Killing processes from DDB

[Matt Burke]

Is it possible to forcibly kill process from DDB which are unkillable from
userland? My understanding is the 'kill' command is effectively the same as
the userland version, so perhaps a process could be terminated by invoking
an OOM handler or something?


I just had a VirtualBox instance crash and hog 100% CPU on my desktop:

mattb      36939 100.0 13.6 2577328 2276108 ??  I     6:13AM    2:28.44
/usr/local/lib/virtualbox/VirtualBox

I kill -9 it

mattb      36939 100.0 13.6 2577328 2275804 ??  T     6:13AM    3:10.89
/usr/local/lib/virtualbox/VirtualBox

Note it's moved to 'stop' state for some reason, yet is still eating 100%
cpu time

# procstat -k 36939
  PID    TID COMM             TDNAME           KSTACK
36939 227509 VirtualBox       -                <running>
36939 227836 VirtualBox       -                mi_switch
thread_suspend_switch thread_single exit1 sigexit postsig ast doreti_ast


Could this be the trigger - 9.0 binary (from pkgng) against 9.1?

$ procstat -b 1 36939
  PID COMM                OSREL PATH
    1 init               901000 /sbin/init
36939 VirtualBox         900044 /usr/local/lib/virtualbox/VirtualBox


I couldn't even kill it with "dtrace -n 'pid$target:::' -p 36939 -l" -
which so far has proven reliable in killing anything:

# dtrace -n 'pid$target:::' -p 2021 -l    <--- unimportant proc
Bus error: 10 (core dumped)
# dtrace -n 'pid$target:::' -p 2044 -l    <--- unimportant proc
Bus error: 10 (core dumped)
# dtrace -n 'pid$target:::' -p 36939 -l   <--- virtualbox hangs dtrace
^C

I couldn't truss the process or use gcore to get a dump, so my only option
was a reboot.  Does anyone have any suggestions on a course of action in
case this happens again? I can't get a kernel dump since the machine
doesn't have enough swap (small SSDs)

Thanks


-- 
The information contained in this message is confidential and intended for the addressee only. If you have received this message in error, or there are any problems with its content, please contact the sender. 

iCritical is a trading name of Critical Software Ltd. Registered in England: 04909220.
Registered Office: IC2, Keele Science Park, Keele, Staffordshire, ST5 5NH.

This message has been scanned for security threats by iCritical. www.icritical.com