopping powerd.
Waiting for PIDS: 636.
Stopping ntpd.
Waiting for PIDS: 633, 633.
Stopping lpd.
Waiting for PIDS: 610.
Stopping lockd.
WaitingWARNING: autofs_unmount: vflush failed with error 16
for PIDS: 592.
Stopping statd.
Waiting for PIDS: 589.
Stopping nfsd.
WaitinlJan 26 12:11:05 ock ordefreebeast syslogr reversal:
1st 0xfffff800692cd490 filed: exiting on sidesc structure (filedesc structure) @ /usr/src/sys/kern/sys_generic.c:1567
2nd 0xfffff8006973f9a0 devfs (devfs) @ /usr/src/gnal 15
sys/kern/vfs_vnops.c:1526
stack backtrace:
#0 0xffffffff80b2c2e3 at witness_debugger+0x73
#1 0xffffffff80b2c164 at witness_checkorder+0xe34
#2 0xffffffff80a9ca21 at lockmgr_lock_fast_path+0x1b1
#3 0xffffffff810f8ca9 at VOP_LOCK1_APV+0xd9
#4 0xffffffff80ba7746 at _vn_lock+0x66
#5 0xffffffff80ba654b at vn_poll+0x3b
#6 0xffffffff80992f4d at devfs_poll_f+0xcd
#7 0xffffffff80b33255 at kern_poll+0x385
#8 0xffffffff80b32ec0 at sys_poll+0x50
#9 0xffffffff80f7a37b at amd64_syscall+0x79b
#10 0xffffffff80f569c8 at fast_syscall_common+0xfc
Waiting (max 60 seconds) for system process `vnlru' to stop... done
Waiting (max 60 seconds) for system process `bufdaemon' to stop... done
Waiting (max 60 seconds) for system process `syncer' to stop...
Syncing disks, vnodes remaining... 5 5 lock order reversal:
1st 0xfffff80007927240 syncer (syncer) @ /usr/src/sys/kern/vfs_subr.c:2157
2nd 0xfffff80007570d50 devfs (devfs) @ /usr/src/sys/ufs/ffs/ffs_vfsops.c:1583
stack backtrace:
#0 0xffffffff80b2c2e3 at witness_debugger+0x73
#1 0xffffffff80b2c164 at witness_checkorder+0xe34
#2 0xffffffff80a9ca21 at lockmgr_lock_fast_path+0x1b1
#3 0xffffffff810f8ca9 at VOP_LOCK1_APV+0xd9
#4 0xffffffff80ba7746 at _vn_lock+0x66
#5 0xffffffff80dc1dac at ffs_sync+0x2cc
#6 0xffffffff80b9ce8f at sync_fsync+0xff
#7 0xffffffff810f7c19 at VOP_FSYNC_APV+0xd9
#8 0xffffffff80b9acc4 at sched_sync+0x284
#9 0xffffffff80a88414 at fork_exit+0x84
#10 0xffffffff80f56e1e at fork_trampoline+0xe
5 3 2 2 1 1 1 1 1 0 0 0 0 0 done
All buffers synced.
lock order reversal:
1st 0xfffff800079c57c8 ufs (ufs) @ /usr/src/sys/kern/vfs_mount.c:1280
2nd 0xfffff8000795e418 devfs (devfs) @ /usr/src/sys/ufs/ffs/ffs_vfsops.c:1371
stack backtrace:
#0 0xffffffff80b2c2e3 at witness_debugger+0x73
#1 0xffffffff80b2c164 at witness_checkorder+0xe34
#2 0xffffffff80a9ca21 at lockmgr_lock_fast_path+0x1b1
#3 0xffffffff810f8ca9 at VOP_LOCK1_APV+0xd9
#4 0xffffffff80ba7746 at _vn_lock+0x66
#5 0xffffffff80dbef63 at ffs_flushfiles+0x93
#6 0xffffffff80da24f2 at softdep_flushfiles+0x82
#7 0xffffffff80dc15f7 at ffs_unmount+0x77
#8 0xffffffff80b8e2c9 at dounmount+0x519
#9 0xffffffff80b9800b at vfs_unmountall+0x6b
#10 0xffffffff80b73d25 at bufshutdown+0x3a5
#11 0xffffffff80ac754a at kern_reboot+0x1da
#12 0xffffffff80ac7312 at sys_reboot+0x3c2
#13 0xffffffff80f7a37b at amd64_syscall+0x79b
#14 0xffffffff80f569c8 at fast_syscall_common+0xfc
Swap device [file] removed.
Uptime: 1m44s
(ada0:ahcich0:0:0:0): spin-down
(ada1:ahcich2:0:0:0): spin-down
(ada2:ahcich3:0:0:0): spin-down
(ada3:ahcich4:0:0:0): spin-down
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00004289d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00004289f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>


