From owner-freebsd-bugs@freebsd.org Mon Jul 6 07:20:02 2015 Return-Path: Delivered-To: freebsd-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3E90E9938FA for ; Mon, 6 Jul 2015 07:20:02 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 2B08E159C for ; Mon, 6 Jul 2015 07:20:02 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t667K2XJ096813 for ; Mon, 6 Jul 2015 07:20:02 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 201371] panic: negative refcount after dhclient during boot Date: Mon, 06 Jul 2015 07:20:02 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 11.0-CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: rink@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 07:20:02 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=201371 Bug ID: 201371 Summary: panic: negative refcount after dhclient during boot Product: Base System Version: 11.0-CURRENT Hardware: mips OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: rink@FreeBSD.org Created attachment 158407 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=158407&action=edit Boot log FreeBSD/mips on a RouterStation Pro panics shortly after reboot: FreeBSD is a registered trademark of The FreeBSD Foundation. FreeBSD 11.0-CURRENT #0 r285099: Sun Jul 5 12:31:47 CEST 2015 rink@greed.home.rink.nu:/home/rink/freebsd/obj/mips.mips/home/rink/freebsd/head/sys/FRINGE mips gcc version 4.2.1 20070831 patched [FreeBSD] [...] Starting devd. Additional inet routing options: gateway=YES. Starting dhclient. DHCPREQUEST on arge0 to 255.255.255.255 port 67 panic: negative refcount 0x8087ec24 KDB: enter: panic [ thread pid 11 tid 100027 ] Stopped at kdb_enter+0x4c: lui at,0x8066 db> r ? KDB: reentering KDB: stack backtrace: db_trace_thread+30 (?,?,?,?) ra cc72b51800000018 sp 0 sz 0 db_trace_self+1c (?,?,?,?) ra cc72b53000000018 sp 0 sz 0 80086f30+34 (?,?,?,?) ra cc72b548000001a0 sp 0 sz 0 kdb_backtrace+44 (?,?,?,?) ra cc72b6e800000018 sp 0 sz 0 kdb_reenter+3c (?,?,?,?) ra cc72b70000000018 sp 0 sz 0 db_error+30 (?,?,?,?) ra cc72b71800000018 sp 0 sz 0 db_run_cmd+28 (?,?,?,?) ra cc72b73000000018 sp 0 sz 0 80084204+388 (?,?,?,?) ra cc72b748000000a8 sp 0 sz 0 db_command_loop+70 (?,?,?,?) ra cc72b7f000000018 sp 0 sz 0 80086dc8+f4 (?,?,?,?) ra cc72b808000001a8 sp 0 sz 0 kdb_trap+110 (?,?,?,?) ra cc72b9b000000030 sp 0 sz 0 trap+cfc (?,?,?,?) ra cc72b9e0000000c8 sp 0 sz 0 MipsKernGenException+134 (0,4,80560720,12f) ra cc72baa8000000c8 sp 100000001 sz 1 kdb_enter+4c (?,?,?,?) ra cc72bb7000000018 sp 0 sz 0 vpanic+ec (?,?,?,?) ra cc72bb8800000020 sp 0 sz 0 kassert_panic+78 (?,8087ec24,80c7b470,0) ra cc72bba800000020 sp 1 sz 1 ifa_free+40 (?,?,?,?) ra cc72bbc800000018 sp 0 sz 0 ip_forward+838 (?,?,?,?) ra cc72bbe000000068 sp 0 sz 0 ip_input+ce4 (823baa00,?,?,?) ra cc72bc4800000038 sp 100000000 sz 0 netisr_dispatch_src+134 (?,?,?,?) ra cc72bc8000000040 sp 0 sz 0 netisr_dispatch+14 (?,?,?,?) ra cc72bcc000000018 sp 0 sz 0 ether_demux+254 (?,823baa00,?,?) ra cc72bcd800000028 sp 1 sz 0 80333ffc+530 (823baa00,?,?,?) ra cc72bd0000000030 sp 100000000 sz 0 netisr_dispatch_src+134 (?,?,?,?) ra cc72bd3000000040 sp 0 sz 0 netisr_dispatch+14 (?,?,?,?) ra cc72bd7000000018 sp 0 sz 0 80333b58+54 (?,?,?,?) ra cc72bd8800000020 sp 0 sz 0 804c7948+30c (?,?,?,?) ra cc72bda800000048 sp 0 sz 0 intr_event_execute_handlers+13c (?,?,?,?) ra cc72bdf000000028 sp 0 sz 0 80228a80+c8 (?,?,?,?) ra cc72be1800000040 sp 0 sz 0 fork_exit+b0 (?,?,?,?) ra cc72be5800000028 sp 0 sz 0 fork_trampoline+10 (?,?,?,?) ra cc72be8000000000 sp 0 sz 0 pid 11 db> Reproduces 100%. I only started getting the panic after 'gateway_enable=YES' in /etc/rc.conf -- You are receiving this mail because: You are the assignee for the bug.