From owner-freebsd-net@FreeBSD.ORG  Wed Sep 28 15:51:47 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: net@FreeBSD.org
Delivered-To: freebsd-net@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2E5DA16A458
	for <net@FreeBSD.org>; Wed, 28 Sep 2005 15:51:47 +0000 (GMT)
	(envelope-from andre@freebsd.org)
Received: from c00l3r.networx.ch (c00l3r.networx.ch [62.48.2.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 296A543D5F
	for <net@FreeBSD.org>; Wed, 28 Sep 2005 15:51:43 +0000 (GMT)
	(envelope-from andre@freebsd.org)
Received: (qmail 82104 invoked from network); 28 Sep 2005 15:24:24 -0000
Received: from unknown (HELO freebsd.org) ([62.48.0.53])
	(envelope-sender <andre@freebsd.org>)
	by c00l3r.networx.ch (qmail-ldap-1.03) with SMTP
	for <kris@obsecurity.org>; 28 Sep 2005 15:24:24 -0000
Message-ID: <433ABC12.948DA54D@freebsd.org>
Date: Wed, 28 Sep 2005 17:51:46 +0200
From: Andre Oppermann <andre@freebsd.org>
X-Mailer: Mozilla 4.8 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Kris Kennaway <kris@obsecurity.org>
References: <20050927222634.GA46375@xor.obsecurity.org>
	<x7psqtzyad.wl%suz@alaxala.net>
	<20050928151319.GA27347@xor.obsecurity.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: SUZUKI Shinsuke <suz@kame.net>, net@FreeBSD.org
Subject: Re: ipv6 panic in 6.0 ([kris@FreeBSD.org: kern/85780: 'panic:bogus	
 refcnt 0' in routing/ipv6])
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Sep 2005 15:51:47 -0000

Kris Kennaway wrote:
> 
> On Wed, Sep 28, 2005 at 12:06:18PM +0900, SUZUKI Shinsuke wrote:
> > Hello kris,
> >
> > >>>>> On Tue, 27 Sep 2005 18:26:34 -0400
> > >>>>> kris@obsecurity.org(Kris Kennaway)  said:
> >
> > > Can someone please look into this ipv6 panic?  It is now my #1 panic
> > > on 6.0 (every few days, and I hardly make any use of ipv6 except for
> > > light nfs and tcp traffic), so it would be good to get it fixed before
> > > the release.
> >
> > Let me confirm one thing.
> > Did you also see a message "panic: bogus refcnt 0", in your panic?
> 
> Yes, that's the panic string.
> 
> > As far as I investigated, only IF_CLONE_REMREF_LOCKED() can display
> > this message.  But it's called only in
> > if_clone_create/detach/destory(), and none of them seems to be called
> > according to the description in the PR.  (rtexpunge() in route.c also
> > has this message, but it is commented out by "if 0", so it is not the
> > cause of this message)
> 
> I have a number of (sparc64) cores for this panic if you'd like to see
> them.

This particular panic string is used by RT_REMREF() via RTFREE_LOCKED()
too.  It could be triggered anywhere in the routing/network code.

-- 
Andre