As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.

When running head, the system does not use ZFS (only UFS2+SU -- not
SUJ -- & tmpfs).

Same system had completed a source-based update for stable/11 from
r328392 to r328429 earlier today without incident (using a different
slice of the boot drive).

Peace,
david
--
David H. Wolfskill ***@catwhisker.org
"unfortunately, no trust!” -- well, of course! You reap what you sow.

See http://www.catwhisker.org/~david/publickey.gpg for my public key.
David Wolfskill
2018-01-26 14:07:08 UTC
Permalink
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
....
The laptop did the same source-based update, and did not exhibit the
panic.

(On the laptop) following the "make delete-old-libs", I did a normal
"shutdown -r now" (as I normally continue using the laptop throughout
the day); when it started to boot, I coerced it to boot head again, then
logged in an ran "poweroff" -- to which it complied without issue.

The build machine went from

FreeBSD 12.0-CURRENT #83 r328393M/328393:1200056: Thu Jan 25 04:37:47 PST 2018 ***@freebeast.catwhisker.org:/common/S4/obj/usr/src/amd64.amd64/sys/GENERIC amd64

to

FreeBSD 12.0-CURRENT #84 r328436M/328436:1200056: Fri Jan 26 04:02:06 PST 2018 ***@freebeast.catwhisker.org:/common/S4/obj/usr/src/amd64.amd64/sys/GENERIC amd64


The laptop went from

FreeBSD 12.0-CURRENT #80 r328393M/328393:1200056: Thu Jan 25 04:56:41 PST 2018 ***@g1-252.catwhisker.org:/common/S4/obj/usr/src/amd64.amd64/sys/CANARY amd64

to

FreeBSD 12.0-CURRENT #81 r328436M/328436:1200056: Fri Jan 26 05:41:19 PST 2018 ***@g1-252.catwhisker.org:/common/S4/obj/usr/src/amd64.amd64/sys/CANARY amd64

Peace,
david
--
David H. Wolfskill ***@catwhisker.org
"unfortunately, no trust!” -- well, of course! You reap what you sow.

See http://www.catwhisker.org/~david/publickey.gpg for my public key.
Warner Losh
2018-01-26 14:47:48 UTC
Permalink
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00004289d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00004289f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral because
geom has finished with the disk and is giving us a final callback so we can
drop the reference we took when we created the geom. Trouble is, cnt should
be like 1 always for this code, but it's not. It looks like it may be bytes
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested to
see what the contents of the softc are...a
Post by David Wolfskill
Same system had completed a source-based update for stable/11 from
r328392 to r328429 earlier today without incident (using a different
slice of the boot drive).
Thanks for the report. This is quite troubling.

Warner
David Wolfskill
2018-01-26 15:07:10 UTC
Permalink
Post by Warner Losh
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by Warner Losh
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by Warner Losh
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00004289d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00004289f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral because
geom has finished with the disk and is giving us a final callback so we can
drop the reference we took when we created the geom. Trouble is, cnt should
be like 1 always for this code, but it's not. It looks like it may be bytes
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested to
see what the contents of the softc are...a
Pointer to how to do that?

I do have ddb right now....
Post by Warner Losh
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Post by Warner Losh
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).

