[Bug 213903] Kernel crashes from turnstile_broadcast (/usr/src/sys/kern/subr_turnstile.c:837)

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
Report Content as Inappropriate

[Bug 213903] Kernel crashes from turnstile_broadcast (/usr/src/sys/kern/subr_turnstile.c:837)


Mark Millard <[hidden email]> changed:

           What    |Removed                     |Added
                 CC|                            |[hidden email]

--- Comment #55 from Mark Millard <[hidden email]> ---
(In reply to muxx.dev from comment #54)\

Looks  to me like ts==0x0 was the starting value
given to turnstile_broadcast in each backtrace
listed in this buzilla bug (213903), for example:

(kgdb) list *0xffffffff80b3a89c
0xffffffff80b3a89c is in turnstile_broadcast
833             /*
834              * Transfer the blocked list to the pending list.
835              */
836             mtx_lock_spin(&td_contested_lock);
837             TAILQ_CONCAT(&ts->ts_pending, &ts->ts_blocked[queue],
838             mtx_unlock_spin(&td_contested_lock);
840             /*
841              * Give a turnstile to each thread.  The last thread gets
Current language:  auto; currently minimal
(kgdb) backtrace
. . .
#8  0xffffffff80b3a89c in turnstile_broadcast (ts=0x0, queue=1) at
#9  0xffffffff80ad48cf in __rw_wunlock_hard (c=0xfffff800437de858, tid=<value
optimized out>, file=<value optimized out>, line=<value optimized out>) at
. . .

Note that ts==0x0 would be a problem for:

TAILQ_CONCAT(&ts->ts_pending, &ts->ts_blocked[queue], td_lockq);

So I wonder if __rw_wunlock_hard is providing a bad ts
value. If yes: the problem then occurs before the
turnstile_broadcast call is made.

You are receiving this mail because:
You are on the CC list for the bug.
[hidden email] mailing list
To unsubscribe, send any mail to "[hidden email]"