https://bugs.dragonflybsd.org/https://bugs.dragonflybsd.org/favicon.ico?16293952082012-08-10T09:34:17ZDragonFlyBSD bugtrackerDragonFlyBSD - Bug #2399: DFBSD v3.1.0.1249.ge27e67 - Panic on lwkt_reltoken from vm_mmaphttps://bugs.dragonflybsd.org/issues/2399?journal_id=108932012-08-10T09:34:17Ztuxillo
<ul><li><strong>Status</strong> changed from <i>New</i> to <i>In Progress</i></li><li><strong>Priority</strong> changed from <i>Normal</i> to <i>High</i></li></ul><p>Grab.</p>
<p>No progress is being made as of yet, but work is ongoing. Trying to KTR acquire/releases as per Matt's advises.</p> DragonFlyBSD - Bug #2399: DFBSD v3.1.0.1249.ge27e67 - Panic on lwkt_reltoken from vm_mmaphttps://bugs.dragonflybsd.org/issues/2399?journal_id=108972012-08-13T13:56:30Zvsrinivasvsrinivas@ops101.org
<ul></ul><p>Per the dump, the thread calling mmap() holds the MP token twice, the tty token, a vmobj token, the vm_token, and three other vmobj tokens. From the code paths, this is not possible; kern_mmap already takes the vm_map's private token, along with vm_mmap. There were no paths taking the mp_token here, and even if so, it should definitely have been released by that point.</p> DragonFlyBSD - Bug #2399: DFBSD v3.1.0.1249.ge27e67 - Panic on lwkt_reltoken from vm_mmaphttps://bugs.dragonflybsd.org/issues/2399?journal_id=108992012-08-13T16:37:52Zdillon
<ul></ul><p>:Issue <a class="issue tracker-1 status-5 priority-5 priority-high3 closed" title="Bug: DFBSD v3.1.0.1249.ge27e67 - Panic on lwkt_reltoken from vm_mmap (Closed)" href="https://bugs.dragonflybsd.org/issues/2399">#2399</a> has been updated by Venkatesh Srinivas.<br />:<br />:Per the dump, the thread calling mmap() holds the MP token twice, the tty token, a vmobj token, the vm_token, and three other vmobj tokens. From the code paths, this is not possible; kern_mmap already takes the vm_map's private token, along with vm_mmap. There were no paths taking the mp_token here, and even if so, it should definitely have been released by that point. <br />:----------------------------------------<br />:Bug <a class="issue tracker-1 status-5 priority-5 priority-high3 closed" title="Bug: DFBSD v3.1.0.1249.ge27e67 - Panic on lwkt_reltoken from vm_mmap (Closed)" href="https://bugs.dragonflybsd.org/issues/2399">#2399</a>: DFBSD v3.1.0.1249.ge27e67 - Panic on lwkt_reltoken from vm_mmap<br />:http://bugs.dragonflybsd.org/issues/2399</p>
<pre><code>Looking at the token array for the thread that crashed the system<br /> won't help you, you'll just get the tokens that were held by the panic<br /> code as it dumped.</code></pre>
<pre><code>The panic code copies the thread's token array to a global array,<br /> take a look at that:</code></pre>
<pre><code>struct lwkt_tokref panic_tokens[LWKT_MAXTOKENS];<br /> int panic_tokens_count;</code></pre>
<pre><code>-Matt</code></pre> DragonFlyBSD - Bug #2399: DFBSD v3.1.0.1249.ge27e67 - Panic on lwkt_reltoken from vm_mmaphttps://bugs.dragonflybsd.org/issues/2399?journal_id=109182012-08-16T17:49:12Zdillon
<ul><li><strong>Status</strong> changed from <i>In Progress</i> to <i>Closed</i></li></ul><p>Antonio's token debugging finally narrowed it down and we found and fixed the sucker. Turned out to be an error path in vm_map_find().</p>