Peace,
david
--
David H. Wolfskill ***@catwhisker.org
"unfortunately, no trust!” -- well, of course! You reap what you sow.

See http://www.catwhisker.org/~david/publickey.gpg for my public key.
thomas masper
2018-01-28 21:22:36 UTC
Permalink
Hi,
similar panic happen to me when extracting a pendrive from laptop USB port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.

panic: Releasing 6 with cnt = -559038242

GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.

Unread portion of the kernel message buffer:
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00593839d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic

__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>, code=<optimized
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx> "\257\257\033\201\377\377\377\377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)


uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
***@laptopW530.tommyBSD.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC
amd64

Regards,
thomas
Post by David Wolfskill
Post by Warner Losh
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by Warner Losh
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by Warner Losh
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by Warner Losh
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by Warner Losh
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral because
geom has finished with the disk and is giving us a final callback so we
can
Post by Warner Losh
drop the reference we took when we created the geom. Trouble is, cnt
should
Post by Warner Losh
be like 1 always for this code, but it's not. It looks like it may be
bytes
Post by Warner Losh
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested to
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
Post by Warner Losh
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Post by Warner Losh
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you sow.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
Warner Losh
2018-01-28 21:28:31 UTC
Permalink
Post by thomas masper
Hi,
similar panic happen to me when extracting a pendrive from laptop USB port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.

Warner
Post by thomas masper
panic: Releasing 6 with cnt = -559038242
GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.
html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
<http://www.gnu.org/software/gdb/bugs/>.
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00593839d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>, code=<optimized
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx> "\257\257\033\201\377\377\377\
377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)
uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
amd64
Regards,
thomas
Post by David Wolfskill
Post by Warner Losh
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by Warner Losh
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by Warner Losh
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by Warner Losh
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by Warner Losh
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral
because
Post by David Wolfskill
Post by Warner Losh
geom has finished with the disk and is giving us a final callback so we
can
Post by Warner Losh
drop the reference we took when we created the geom. Trouble is, cnt
should
Post by Warner Losh
be like 1 always for this code, but it's not. It looks like it may be
bytes
Post by Warner Losh
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested
to
Post by David Wolfskill
Post by Warner Losh
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
Post by Warner Losh
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Post by Warner Losh
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you sow.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
thomas masper
2018-01-28 21:49:31 UTC
Permalink
Post by Warner Losh
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.
Exactly! Just insert and remove the usb thumb drive.
Happen in both USB3 and USB2 ports of the laptop.


