panic: sbflush_locked on 5.4-p5/i386

[Alexander S. Usov]

Rong-En Fan wrote:

> hello,
> 
> I have a 5.4-p5 running on i386. Got a panic:
> panic: sbflush_locked: cc 0 || mb 0xc33bf000 || mbcnt 4294967040
> It is an web server running Apache and Postfix as a backup MX.
> I'm using gmirror on all partitions and thus cannot get a dump (swap
> is on gmirror). Some ddb outputs are below.

I got a few similar panics.
It looks that I managet to get rid of them by setting mpsafenet=0, but I am
not sure -- I have to monitor it for a bit longer.
I have managed to get a few dumps, so the traces are:

========================== N 1 =========================
#0  doadump () at pcpu.h:159
#1  0xc0513885 in boot (howto=260) at ../../../kern/kern_shutdown.c:410
#2  0xc0513eca in panic (fmt=0xc06ac866 "sbflush_locked: cc %u || mb %p ||
mbcnt %u")
    at ../../../kern/kern_shutdown.c:566
#3  0xc05559a6 in sbflush_locked (sb=0xc28400b8)
at ../../../kern/uipc_socket2.c:1119
#4  0xc05559ce in sbrelease_locked (sb=0xc28400b8, so=0x0)
at ../../../kern/uipc_socket2.c:564
#5  0xc05525eb in sofree (so=0xc2840000) at ../../../kern/uipc_socket.c:405
#6  0xc05a56e1 in in_pcbdetach (inp=0xc2312654)
at ../../../netinet/in_pcb.c:719
#7  0xc05b6284 in tcp_close (tp=0x0) at ../../../netinet/tcp_subr.c:783
#8  0xc05b2c13 in tcp_input (m=0xc1cff600, off0=-1625741474)
at ../../../netinet/tcp_input.c:2286
#9  0xc05a9aff in ip_input (m=0xc1cff600) at ../../../netinet/ip_input.c:776
#10 0xc059214a in netisr_processqueue (ni=0xc070b0d8)
at ../../../net/netisr.c:233
#11 0xc0592409 in swi_net (dummy=0x0) at ../../../net/netisr.c:346
#12 0xc04fb98d in ithread_loop (arg=0xc1979500)
at ../../../kern/kern_intr.c:547
#13 0xc04fa9c8 in fork_exit (callout=0xc04fb8d6 <ithread_loop>, arg=0x0,
frame=0x0)
    at ../../../kern/kern_fork.c:791
#14 0xc0656a7c in fork_trampoline () at ../../../i386/i386/exception.s:209
=============================================================

and

======================== N 2 ================================
#0  doadump () at pcpu.h:159
#1  0xc0513885 in boot (howto=260) at ../../../kern/kern_shutdown.c:410
#2  0xc0513eca in panic (fmt=0xc06989e7 "%s")
at ../../../kern/kern_shutdown.c:566
#3  0xc0667756 in trap_fatal (frame=0xe686fa60, eva=12)
at ../../../i386/i386/trap.c:817
#4  0xc06679e4 in trap_pfault (frame=0xe686fa60, usermode=0, eva=12)
    at ../../../i386/i386/trap.c:735
#5  0xc0667db3 in trap (frame=
      {tf_fs = -427425768, tf_es = -1067253744, tf_ds = -1044447216, tf_edi
= 16, tf_esi = 0, tf_ebp = -427361608, tf_isp = -427361652, tf_ebx = 40,
tf_edx = -1044393868, tf_ecx = 0, tf_eax = 0, tf_trapno = 12, tf_err = 0,
tf_eip = -1068176275, tf_cs = 8, tf_eflags = 66050, tf_esp = -1044409808,
tf_ss = -1044393868}) at ../../../i386/i386/trap.c:425
#6  0xc0656a1a in calltrap () at ../../../i386/i386/exception.s:140
#7  0xe6860018 in ?? ()
#8  0xc0630010 in zone_timeout (zone=0xc1bf9200)
at ../../../vm/uma_core.c:418
#9  0xc05b44ad in tcp_output (tp=0xc23b6534)
at ../../../netinet/tcp_output.c:811
#10 0xc05bc5ab in tcp_usr_send (so=0x0, flags=0, m=0xc1bf9200, nam=0x0,
control=0x0, td=0xc1e33a80)
    at ../../../netinet/tcp_usrreq.c:699
#11 0xc0550fb4 in sosend (so=0xc228d8dc, addr=0x0, uio=0xe686fc80,
top=0xc1bf9200, control=0x0,
    flags=0, td=0xc1e33a80) at ../../../kern/uipc_socket.c:835
#12 0xc053ed99 in soo_write (fp=0x0, uio=0xe686fc80, active_cred=0xc1fd9980,
flags=0,
    td=0xc1e33a80) at ../../../kern/sys_socket.c:118
#13 0xc0537c15 in dofilewrite (td=0xc1e33a80, fp=0xc1fd7110, fd=0, buf=0x0,
nbyte=56, offset=Unhandled dwarf expression opcode 0x93
)
    at file.h:245
#14 0xc0537ea8 in write (td=0xc1e33a80, uap=0xe686fd14)
at ../../../kern/sys_generic.c:282
#15 0xc06681fa in syscall (frame=
      {tf_fs = -1078001617, tf_es = 47, tf_ds = -1078001617, tf_edi =
138645504, tf_esi = 56, tf_ebp = -1077957448, tf_isp = -427360908, tf_ebx =
675435700, tf_edx = 0, tf_ecx = 0, tf_eax = 4, tf_trapno = 22, tf_err = 2,
tf_eip = 675424571, tf_cs = 31, tf_eflags = 646, tf_esp = -1077957476,
tf_ss = 47}) at ../../../i386/i386/trap.c:1009
#16 0xc0656a6f in Xint0x80_syscall () at ../../../i386/i386/exception.s:201
#17 0xbfbf002f in ?? ()
#18 0x0000002f in ?? ()
#19 0xbfbf002f in ?? ()
#20 0x08439000 in ?? ()
#21 0x00000038 in ?? ()
 ........... a bunch more of these ................
=============================================================



-- 
Best regards,
  Alexander.