Date: Fri, 15 Jun 2007 18:34:58 +0300 From: "Artem Naluzhny" <tut@nhamon.com.ua> To: current@freebsd.org, net@freebsd.org Subject: Re: "kernel: rtfree: 0xc3c4bd98 has 2 refs" on recent current Message-ID: <65dfa4fc0706150834k3766f42ao8a77b66cb44b48c7@mail.gmail.com> In-Reply-To: <65dfa4fc0706150750s266e8f37l868a2bc685bd6750@mail.gmail.com> References: <65dfa4fc0706141427q24f74f0kd82d20a9bb20e09b@mail.gmail.com> <65dfa4fc0706150730g29619f06h3b5ca07e382485a3@mail.gmail.com> <65dfa4fc0706150750s266e8f37l868a2bc685bd6750@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> Here is a backtrace:
>
> rtfree: 0xc3c5cca8 has 2 refs
> KDB: stack backtrace:
> db_trace_self_wrapper(c06b84de,e111dad4,c05d18f1,c06be1ff,c069bdd1,...)
at db_trace_self_wrapper+0x26
> kdb_backtrace(c06be1ff,c069bdd1,c3c5cca8,2,c3c5cca8,...) at kdb_backtrace+0x29
> rtfree(c3c5cca8,c3b3a010,10,c05d190b,c3c5cd98,...) at rtfree+0x51
> rtredirect(e111dba0,e111db90,0,6,e111db80,...) at rtredirect+0x1cf
> icmp_input(c3d14400,14,e111dbd8,0,c3c63e00,...) at icmp_input+0x50f
> ip_input(c3d14400,c05bd255,800,c39e5800,800,...) at ip_input+0x6ae
> netisr_dispatch(2,c3d14400,10,3,0,...) at
> netisr_dispatch+0x55
> ether_demux(c39e5800,c3d14400,3,0,3,...) at ether_demux+0x1aa
> ether_input(c39e5800,c3d14400,2,1,c396cc84,...) at ether_input+0x323
> bfe_intr(c39d1000,0,c06b4383,46b,0,...) at bfe_intr+0x41a
> ithread_loop(c39eb730,e111dd38,0,0,0,...) at ithread_loop+0x1ab
> fork_exit(c0511d70,c39eb730,e111dd38) at fork_exit+0x99
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0, eip = 0, esp = 0xe111dd70, ebp = 0 ---
>
>
> Here is an incoming ICMP packet (the last one) causing the "rtfree has
> 2 refs" message (00:19:b9:5a:a3:10 is my host):
>
> 17:47:46.915491 00:0c:29:b2:14:38 > 00:19:b9:5a:a3:10, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl 64, id 48899, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.25 > 192.168.0.55: ICMP redirect 192.168.0.1 to host 192.168.0.1, length 36
> (tos 0x0, ttl 16, id 0, offset 0, flags [none], proto: UDP (17), length: 328) 192.168.0.55.68 > 192.168.0.1.67: [|bootp]
> 0x0000: 4500 0038 bf03 0000 4001 3a21 c0a8 0019 E..8....@.:!....
> 0x0010: c0a8 0037 0501 48f7 c0a8 0001 4500 0148 ...7..H.....E..H
> 0x0020: 0000 0000 1011 281d c0a8 0037 c0a8 0001 ......(....7....
> 0x0030: 0044 0043 0134 efa2 .D.C.4..
> 17:47:46.942512 00:19:b9:5a:a3:10 > 00:50:bf:b1:34:a3, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl 64, id 207, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.55 > 192.168.0.1: ICMP 192.168.0.55 udp port 68 unreachable, length 36
> (tos 0x0, ttl 64, id 14203, offset 0, flags [none], proto: UDP (17), length: 334) 192.168.0.1.67 > 192.168.0.55.68: [|bootp]
> 0x0000: 4500 0038 00cf 0000 4001 f86d c0a8 0037 E..8....@..m...7
> 0x0010: c0a8 0001 0303 0dbe 0000 0000 4500 014e ............E..N
> 0x0020: 377b 0000 4011 c09b c0a8 0001 c0a8 0037 7{..@..........7
> 0x0030: 0043 0044 013a ed7d .C.D.:.}
> 17:47:46.942528 00:19:b9:5a:a3:10 > 00:50:bf:b1:34:a3, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl 64, id 208, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.55 > 192.168.0.1: ICMP 192.168.0.55 udp port 68 unreachable, length 36
> (tos 0x0, ttl 64, id 14204, offset 0, flags [none], proto: UDP (17), length: 334) 192.168.0.1.67 > 192.168.0.55.68: [|bootp]
> 0x0000: 4500 0038 00d0 0000 4001 f86c c0a8 0037 E..8....@..l...7
> 0x0010: c0a8 0001 0303 0dbe 0000 0000 4500 014e ............E..N
> 0x0020: 377c 0000 4011 c09a c0a8 0001 c0a8 0037 7|..@..........7
> 0x0030: 0043 0044 013a ed7d .C.D.:.}
The behavior was introduced by following commit:
glebius 2007-05-22 16:17:32 UTC
FreeBSD src repository
Modified files:
sys/net route.c
Log:
Some minor cleanups:
- In rt_check() remove the senderr() macro and the "bad" label. They
used to simplify code, but now aren't.
- Remove extra RT_LOCK_ASSERT() in rt_setgate(). The RT_REMREF macro
does this.
- In rtfree() convert panics to KASSERTs.
- Strict the routing API: rtfree() should be called only in a case
when we are completely sure we've got the last reference on the
rtentry. In all other cases RTFREE_LOCKED() macro should be used.
If the reference isn't the last one spit out a warning printf.
Correct the only(?) case for this in rt_check().
- Fix typos in comments.
Revision Changes Path
1.119 +15 -22 src/sys/net/route.c
--
/tut
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?65dfa4fc0706150834k3766f42ao8a77b66cb44b48c7>