Regards
thomas
Post by Warner Losh
Post by thomas masper
Hi,
similar panic happen to me when extracting a pendrive from laptop USB port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.
Warner
Post by thomas masper
panic: Releasing 6 with cnt = -559038242
GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
<http://www.gnu.org/software/gdb/bugs/>.
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00593839d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>, code=<optimized
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx>
"\257\257\033\201\377\377\377\377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)
uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
amd64
Regards,
thomas
Post by David Wolfskill
On Fri, Jan 26, 2018 at 5:29 AM, David Wolfskill
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral because
geom has finished with the disk and is giving us a final callback so we
can
drop the reference we took when we created the geom. Trouble is, cnt
should
be like 1 always for this code, but it's not. It looks like it may be
bytes
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested to
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you sow.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
Konrad Witaszczyk
2018-01-28 22:22:08 UTC
Permalink
Post by Warner Losh
Post by thomas masper
Hi,
similar panic happen to me when extracting a pendrive from laptop USB port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.
Warner
I hit the same problem after upgrading to r328500. I booted my laptop from a
pendrive, got a GELI password prompt, removed the pendrive, typed in a GELI
password and then I got the kernel panic. Removing the pendrive at an earlier
stage is a workaround for me at the moment.
Post by Warner Losh
Post by thomas masper
panic: Releasing 6 with cnt = -559038242
GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.
html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
<http://www.gnu.org/software/gdb/bugs/>.
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00593839d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>, code=<optimized
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx> "\257\257\033\201\377\377\377\
377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)
uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
amd64
Regards,
thomas
Post by David Wolfskill
Post by Warner Losh
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by Warner Losh
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by Warner Losh
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by Warner Losh
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by Warner Losh
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral
because
Post by David Wolfskill
Post by Warner Losh
geom has finished with the disk and is giving us a final callback so we
can
Post by Warner Losh
drop the reference we took when we created the geom. Trouble is, cnt
should
Post by Warner Losh
be like 1 always for this code, but it's not. It looks like it may be
bytes
Post by Warner Losh
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested
to
Post by David Wolfskill
Post by Warner Losh
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
Post by Warner Losh
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Post by Warner Losh
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you sow.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
Allan Jude
2018-01-29 01:40:22 UTC
Permalink
Post by Warner Losh
Post by thomas masper
Hi,
similar panic happen to me when extracting a pendrive from laptop USB port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.
Warner
Post by thomas masper
panic: Releasing 6 with cnt = -559038242
GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.
html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
<http://www.gnu.org/software/gdb/bugs/>.
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00593839d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>, code=<optimized
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx> "\257\257\033\201\377\377\377\
377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)
uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
amd64
Regards,
thomas
Post by David Wolfskill
Post by Warner Losh
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by Warner Losh
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by Warner Losh
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by Warner Losh
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by Warner Losh
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral
because
Post by David Wolfskill
Post by Warner Losh
geom has finished with the disk and is giving us a final callback so we
can
Post by Warner Losh
drop the reference we took when we created the geom. Trouble is, cnt
should
Post by Warner Losh
be like 1 always for this code, but it's not. It looks like it may be
bytes
Post by Warner Losh
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested
to
Post by David Wolfskill
Post by Warner Losh
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
Post by Warner Losh
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Post by Warner Losh
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you sow.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
I've been seeing this today while working on my laptop.

1) insert USB stick.
2) mount UFS partition to /mnt
3) copy a file off
4) umount /mnt
5) remove usb stick
6) instant panic

Oddly, it is the same negative number every time (-559038242), so it
isn't random/memory corruption.
--
Allan Jude
Warner Losh
2018-01-29 02:29:23 UTC
Permalink
Post by Warner Losh
Post by thomas masper
Hi,
similar panic happen to me when extracting a pendrive from laptop USB port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.
Warner
Post by thomas masper
panic: Releasing 6 with cnt = -559038242
GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.
html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
<http://www.gnu.org/software/gdb/bugs/>.
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00593839d0
Post by Warner Losh
Post by thomas masper
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>, code=<optimized
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx> "\257\257\033\201\377\377\377\
377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)
uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
amd64
Regards,
thomas
Post by David Wolfskill
Post by Warner Losh
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by Warner Losh
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by Warner Losh
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by Warner Losh
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by Warner Losh
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral
because
Post by David Wolfskill
Post by Warner Losh
geom has finished with the disk and is giving us a final callback so we
can
Post by Warner Losh
drop the reference we took when we created the geom. Trouble is, cnt
should
Post by Warner Losh
be like 1 always for this code, but it's not. It looks like it may be
bytes
Post by Warner Losh
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested
to
Post by David Wolfskill
Post by Warner Losh
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
Post by Warner Losh
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Post by Warner Losh
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you sow.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
"
Post by Warner Losh
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
I've been seeing this today while working on my laptop.

1) insert USB stick.
2) mount UFS partition to /mnt
3) copy a file off
4) umount /mnt
5) remove usb stick
6) instant panic

Oddly, it is the same negative number every time (-559038242), so it
isn't random/memory corruption.



Is mount required?

Warner


Allan Jude
_______________________________________________
freebsd-***@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-***@freebsd.org"
Allan Jude
2018-01-29 03:11:42 UTC
Permalink
Post by Allan Jude
I've been seeing this today while working on my laptop.
1) insert USB stick.
2) mount UFS partition to /mnt
3) copy a file off
4) umount /mnt
5) remove usb stick
6) instant panic
Oddly, it is the same negative number every time (-559038242), so it
isn't random/memory corruption.
Is mount required?
Warner 
No, I just plugged the USB stick in, and then removed it 10 seconds
later, panic.

