From owner-freebsd-current@freebsd.org Sun Jul 5 15:16:24 2015 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 46A6E9F6C for ; Sun, 5 Jul 2015 15:16:24 +0000 (UTC) (envelope-from rink@gloom.codethulu.net) Received: from anathema.codethulu.net (anathema.codethulu.net [IPv6:2001:610:60b:1::2]) by mx1.freebsd.org (Postfix) with ESMTP id E228A1233 for ; Sun, 5 Jul 2015 15:16:23 +0000 (UTC) (envelope-from rink@gloom.codethulu.net) Received: from anathema.codethulu.net (anathema.codethulu.net [37.247.37.64]) by anathema.codethulu.net (Postfix) with ESMTP id 70FCD3A17ABD for ; Sun, 5 Jul 2015 17:16:20 +0200 (CEST) X-Virus-Scanned: amavisd-new at codethulu.net Received: from anathema.codethulu.net ([37.247.37.64]) by anathema.codethulu.net (anathema.codehulu.net [37.247.37.64]) (amavisd-new, port 10024) with ESMTP id V1lETe3bm3H2 for ; Sun, 5 Jul 2015 15:16:19 +0000 (UTC) Received: from gloom.codethulu.net (anathema.codethulu.net [37.247.37.64]) by anathema.codethulu.net (Postfix) with ESMTPS id C61FC3A17AA6 for ; Sun, 5 Jul 2015 17:16:19 +0200 (CEST) Received: (from rink@localhost) by gloom.codethulu.net (8.14.9/8.14.9/Submit) id t65FGJ42085879 for freebsd-current@freebsd.org; Sun, 5 Jul 2015 17:16:19 +0200 (CEST) (envelope-from rink) Date: Sun, 5 Jul 2015 17:16:19 +0200 From: Rink Springer To: freebsd-current@freebsd.org Subject: panic: negative refcount after dhclient during boot Message-ID: <20150705151541.GC45822@rink.nu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2015 15:16:24 -0000 Hi all, On my FreeBSD/mips machine (it's a RouterStation Pro), I get the following panic during boot: FreeBSD is a registered trademark of The FreeBSD Foundation. FreeBSD 11.0-CURRENT #0 r285099: Sun Jul 5 12:31:47 CEST 2015 rink@greed.home.rink.nu:/home/rink/freebsd/obj/mips.mips/home/rink/freebsd/head/sys/FRINGE mips gcc version 4.2.1 20070831 patched [FreeBSD] [...] Starting devd. Additional inet routing options: gateway=YES. Starting dhclient. DHCPREQUEST on arge0 to 255.255.255.255 port 67 panic: negative refcount 0x8087ec24 KDB: enter: panic [ thread pid 11 tid 100027 ] Stopped at kdb_enter+0x4c: lui at,0x8066 db> r ? KDB: reentering KDB: stack backtrace: db_trace_thread+30 (?,?,?,?) ra cc72b51800000018 sp 0 sz 0 db_trace_self+1c (?,?,?,?) ra cc72b53000000018 sp 0 sz 0 80086f30+34 (?,?,?,?) ra cc72b548000001a0 sp 0 sz 0 kdb_backtrace+44 (?,?,?,?) ra cc72b6e800000018 sp 0 sz 0 kdb_reenter+3c (?,?,?,?) ra cc72b70000000018 sp 0 sz 0 db_error+30 (?,?,?,?) ra cc72b71800000018 sp 0 sz 0 db_run_cmd+28 (?,?,?,?) ra cc72b73000000018 sp 0 sz 0 80084204+388 (?,?,?,?) ra cc72b748000000a8 sp 0 sz 0 db_command_loop+70 (?,?,?,?) ra cc72b7f000000018 sp 0 sz 0 80086dc8+f4 (?,?,?,?) ra cc72b808000001a8 sp 0 sz 0 kdb_trap+110 (?,?,?,?) ra cc72b9b000000030 sp 0 sz 0 trap+cfc (?,?,?,?) ra cc72b9e0000000c8 sp 0 sz 0 MipsKernGenException+134 (0,4,80560720,12f) ra cc72baa8000000c8 sp 100000001 sz 1 kdb_enter+4c (?,?,?,?) ra cc72bb7000000018 sp 0 sz 0 vpanic+ec (?,?,?,?) ra cc72bb8800000020 sp 0 sz 0 kassert_panic+78 (?,8087ec24,80c7b470,0) ra cc72bba800000020 sp 1 sz 1 ifa_free+40 (?,?,?,?) ra cc72bbc800000018 sp 0 sz 0 ip_forward+838 (?,?,?,?) ra cc72bbe000000068 sp 0 sz 0 ip_input+ce4 (823baa00,?,?,?) ra cc72bc4800000038 sp 100000000 sz 0 netisr_dispatch_src+134 (?,?,?,?) ra cc72bc8000000040 sp 0 sz 0 netisr_dispatch+14 (?,?,?,?) ra cc72bcc000000018 sp 0 sz 0 ether_demux+254 (?,823baa00,?,?) ra cc72bcd800000028 sp 1 sz 0 80333ffc+530 (823baa00,?,?,?) ra cc72bd0000000030 sp 100000000 sz 0 netisr_dispatch_src+134 (?,?,?,?) ra cc72bd3000000040 sp 0 sz 0 netisr_dispatch+14 (?,?,?,?) ra cc72bd7000000018 sp 0 sz 0 80333b58+54 (?,?,?,?) ra cc72bd8800000020 sp 0 sz 0 804c7948+30c (?,?,?,?) ra cc72bda800000048 sp 0 sz 0 intr_event_execute_handlers+13c (?,?,?,?) ra cc72bdf000000028 sp 0 sz 0 80228a80+c8 (?,?,?,?) ra cc72be1800000040 sp 0 sz 0 fork_exit+b0 (?,?,?,?) ra cc72be5800000028 sp 0 sz 0 fork_trampoline+10 (?,?,?,?) ra cc72be8000000000 sp 0 sz 0 pid 11 db> This reproduces 100%. I'm at: FreeBSD 11.0-CURRENT #0 r285099: Sun Jul 5 12:31:47 CEST 2015 Let me know what I can do to help track this down; I only started getting the panic after 'gateway_enable=YES' in /etc/rc.conf The kernel has INVARIANTS but no WITNESS. Config available at http://rink.nu/tmp/FRINGE - boot log at http://rink.nu/tmp/fringe.txt Regards, Rink Springer