FreeBSD Bugzilla – Attachment 172268 Details for
Bug 210884
panic: bogus refcnt 0 on lle 0xfffff80004608c00
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
svn diff
diff.210884 (text/plain), 5.37 KB, created by
Larry Rosenman
on 2016-07-09 01:57:08 UTC
(
hide
)
Description:
svn diff
Filename:
MIME Type:
Creator:
Larry Rosenman
Created:
2016-07-09 01:57:08 UTC
Size:
5.37 KB
patch
obsolete
>Index: share/man/man9/timeout.9 >=================================================================== >--- share/man/man9/timeout.9 (revision 302379) >+++ share/man/man9/timeout.9 (working copy) >@@ -29,7 +29,7 @@ > .\" > .\" $FreeBSD$ > .\" >-.Dd July 4, 2016 >+.Dd September 14, 2015 > .Dt TIMEOUT 9 > .Os > .Sh NAME >@@ -247,10 +247,6 @@ > negative one is returned. > If the callout is currently being serviced and cannot be stopped, > then zero will be returned. >-If the callout is currently being serviced and cannot be stopped, and at the >-same time a next invocation of the same callout is also scheduled, then >-.Fn callout_stop >-unschedules the next run and returns zero. > If the callout has an associated lock, > then that lock must be held when this function is called. > .Pp >@@ -818,7 +814,7 @@ > .Fn callout_drain > functions return a value of one if the callout was still pending when it was > called, a zero if the callout could not be stopped and a negative one is it >-was either not running or has already completed. >+was either not running or haas already completed. > The > .Fn timeout > function returns a >Index: sys/kern/kern_timeout.c >=================================================================== >--- sys/kern/kern_timeout.c (revision 302379) >+++ sys/kern/kern_timeout.c (working copy) >@@ -1166,7 +1166,7 @@ > struct callout_cpu *cc, *old_cc; > struct lock_class *class; > int direct, sq_locked, use_lock; >- int cancelled, not_on_a_list; >+ int not_on_a_list; > > if ((flags & CS_DRAIN) != 0) > WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, c->c_lock, >@@ -1236,14 +1236,28 @@ > } > > /* >- * If the callout is running, try to stop it or drain it. >+ * If the callout isn't pending, it's not on the queue, so >+ * don't attempt to remove it from the queue. We can try to >+ * stop it by other means however. > */ >- if (cc_exec_curr(cc, direct) == c) { >+ if (!(c->c_iflags & CALLOUT_PENDING)) { > /* >- * Succeed we to stop it or not, we must clear the >- * active flag - this is what API users expect. >+ * If it wasn't on the queue and it isn't the current >+ * callout, then we can't stop it, so just bail. >+ * It probably has already been run (if locking >+ * is properly done). You could get here if the caller >+ * calls stop twice in a row for example. The second >+ * call would fall here without CALLOUT_ACTIVE set. > */ > c->c_flags &= ~CALLOUT_ACTIVE; >+ if (cc_exec_curr(cc, direct) != c) { >+ CTR3(KTR_CALLOUT, "failed to stop %p func %p arg %p", >+ c, c->c_func, c->c_arg); >+ CC_UNLOCK(cc); >+ if (sq_locked) >+ sleepq_release(&cc_exec_waiting(cc, direct)); >+ return (-1); >+ } > > if ((flags & CS_DRAIN) != 0) { > /* >@@ -1362,7 +1376,7 @@ > cc_exec_drain(cc, direct) = drain; > } > CC_UNLOCK(cc); >- return ((flags & CS_EXECUTING) != 0); >+ return ((flags & CS_MIGRBLOCK) != 0); > } > CTR3(KTR_CALLOUT, "failed to stop %p func %p arg %p", > c, c->c_func, c->c_arg); >@@ -1369,21 +1383,13 @@ > if (drain) { > cc_exec_drain(cc, direct) = drain; > } >+ CC_UNLOCK(cc); > KASSERT(!sq_locked, ("sleepqueue chain still locked")); >- cancelled = ((flags & CS_EXECUTING) != 0); >- } else >- cancelled = 1; >- >+ return (0); >+ } > if (sq_locked) > sleepq_release(&cc_exec_waiting(cc, direct)); > >- if ((c->c_iflags & CALLOUT_PENDING) == 0) { >- CTR3(KTR_CALLOUT, "failed to stop %p func %p arg %p", >- c, c->c_func, c->c_arg); >- CC_UNLOCK(cc); >- return (cancelled); >- } >- > c->c_iflags &= ~CALLOUT_PENDING; > c->c_flags &= ~CALLOUT_ACTIVE; > >@@ -1400,7 +1406,7 @@ > } > callout_cc_del(c, cc); > CC_UNLOCK(cc); >- return (cancelled); >+ return (1); > } > > void >Index: sys/kern/subr_sleepqueue.c >=================================================================== >--- sys/kern/subr_sleepqueue.c (revision 302379) >+++ sys/kern/subr_sleepqueue.c (working copy) >@@ -600,7 +600,7 @@ > * another CPU, so synchronize with it to avoid having it > * accidentally wake up a subsequent sleep. > */ >- else if (_callout_stop_safe(&td->td_slpcallout, CS_EXECUTING, NULL) >+ else if (_callout_stop_safe(&td->td_slpcallout, CS_MIGRBLOCK, NULL) > == 0) { > td->td_flags |= TDF_TIMEOUT; > TD_SET_SLEEPING(td); >Index: sys/netinet6/in6.c >=================================================================== >--- sys/netinet6/in6.c (revision 302379) >+++ sys/netinet6/in6.c (working copy) >@@ -2322,16 +2322,10 @@ > sdl = &ndpc.sdl; > sdl->sdl_family = AF_LINK; > sdl->sdl_len = sizeof(*sdl); >+ sdl->sdl_alen = ifp->if_addrlen; > sdl->sdl_index = ifp->if_index; > sdl->sdl_type = ifp->if_type; >- if ((lle->la_flags & LLE_VALID) == LLE_VALID) { >- sdl->sdl_alen = ifp->if_addrlen; >- bcopy(lle->ll_addr, LLADDR(sdl), >- ifp->if_addrlen); >- } else { >- sdl->sdl_alen = 0; >- bzero(LLADDR(sdl), ifp->if_addrlen); >- } >+ bcopy(lle->ll_addr, LLADDR(sdl), ifp->if_addrlen); > if (lle->la_expire != 0) > ndpc.rtm.rtm_rmx.rmx_expire = lle->la_expire + > lle->lle_remtime / hz + >Index: sys/sys/callout.h >=================================================================== >--- sys/sys/callout.h (revision 302379) >+++ sys/sys/callout.h (working copy) >@@ -64,8 +64,9 @@ > > /* Flags for callout_stop_safe() */ > #define CS_DRAIN 0x0001 /* callout_drain(), wait allowed */ >-#define CS_EXECUTING 0x0002 /* Positive return value indicates that >- the callout was executing */ >+#define CS_MIGRBLOCK 0x0002 /* Block migration, return value >+ indicates that the callout was >+ executing */ > > #ifdef _KERNEL > /*
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 210884
:
172201
|
172202
|
172217
|
172254
|
172266
| 172268 |
172272
|
172407
|
172505
|
172634
|
172639