I've also seen it in VirtualBox when removing a virtual CD (.iso)
--
Allan Jude
Cy Schubert
2018-01-29 02:38:50 UTC
Permalink
In message <2effa324-c428-6135-371b-***@freebsd.org>, Allan
Jude write
Post by Allan Jude
Post by Warner Losh
Post by thomas masper
Hi,
similar panic happen to me when extracting a pendrive from laptop USB port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.
Warner
Post by thomas masper
panic: Releasing 6 with cnt = -559038242
Converting this to hex we get DEADC0DE.
Post by Allan Jude
Post by Warner Losh
Post by thomas masper
GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.
html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
<http://www.gnu.org/software/gdb/bugs/>.
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame 0xfffffe00593839d0
g_destroy_provider() at g_destroy_provider+0xae/frame 0xfffffe00593839f0
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>, code=<optimized
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized
out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx> "\257\257\033\201\377\377\377\
377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)
uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
amd64
Regards,
thomas
Post by David Wolfskill
Post by Warner Losh
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated ports
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by Warner Losh
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by Warner Losh
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by Warner Losh
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by Warner Losh
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral
because
Post by David Wolfskill
Post by Warner Losh
geom has finished with the disk and is giving us a final callback so we
can
Post by Warner Losh
drop the reference we took when we created the geom. Trouble is, cnt
should
Post by Warner Losh
be like 1 always for this code, but it's not. It looks like it may be
bytes
Post by Warner Losh
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be interested
to
Post by David Wolfskill
Post by Warner Losh
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
Post by Warner Losh
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Post by Warner Losh
Warner
....
I should still have access to the serial console after I get in to the
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you sow.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
I've been seeing this today while working on my laptop.
1) insert USB stick.
2) mount UFS partition to /mnt
3) copy a file off
4) umount /mnt
5) remove usb stick
6) instant panic
Oddly, it is the same negative number every time (-559038242), so it
isn't random/memory corruption.
--
Allan Jude
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
--
Cheers,
Cy Schubert <***@cschubert.com>
FreeBSD UNIX: <***@FreeBSD.org> Web: http://www.FreeBSD.org

The need of the many outweighs the greed of the few.
Warner Losh
2018-01-29 03:18:59 UTC
Permalink
Post by Cy Schubert
Jude write
Post by Allan Jude
On Sun, Jan 28, 2018 at 2:22 PM, thomas masper <
Post by thomas masper
Hi,
similar panic happen to me when extracting a pendrive from laptop USB
port
Post by Allan Jude
Post by thomas masper
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues are
related.
Do you have a reproducible test case? Ideally, it would be 'insert and
remove usb thumb drive' but maybe there's more steps between insert and
removal.
Warner
Post by thomas masper
panic: Releasing 6 with cnt = -559038242
Converting this to hex we get DEADC0DE.
vm/uma_dbg.c:static const uint32_t uma_junk = 0xdeadc0de;

Use after free it is then...

