From nobody Tue Feb 08 19:45:37 2022 X-Original-To: freebsd-transport@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 1433519B5F85 for ; Tue, 8 Feb 2022 19:45:45 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mx1.sbone.de (cross.sbone.de [195.201.62.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JtYQY6jRCz4q0N for ; Tue, 8 Feb 2022 19:45:41 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mx1.sbone.de (Postfix) with ESMTPS id A01078D4A15D; Tue, 8 Feb 2022 19:45:40 +0000 (UTC) Received: from content-filter.sbone.de (content-filter.sbone.de [IPv6:fde9:577b:c1a9:31::2013:2742]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPS id 39FD0E70814; Tue, 8 Feb 2022 19:45:40 +0000 (UTC) X-Virus-Scanned: amavisd-new at sbone.de Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587]) by content-filter.sbone.de (content-filter.sbone.de [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024) with ESMTP id NmVdfKg52uJY; Tue, 8 Feb 2022 19:45:38 +0000 (UTC) Received: from nv.sbone.de (nv.sbone.de [IPv6:fde9:577b:c1a9:31::2013:138]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPSA id 24257E707BB; Tue, 8 Feb 2022 19:45:38 +0000 (UTC) Date: Tue, 8 Feb 2022 19:45:37 +0000 (UTC) From: "Bjoern A. Zeeb" To: Drew Gallatin cc: freebsd-transport@freebsd.org Subject: Re: panic: syncache: mbuf too small In-Reply-To: Message-ID: References: X-OpenPGP-Key-Id: 0x14003F198FEFA3E77207EE8D2B58B8F83CCF1842 List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-transport List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-transport@freebsd.org X-BeenThere: freebsd-transport@freebsd.org MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Rspamd-Queue-Id: 4JtYQY6jRCz4q0N X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of bzeeb-lists@lists.zabbadoz.net designates 195.201.62.131 as permitted sender) smtp.mailfrom=bzeeb-lists@lists.zabbadoz.net X-Spamd-Result: default: False [-3.30 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; RCVD_COUNT_FIVE(0.00)[5]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:195.201.62.131]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[zabbadoz.net]; TO_MATCH_ENVRCPT_SOME(0.00)[]; BLOCKLISTDE_FAIL(0.00)[195.201.62.131:server fail]; RCPT_COUNT_TWO(0.00)[2]; NEURAL_HAM_SHORT(-1.00)[-1.000]; MLMMJ_DEST(0.00)[freebsd-transport]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:24940, ipnet:195.201.0.0/16, country:DE]; RCVD_TLS_LAST(0.00)[] X-ThisMailContainsUnwantedMimeParts: N On Tue, 8 Feb 2022, Bjoern A. Zeeb wrote: > On Tue, 8 Feb 2022, Drew Gallatin wrote: > >> Can you examine max_linkhdr? > > Yes, was still sitting in ddb (thankfully watchdog got disabled): > > db> x max_linkhdr > max_linkhdr: 58 > > And for consistency checks: > > db> x max_hdr > max_hdr: 94 > db> x max_datalen > max_datalen: 14 > db> x max_protohdr > max_protohdr: 3c If I do the maths correctly: MHLEN = 168 (0x94 + 0x14) TCP_MAXHLEN = 60 - 24 = 36 TCP_MAXOLEN max_linkhdr = 88 168 - 88 - 36 = 44 ipv6_hdr size = 40 Leaves us with 4 for the tcp_header again? Which would be 24? Why would this not go kaboom all the time? Hmm I assume it's ieee80211_proto.c .. it changes max_linkhdr .. > db> show reg > cs 0x20 > ds 0x3b > es 0x3b > fs 0x13 > gs 0x1b > ss 0x28 > rax 0x12 > rcx 0x1 > rdx 0xffffffff811f6d0a > rbx 0xffffffff812e614c > rsp 0xfffffe0007fa15a0 > rbp 0xfffffe0007fa15b0 > rsi 0x80 > rdi 0xffffffff81e8cec0 cnputs_mtx > r8 0x10 > r9 0x1d0 > r10 0xffffffff81cfa820 vga_conssoftc > r11 0x10 > r12 0xffffffff812961ab > r13 0x28 > r14 0x100 > r15 0xfffffe000937a740 > rip 0xffffffff80c545a7 kdb_enter+0x37 > rflags 0x86 > kdb_enter+0x37: movq $0,0x1283a5e(%rip) > > Found a console log; the system was idle, right after a boot for a few > minutes. > It's a lab machine having booted off IPv4 (grml) but also having IPv6 on > the network. > > According to terminal backlogs it was an incoming IPv6 ssh session likely > to have triggered this. Always great if things are "idle" and only few > people > to ask. > > it is amd64; main @ 773e3a71b2f11d422694495aca988d4c7143601b from Jan 31st. > > /bz > > >> Drew >> >> On Tue, Feb 8, 2022 at 1:58 PM Bjoern A. Zeeb < >> bzeeb-lists@lists.zabbadoz.net> wrote: >> >>> Hi, >>> >>> I just came to a console finding this. The tree is from a few days ago; >>> is this known or should I investigate if it happens again? I sadly >>> cannot >>> dump on this machine. >>> >>> /bz >>> >>> db> show panic >>> panic: syncache: mbuf too small >>> db> where >>> Tracing pid 0 tid 100014 td 0xfffffe000937a740 >>> kdb_enter() at kdb_enter+0x37/frame 0xfffffe0007fa15b0 >>> vpanic() at vpanic+0x1b0/frame 0xfffffe0007fa1600 >>> panic() at panic+0x43/frame 0xfffffe0007fa1660 >>> syncache_respond() at syncache_respond+0x777/frame 0xfffffe0007fa1730 >>> syncache_add() at syncache_add+0xa71/frame 0xfffffe0007fa18c0 >>> tcp_input_with_port() at tcp_input_with_port+0x14f5/frame >>> 0xfffffe0007fa1a20 >>> tcp6_input_with_port() at tcp6_input_with_port+0x69/frame >>> 0xfffffe0007fa1a50 >>> tcp6_input() at tcp6_input+0xb/frame 0xfffffe0007fa1a60 >>> ip6_input() at ip6_input+0xc2f/frame 0xfffffe0007fa1b40 >>> netisr_dispatch_src() at netisr_dispatch_src+0xaf/frame 0xfffffe0007fa1ba0 >>> ether_demux() at ether_demux+0x16e/frame 0xfffffe0007fa1bd0 >>> ether_nh_input() at ether_nh_input+0x3fc/frame 0xfffffe0007fa1c30 >>> netisr_dispatch_src() at netisr_dispatch_src+0xaf/frame 0xfffffe0007fa1c90 >>> ether_input() at ether_input+0x99/frame 0xfffffe0007fa1cf0 >>> iflib_rxeof() at iflib_rxeof+0xcb3/frame 0xfffffe0007fa1e00 >>> _task_fn_rx() at _task_fn_rx+0x7a/frame 0xfffffe0007fa1e40 >>> gtaskqueue_run_locked() at gtaskqueue_run_locked+0xa7/frame >>> 0xfffffe0007fa1ec0 >>> gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0xc2/frame >>> 0xfffffe0007fa1ef0 >>> fork_exit() at fork_exit+0x80/frame 0xfffffe0007fa1f30 >>> fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0007fa1f30 >>> --- trap 0, rip = 0, rsp = 0, rbp = 0 --- >>> >>> >>> -- >>> Bjoern A. Zeeb r15:7 >>> >>> >> > > -- Bjoern A. Zeeb r15:7