crash with network01.patch

[Peter Avalos]

After patching for the previously reported crash regarding
tcp_syncache.bucket_limit, I also installed the network01.patch,
and saw this panic this morning.  I realize that an updated patchset
has been committed, but I'm not sure if this problem was fixed.  Kernel
and core are on leaf in ~pavalos/crash/*.10.

Matt:  This is the same thing I emailed you about this morning, except
that I previously said I had network02.patch, when in fact I had #1.

--Peter

panic: assertion: sfm->mref_count > 0 in sf_buf_mfree
mp_lock = 00000001; cpuid = 1; lapic.id = 06000000
boot() called on cpu#1
Uptime: 2d9h40m41s

dumping to dev #da/0x20001, offset 378927

[...]

#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:527
527             if (dumping++) {
dumpsys () at /usr/src/sys/kern/kern_shutdown.c:527
527             if (dumping++) {
(kgdb) bt
#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:527
#1  0xc0190241 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:360
#2  0xc01907d9 in panic (fmt=0xc0309fac "assertion: sfm->mref_count > 0 in %s") at /usr/src/sys/kern/kern_shutdown.c:673
#3  0xc01c6ba2 in sf_buf_mfree (arg=0xebe10d80) at /usr/src/sys/kern/uipc_syscalls.c:1268
#4  0xc01be30b in m_free (m=0xecb86900) at /usr/src/sys/kern/uipc_mbuf.c:792
#5  0xc01be3dd in m_freem (m=0xecb86900) at /usr/src/sys/kern/uipc_mbuf.c:822
#6  0xc01c4a64 in sbdrop (sb=0xda814440, len=40) at /usr/src/sys/kern/uipc_socket2.c:907
#7  0xc0206ea1 in tcp_input (m=0xea3ade00) at /usr/src/sys/netinet/tcp_input.c:2150
#8  0xc01ff27e in transport_processing_oncpu (m=0xea3ade00, hlen=20, ip=0x0, nexthop=0x0) at /usr/src/sys/netinet/ip_input.c:421
#9  0xc01ffd2d in ip_input (m=0xea3ade00) at /usr/src/sys/netinet/ip_input.c:1121
#10 0xc01ff2f6 in ip_input_handler (msg0=0xc3e063c0) at /usr/src/sys/netinet/ip_input.c:452
#11 0xc020a1a2 in tcpmsg_service_loop (dummy=0x0) at /usr/src/sys/netinet/tcp_subr.c:391
#12 0xc019779f in lwkt_create (func=0, arg=0x0, tdp=0x1000, template=0x0, tdflags=---Can't read userspace from dump, or kernel process---

) at /usr/src/sys/kern/lwkt_thread.c:1362
Previous frame inner to this frame (corrupt stack?)

Attachment:
pgp00001.pgp
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pgp00001.pgp
Type: application/octet-stream
Size: 189 bytes
Desc: "Description: PGP signature"
URL: <http://lists.dragonflybsd.org/pipermail/bugs/attachments/20051128/570e37f3/attachment-0021.obj>