Warner
Post by Cy Schubert
Post by Allan Jude
Post by thomas masper
GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD]
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <
http://gnu.org/licenses/gpl.
Post by Allan Jude
Post by thomas masper
html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show
copying"
Post by Allan Jude
Post by thomas masper
and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
<http://www.gnu.org/software/gdb/bugs/>.
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from
/usr/lib/debug//boot/kernel/kernel.debug...done.
done.
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk 8.07> s/n 30E47C20 detached
(da0:umass-sim0:0:0:0): Periph destroyed
panic: Releasing 6 with cnt = -559038242
cpuid = 0
time = 1517158352
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00593838c0
vpanic() at vpanic+0x18d/frame 0xfffffe0059383920
panic() at panic+0x43/frame 0xfffffe0059383980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00593839a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00593839d0
Post by Allan Jude
Post by thomas masper
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00593839f0
Post by Allan Jude
Post by thomas masper
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0059383a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0059383a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0059383ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0059383ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
__curthread () at ./machine/pcpu.h:229
229 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) #0 __curthread () at ./machine/pcpu.h:229
#1 doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:346
#2 0xffffffff8040a08b in db_dump (dummy=<optimized out>,
dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>)
at /usr/src/sys/ddb/db_command.c:574
#3 0xffffffff80409e59 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>)
at /usr/src/sys/ddb/db_command.c:481
#4 0xffffffff80409bd4 in db_command_loop ()
at /usr/src/sys/ddb/db_command.c:534
#5 0xffffffff8040cdff in db_trap (type=<optimized out>,
code=<optimized
Post by Allan Jude
Post by thomas masper
out>)
at /usr/src/sys/ddb/db_main.c:250
#6 0xffffffff80b0d923 in kdb_trap (type=3, code=-61456, tf=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:697
#7 0xffffffff80f7b498 in trap (frame=0xfffffe00593837f0)
at /usr/src/sys/amd64/amd64/trap.c:547
#8 <signal handler called>
#9 kdb_enter (why=0xffffffff811f101e "panic", msg=<optimized out>)
at /usr/src/sys/kern/subr_kdb.c:479
#10 0xffffffff80ac8d3a in vpanic (fmt=<optimized out>,
ap=0xfffffe0059383960)
at /usr/src/sys/kern/kern_shutdown.c:800
#11 0xffffffff80ac8dc3 in panic (
fmt=0xffffffff81b1bbd8 <cnputs_mtx> "\257\257\033\201\377\377\377\
377")
at /usr/src/sys/kern/kern_shutdown.c:738
#12 0xffffffff80368bb2 in da_periph_release (periph=<optimized out>,
token=DA_REF_GEOM) at /usr/src/sys/cam/scsi/scsi_da.c:1591
#13 dadiskgonecb (dp=<optimized out>) at
/usr/src/sys/cam/scsi/scsi_da.c:1904
#14 0xffffffff80a0fdd5 in g_disk_providergone (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_disk.c:783
#15 0xffffffff80a15f9e in g_destroy_provider (pp=0xfffff80003e8b700)
at /usr/src/sys/geom/geom_subr.c:746
#16 0xffffffff80a15e17 in g_wither_washer ()
at /usr/src/sys/geom/geom_subr.c:461
#17 0xffffffff80a112da in g_run_events ()
at /usr/src/sys/geom/geom_event.c:297
#18 0xffffffff80a89444 in fork_exit (
callout=0xffffffff80a138c0 <g_event_procbody>, arg=0x0,
frame=0xfffffe0059383ac0) at /usr/src/sys/kern/kern_fork.c:1039
#19 <signal handler called>
(kgdb)
uname -a
FreeBSD laptopW530.tommyBSD.org 12.0-CURRENT FreeBSD 12.0-CURRENT #13
r328509M: Sun Jan 28 15:38:35 CET 2018
sys/GENERIC
Post by Allan Jude
Post by thomas masper
amd64
Regards,
thomas
On Fri, Jan 26, 2018 at 4:07 PM, David Wolfskill <
Post by David Wolfskill
On Fri, Jan 26, 2018 at 5:29 AM, David Wolfskill <
Post by David Wolfskill
This is on my "build machine" (laptop is still building updated
ports
Post by Allan Jude
Post by thomas masper
Post by David Wolfskill
Post by David Wolfskill
for today, so I don't know yet whether or not it encounters this.)
Running a kernel with INVARIANTS, right?
Yes -- GENERIC.
Post by David Wolfskill
