site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Adi (ADC Ref Library Xcode 2.5) ... ifnet_output_raw will always free the packet chain. (ADC Ref Library Xcode 3.0+; SDK10.5 & SDK 10.6; kpi_interface.h) ... ifnet_output_raw will always free the packet chain. Any ideas/suggestions will be highly appreciated. Alexander _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/adi%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com On Jun 17, 2009, at 9:12 PM, Alexander Klyuev wrote: panic(cpu 1 caller 0xffffff800024c91c): assertion failed: m->m_type == MT_FREE && m->m_flags == M_EXT, file: /SourceCache/xnu/xnu-1456/ bsd/kern/uipc_mbuf.c, line: 3271. This means that there was some sort of use-after-free error. If you add "mbuf_debug=0x3" to your boot-args, you should typically catch the panic earlier on when something tries to access the mbuf that's already freed (due to page fault). With mbuf debugging enabled, you will be able to know where the free actually happened, and it will give you a better lead towards root causing the issue. I use mbufs of both kinds: <packet> and <header> i.e. with/without external cluster and I definitely have problems with mbufs with external cluster. I've read all the versions of documentation on ifnet_output_raw(). Here are some of them: (SDK10.4u; kpi_interface.h) ... ifnet_output_raw will free the packet chain in the event of an error. Some old versions conflicted with newer ones regarding mbuf ownership and I've assumed "ifnet_output_raw will always free the packet chain." statement is correct. However I'm a bit stuck with 64-bit kernel. Whatever I do with mbufs with ext cluster, I get kernel panics like mentioned above and similar when I call mbuf_getpacket(), ifnet_output_raw() functions. I'm also having unexpected panics with similar reason description when mbuf cache audit is performed by kernel. Nothing of mentioned above happens on 32-bit kernel. BTW, when I manipulate mbufs with no ext cluster, everything works correctly on 64-bit kernel as expected. Does anybody knows what's the reason of such 64-bit kernel behaviour regarding mbufs with external cluster or I'm just missing something? This email sent to adi@apple.com smime.p7s