[Bug 213903] Kernel crashes from turnstile_broadcast (/usr/src/sys/kern/subr_turnstile.c:837)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213903

Mark Millard <markmi at dsl-only.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markmi at dsl-only.net

--- Comment #55 from Mark Millard <markmi at dsl-only.net> ---
(In reply to muxx.dev from comment #54)\

Looks  to me like ts==0x0 was the starting value
given to turnstile_broadcast in each backtrace
listed in this buzilla bug (213903), for example:

(kgdb) list *0xffffffff80b3a89c
0xffffffff80b3a89c is in turnstile_broadcast
(/usr/src/sys/kern/subr_turnstile.c:837).
832
833             /*
834              * Transfer the blocked list to the pending list.
835              */
836             mtx_lock_spin(&td_contested_lock);
837             TAILQ_CONCAT(&ts->ts_pending, &ts->ts_blocked[queue],
td_lockq);
838             mtx_unlock_spin(&td_contested_lock);
839
840             /*
841              * Give a turnstile to each thread.  The last thread gets
Current language:  auto; currently minimal
(kgdb) backtrace
. . .
#8  0xffffffff80b3a89c in turnstile_broadcast (ts=0x0, queue=1) at
/usr/src/sys/kern/subr_turnstile.c:837
#9  0xffffffff80ad48cf in __rw_wunlock_hard (c=0xfffff800437de858, tid=<value
optimized out>, file=<value optimized out>, line=<value optimized out>) at
/usr/src/sys/kern/kern_rwlock.c:1027
. . .

Note that ts==0x0 would be a problem for:

TAILQ_CONCAT(&ts->ts_pending, &ts->ts_blocked[queue], td_lockq);

So I wonder if __rw_wunlock_hard is providing a bad ts
value. If yes: the problem then occurs before the
turnstile_broadcast call is made.

-- 
You are receiving this mail because:
You are on the CC list for the bug.