I had performed a source-based update from r328393 to r328436,
rebooted, performed "make delete-old-libs", and all seemed well.
This has my change 328415 in it.
:-)
Post by David Wolfskill
panic: Unholding 6 with cnt = -559038242
cpuid = 3
time = 1516968697
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00004288c0
vpanic() at vpanic+0x18d/frame 0xfffffe0000428920
panic() at panic+0x43/frame 0xfffffe0000428980
dadiskgonecb() at dadiskgonecb+0x42/frame 0xfffffe00004289a0
g_disk_providergone() at g_disk_providergone+0x25/frame
0xfffffe00004289d0
Post by David Wolfskill
g_destroy_provider() at g_destroy_provider+0xae/frame
0xfffffe00004289f0
Post by David Wolfskill
g_wither_washer() at g_wither_washer+0x87/frame 0xfffffe0000428a30
g_run_events() at g_run_events+0x3ca/frame 0xfffffe0000428a70
fork_exit() at fork_exit+0x84/frame 0xfffffe0000428ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000428ab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 13 tid 100044 ]
Stopped at kdb_enter+0x3b: movq $0,kdb_why
db>
That's no good. We're releasing a reference to the da peripheral
because
Post by David Wolfskill
geom has finished with the disk and is giving us a final callback
so we
Post by Allan Jude
Post by thomas masper
Post by David Wolfskill
can
drop the reference we took when we created the geom. Trouble is, cnt
should
be like 1 always for this code, but it's not. It looks like it may
be
Post by Allan Jude
Post by thomas masper
Post by David Wolfskill
bytes
to a pointer :(
Post by David Wolfskill
As noted, this is a build machine, and it was to be powered off for
the rest of the day anyway, so I don't need to get it up & running
immediately: I can poke at the ddb prompt, given some clues.
I don't suppose you can attach kgdb to this machine? I'd be
interested
Post by Allan Jude
Post by thomas masper
to
Post by David Wolfskill
see what the contents of the softc are...a
Pointer to how to do that?
I do have ddb right now....
....
Thanks for the report. This is quite troubling.
Well, let's get it fixed, then! :-)
Warner
....
I should still have access to the serial console after I get in to
the
Post by Allan Jude
Post by thomas masper
Post by David Wolfskill
office (heading out shortly).
Peace,
david
--
"unfortunately, no trust!” -- well, of course! You reap what you
sow.
Post by Allan Jude
Post by thomas masper
Post by David Wolfskill
See http://www.catwhisker.org/~david/publickey.gpg for my public
key.
Post by Allan Jude
Post by thomas masper
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
freebsd.org"
Post by Allan Jude
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
freebsd.org"
Post by Allan Jude
I've been seeing this today while working on my laptop.
1) insert USB stick.
2) mount UFS partition to /mnt
3) copy a file off
4) umount /mnt
5) remove usb stick
6) instant panic
Oddly, it is the same negative number every time (-559038242), so it
isn't random/memory corruption.
--
Allan Jude
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
freebsd.org"
--
Cheers,
The need of the many outweighs the greed of the few.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-current
Cy Schubert
2018-01-29 03:44:01 UTC
Permalink
In message <CANCZdfpgo7=O+NvQH_Vh56U1sSd92_3TmNGDiSF+***@mail.gma
il.com>
--94eb2c0425900a5b5c0563e1b5b8
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Post by Cy Schubert
Jude write
On Sun, Jan 28, 2018 at 2:22 PM, thomas masper <
Hi,
similar panic happen to me when extracting a pendrive from laptop US=
B
Post by Cy Schubert
port
(I tried 3 different pendrive).
No issue if I reboot or shutdown. I don't know if those two issues a=
re
Post by Cy Schubert
related.
Do you have a reproducible test case? Ideally, it would be 'insert an=
d
Post by Cy Schubert
remove usb thumb drive' but maybe there's more steps between insert a=
nd
Post by Cy Schubert
removal.
Warner
panic: Releasing 6 with cnt =3D -559038242
Converting this to hex we get DEADC0DE.
vm/uma_dbg.c:static const uint32_t uma_junk =3D 0xdeadc0de;
Use after free it is then...
Yes, INVARIANTS. Learned that when I was chasing an ipfilter use after
free.
--
Cheers,
Cy Schubert <***@cschubert.com>
FreeBSD UNIX: <***@FreeBSD.org> Web: http://www.FreeBSD.org

The need of the many outweighs the greed of the few.
Loading...