got a panic on 5.4-STABLE

[Rong-En Fan]

On 8/28/05, Rong-En Fan <grafan at gmail.com> wrote:
> Hi,
> 
> I got a panic on an i386 5.4-STABLE around Aug 28 with SMP enabled.
> It has 2 physical CPU with HTT enabled (so, total 4 cpus).
> This is a NFS server only with external scsi raid attached.
> 
> The console log, kgdb output and sysctl.conf are as below.
> I'll keep this core and if someone is interested, I can send any other
> information requested.

I have the following in make.conf:
CPUTYPE?= p4
CFLAGS= -O -pipe
COPTFLAGS= -O -pipe

The difference between GENERIC and my kernel is here:
http://www.rafan.org/FreeBSD/panic/m_copym/kernel-diff-against-GENERIC.txt

And I also looked at the dump file, looks like that when calling
m_copym(), m->m_len is 20, off is 1500, m->m_next is NULL
After first iteration, m becomes NULL...

#20 0xc051d62f in m_copym (m=0x0, off0=1500, len=1480, wait=1)
    at /usr/src/sys/kern/uipc_mbuf.c:389
389                     m = m->m_next;
(kgdb) l
384             while (off > 0) {
385                     KASSERT(m != NULL, ("m_copym, offset > size of
mbuf chain"));
386                     if (off < m->m_len)
387                             break;
388                     off -= m->m_len;
389                     m = m->m_next;
390             }
391             np = &top;
392             top = 0;
393             while (len > 0) {
(kgdb) p off
$15 = 1480
(kgdb) up
#21 0xc0576835 in ip_fragment (ip=0xc20d8de4, m_frag=0xe7088b48,
mtu=-1039299264,
    if_hwassist_flags=6, sw_csum=1) at /usr/src/sys/netinet/ip_output.c:967
967                     m->m_next = m_copy(m0, off, len);
(kgdb) p off
$9 = 1500
(kgdb) p len
$10 = 1480
(kgdb) p m0
$11 = (struct mbuf *) 0xc20d8d00
(kgdb) p *m0
$12 = {m_hdr = {mh_next = 0x0, mh_nextpkt = 0x0, mh_data = 0xc20d8d40
"E", mh_len = 20,
    mh_flags = 2050, mh_type = 2}, M_dat = {MH = {MH_pkthdr = {rcvif =
0x0, len = 8348,
        header = 0xc5b25010, csum_flags = 0, csum_data = 6, tags =
{slh_first = 0x0}},
      MH_dat = {MH_ext = {
          ext_buf = 0xc33ae000 "oker</a>\nonline casinos <a
href=http://www.lucky-777-casinos.com>online casinos</a>\nviagra <a
href=http://www.ALL-VIAGRA.INFO>vip�", ext_free = 0,
          ext_args = 0x0, ext_size = 2048, ref_cnt = 0xdc050045,
ext_type = 549021963},
        MH_databuf =
"\000�:�\000\000\000\000\000\000\000\000\000\b\000\000E\000\005�\vi�
@\0                                                                   
                   
021��\214p\0360\214p\036\034@\021��\214p\0360\214p\036%\b\001\003
\000xU�mJ\207�\000\000\000\0                                          
                                           001", '\0' <repeats 23
times>, "\002\000\000\001�\000\000\000\002\000\000q�\000\000\001�\000\0
                                                                      
                
000\000\000\000\000\002\000\000\000\000\000\000\000\b\000\000\000\000\001\001\217\000\021\000\000\000\000\000\000\004\034\000\000\000\000\000\031\024�C\021m�\000\000\000\000B�[�\000\000\0
                                                                      
               
000\000B�[�\000\000\000\016\fo\2117\000\016\f^̺\b\000E\000\234
\vi\000\000@\021��\214p\0360\214                                      
                                                 4p\036\034\b\001\003�
\210N�"}},
    M_databuf = "\000\000\000\000\234
\000\000\020P��\000\000\000\000\006\000\000\000\000\000               
                                                                      
   0\000\000\000�:�\000\000\000\000\000\000\000\000\000\b\000\000E\000\005�\vi�
@\021��\214p\0360                                                     
                               
0\214p\036\034@\021��\214p\0360\214p\036%\b\001\003
\000xU�mJ\207�\000\000\000\001", '\0' <rep                            
                                                           peats 23
times>, "\002\000\000\001�\000\000\000\002\000\000q�\000\000\001�\000\000\000\000\000
                                                                      
                
0\000\002\000\000\000\000\000\000\000\b\000\000\000\000\001\001\217\000\021\000\000\000\000\000\000\004\034\000\000\000\000\000\031\024�C\021m�\000\000\000\000B�[�\000\000\000\000B�[�\000
                                                                      
              0\000\000\016\fo\2117\000\016\f^̺\b\000E\000\234
\vi\000\000@"...}}
(kgdb) l
962                             len = ip->ip_len - off;
963                             m->m_flags |= M_LASTFRAG;
964                     } else
965                             mhip->ip_off |= IP_MF;
966                     mhip->ip_len = htons((u_short)(len + mhlen));
967                     m->m_next = m_copy(m0, off, len);
968                     if (m->m_next == NULL) {        /* copy failed */
969                             m_free(m);
970                             error = ENOBUFS;        /* ??? */
971                             ipstat.ips_odropped++;
(kgdb) up
#22 0xc05764a6 in ip_output (m=0xc20d8d00, opt=0xc20d8de4,
ro=0xe7088b14, flags=0, imo=0x0,
    inp=0xc24317bc) at /usr/src/sys/netinet/ip_output.c:796
796             error = ip_fragment(ip, &m, ifp->if_mtu,
ifp->if_hwassist, sw_csum);
(kgdb) p ip
$16 = (struct ip *) 0xc20d8de4
(kgdb) p *ip
$19 = {ip_hl = 5, ip_v = 4, ip_tos = 0 '\0', ip_len = 8348, ip_id =
26891, ip_off = 0,
  ip_ttl = 64 '@', ip_p = 17 '\021', ip_sum = 54716, ip_src = {s_addr
= 807301260},
  ip_dst = {s_addr = 471756940}}

Thanks,
Rong-En fan