[Bug 296474] [rack][[panic] recovery_rxt_cnt would go negative

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296474

            Bug ID: 296474
           Summary: [rack][[panic] recovery_rxt_cnt would go negative
           Product: Base System
           Version: 16.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]

panic while bulk building in poudriere

Backtrace
---------
Tracing pid 0 tid 100265 td 0xffff000312c70640
db_trace_self() at db_trace_self
db_stack_trace() at db_stack_trace+0xf8
db_command() at db_command+0x390
db_command_loop() at db_command_loop+0x58
db_trap() at db_trap+0x10c
kdb_trap() at kdb_trap+0x364
handle_el1h_sync() at handle_el1h_sync+0x18
--- exception, esr 0xf2000000
kdb_enter() at kdb_enter+0x48
vpanic() at vpanic+0x208
panic() at panic+0x48
rack_proc_sack_blk() at rack_proc_sack_blk+0x1450
handle_el1h_sync() at handle_el1h_sync+0x18
--- exception, esr 0xf2000000
kdb_enter() at kdb_enter+0x48
vpanic() at vpanic+0x208
panic() at panic+0x48
rack_proc_sack_blk() at rack_proc_sack_blk+0x1450
rack_log_ack() at rack_log_ack+0x624
rack_process_ack() at rack_process_ack+0x30c
rack_do_established() at rack_do_established+0xaac
rack_do_segment_nounlock() at rack_do_segment_nounlock+0x1cdc
rack_do_segment() at rack_do_segment+0x114
tcp_input_with_port() at tcp_input_with_port+0x1020
tcp_input() at tcp_input+0x10
ip_input() at ip_input+0x370
netisr_dispatch_src() at netisr_dispatch_src+0xec
ether_demux() at ether_demux+0x180
ether_nh_input() at ether_nh_input+0x394
netisr_dispatch_src() at netisr_dispatch_src+0xec
ether_input() at ether_input+0xe8
iflib_rxeof() at iflib_rxeof+0x800
_task_fn_rx() at _task_fn_rx+0xb4
gtaskqueue_run_locked() at gtaskqueue_run_locked+0x170
gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0xc0
fork_exit() at fork_exit+0x80
fork_trampoline() at fork_trampoline+0x18

Registers at kdb_enter
----------------------
spsr                0x60400009
x0                        0x12
x1          0xffff00031332c078
x2          0xffff000000b3d23e
x3                       0x248
x4                         0xf
x5                        0x10
x6          0xffff007fffe2a000
x7                       0x254
x8          0x915746f4baa89085
x9          0x915746f4baa89085
x10                    0x12800
x11                        0xf
x12                          0
x13                        0x4
x14                      0x200
x15                        0x1
x16                       0x80
x17                      0x220
x18         0xffff000047f60000
x19         0xffff00000113b000  epoch_array+0x1f00
x20                          0
x21         0xffff000312c70640
x22                        0x1
x23                          0
x24                 0x721c9922
x25                 0x1a8cf0b2
x26         0xffffa800e7321a80
x27                 0x1a8cf2be
x28         0xffffa800e7321aa8
x29         0xffff00031332c200
lr          0xffff0000005588f0  kdb_enter+0x44
elr         0xffff0000005588f4  kdb_enter+0x48
sp          0xffff00031332c200

Function: rack_check_reorder_ack() [inlined into rack_proc_sack_blk()]
Line: 9203-9204

    KASSERT((rack->r_ctl.recovery_rxt_cnt >= (the_end - rsm->r_start)),
        ("rsm:%p rack:%p recovery_rxt_cnt would go negative "
         "recovery_rxt_cnt:%u sub:%u",
         rsm, rack, rack->r_ctl.recovery_rxt_cnt,
         (the_end - rsm->r_start)));

Values at time of panic:
    rack->r_ctl.recovery_rxt_cnt = 0
    the_end - rsm->r_start       = 524

-- 
You are receiving this mail because:
You are the assignee for the bug.