From owner-freebsd-net@FreeBSD.ORG  Thu Apr 12 08:47:28 2007
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id A829A16A405;
	Thu, 12 Apr 2007 08:47:28 +0000 (UTC)
	(envelope-from thompsa@freebsd.org)
Received: from heff.fud.org.nz (203-109-251-39.static.bliink.ihug.co.nz
	[203.109.251.39])
	by mx1.freebsd.org (Postfix) with ESMTP id 4C03C13C4B9;
	Thu, 12 Apr 2007 08:47:28 +0000 (UTC)
	(envelope-from thompsa@freebsd.org)
Received: by heff.fud.org.nz (Postfix, from userid 1001)
	id 262721CC5A; Thu, 12 Apr 2007 20:47:27 +1200 (NZST)
Date: Thu, 12 Apr 2007 20:47:27 +1200
From: Andrew Thompson <thompsa@freebsd.org>
To: "Bruce M. Simpson" <bms@FreeBSD.org>
Message-ID: <20070412084727.GH9390@heff.fud.org.nz>
References: <20070412010707.GC9390@heff.fud.org.nz>
	<461DF140.2020203@FreeBSD.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <461DF140.2020203@FreeBSD.org>
User-Agent: Mutt/1.5.13 (2006-08-11)
Cc: freebsd-net@freebsd.org
Subject: Re: ipv6 multicast refcnt panic
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 12 Apr 2007 08:47:28 -0000

On Thu, Apr 12, 2007 at 09:43:44AM +0100, Bruce M. Simpson wrote:
> Andrew Thompson wrote:
> >I have come across this panic which appears to be from incorrect
> >refcounting on the inet6 multicast code.
> >  
> I'm assuming this is in -CURRENT, as the refcount code has not yet been 
> MFCed.
 
Yes sorry, a fresh current kernel.
 
> >in6m_refcount is still 1 so the in6_multi is not freed.
> 
> I'll try to investigate further as time permits. Thanks for pointing 
> this out, I suspect the same problem affects vlan and other nested cloners.

Cool. Its 100% reproducible for me so hopefully you will be able to
trigger the panic too.


Andrew