From owner-freebsd-net@FreeBSD.ORG Fri Jun 15 16:04:16 2007 Return-Path: X-Original-To: net@freebsd.org Delivered-To: freebsd-net@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 3315A16A46F for ; Fri, 15 Jun 2007 16:04:16 +0000 (UTC) (envelope-from tutatnhamon@gmail.com) Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.178]) by mx1.freebsd.org (Postfix) with ESMTP id C98A813C489 for ; Fri, 15 Jun 2007 16:04:15 +0000 (UTC) (envelope-from tutatnhamon@gmail.com) Received: by py-out-1112.google.com with SMTP id a29so1695240pyi for ; Fri, 15 Jun 2007 09:04:15 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=eRy4TwbAcKTuq081ZoGENn9yeIxtsPzi4pyEv6upYlgnC/2sNCUbpapmN3NvhIYtGiGozbDf2zRGAQRmFhJ7fp0k+O5whYaCBDKqLovQntI6K5MTb1X9ix884SNiaUbPXUE8lMJ8AVRJ0Rxmmy5TyikeQ42h2fVbSZMSDauVQFg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=IeCzpAHbrKEkkoRQcYkSV6zJx6S57JXDYsgcsuk0dWntOx3FhmHpunZhCiNxvcyXpRy7YhynnX1XNqYSjUc4eaFAPdXadP7L7Wgp/OsAmtpMRozXXhyaOu070MwMWWZsKQ9JjagKhvAPOJC/2zU1q2SoWSLq9m0NNj7OGlTvIPM= Received: by 10.64.151.17 with SMTP id y17mr5390351qbd.1181921698250; Fri, 15 Jun 2007 08:34:58 -0700 (PDT) Received: by 10.65.180.5 with HTTP; Fri, 15 Jun 2007 08:34:58 -0700 (PDT) Message-ID: <65dfa4fc0706150834k3766f42ao8a77b66cb44b48c7@mail.gmail.com> Date: Fri, 15 Jun 2007 18:34:58 +0300 From: "Artem Naluzhny" Sender: tutatnhamon@gmail.com To: current@freebsd.org, net@freebsd.org In-Reply-To: <65dfa4fc0706150750s266e8f37l868a2bc685bd6750@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <65dfa4fc0706141427q24f74f0kd82d20a9bb20e09b@mail.gmail.com> <65dfa4fc0706150730g29619f06h3b5ca07e382485a3@mail.gmail.com> <65dfa4fc0706150750s266e8f37l868a2bc685bd6750@mail.gmail.com> X-Google-Sender-Auth: d4db3488398d3d01 Cc: Subject: Re: "kernel: rtfree: 0xc3c4bd98 has 2 refs" on recent current X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2007 16:04:16 -0000 > Here is a backtrace: > > rtfree: 0xc3c5cca8 has 2 refs > KDB: stack backtrace: > db_trace_self_wrapper(c06b84de,e111dad4,c05d18f1,c06be1ff,c069bdd1,...) at db_trace_self_wrapper+0x26 > kdb_backtrace(c06be1ff,c069bdd1,c3c5cca8,2,c3c5cca8,...) at kdb_backtrace+0x29 > rtfree(c3c5cca8,c3b3a010,10,c05d190b,c3c5cd98,...) at rtfree+0x51 > rtredirect(e111dba0,e111db90,0,6,e111db80,...) at rtredirect+0x1cf > icmp_input(c3d14400,14,e111dbd8,0,c3c63e00,...) at icmp_input+0x50f > ip_input(c3d14400,c05bd255,800,c39e5800,800,...) at ip_input+0x6ae > netisr_dispatch(2,c3d14400,10,3,0,...) at > netisr_dispatch+0x55 > ether_demux(c39e5800,c3d14400,3,0,3,...) at ether_demux+0x1aa > ether_input(c39e5800,c3d14400,2,1,c396cc84,...) at ether_input+0x323 > bfe_intr(c39d1000,0,c06b4383,46b,0,...) at bfe_intr+0x41a > ithread_loop(c39eb730,e111dd38,0,0,0,...) at ithread_loop+0x1ab > fork_exit(c0511d70,c39eb730,e111dd38) at fork_exit+0x99 > fork_trampoline() at fork_trampoline+0x8 > --- trap 0, eip = 0, esp = 0xe111dd70, ebp = 0 --- > > > Here is an incoming ICMP packet (the last one) causing the "rtfree has > 2 refs" message (00:19:b9:5a:a3:10 is my host): > > 17:47:46.915491 00:0c:29:b2:14:38 > 00:19:b9:5a:a3:10, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl 64, id 48899, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.25 > 192.168.0.55: ICMP redirect 192.168.0.1 to host 192.168.0.1, length 36 > (tos 0x0, ttl 16, id 0, offset 0, flags [none], proto: UDP (17), length: 328) 192.168.0.55.68 > 192.168.0.1.67: [|bootp] > 0x0000: 4500 0038 bf03 0000 4001 3a21 c0a8 0019 E..8....@.:!.... > 0x0010: c0a8 0037 0501 48f7 c0a8 0001 4500 0148 ...7..H.....E..H > 0x0020: 0000 0000 1011 281d c0a8 0037 c0a8 0001 ......(....7.... > 0x0030: 0044 0043 0134 efa2 .D.C.4.. > 17:47:46.942512 00:19:b9:5a:a3:10 > 00:50:bf:b1:34:a3, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl 64, id 207, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.55 > 192.168.0.1: ICMP 192.168.0.55 udp port 68 unreachable, length 36 > (tos 0x0, ttl 64, id 14203, offset 0, flags [none], proto: UDP (17), length: 334) 192.168.0.1.67 > 192.168.0.55.68: [|bootp] > 0x0000: 4500 0038 00cf 0000 4001 f86d c0a8 0037 E..8....@..m...7 > 0x0010: c0a8 0001 0303 0dbe 0000 0000 4500 014e ............E..N > 0x0020: 377b 0000 4011 c09b c0a8 0001 c0a8 0037 7{..@..........7 > 0x0030: 0043 0044 013a ed7d .C.D.:.} > 17:47:46.942528 00:19:b9:5a:a3:10 > 00:50:bf:b1:34:a3, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl 64, id 208, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.55 > 192.168.0.1: ICMP 192.168.0.55 udp port 68 unreachable, length 36 > (tos 0x0, ttl 64, id 14204, offset 0, flags [none], proto: UDP (17), length: 334) 192.168.0.1.67 > 192.168.0.55.68: [|bootp] > 0x0000: 4500 0038 00d0 0000 4001 f86c c0a8 0037 E..8....@..l...7 > 0x0010: c0a8 0001 0303 0dbe 0000 0000 4500 014e ............E..N > 0x0020: 377c 0000 4011 c09a c0a8 0001 c0a8 0037 7|..@..........7 > 0x0030: 0043 0044 013a ed7d .C.D.:.} The behavior was introduced by following commit: glebius 2007-05-22 16:17:32 UTC FreeBSD src repository Modified files: sys/net route.c Log: Some minor cleanups: - In rt_check() remove the senderr() macro and the "bad" label. They used to simplify code, but now aren't. - Remove extra RT_LOCK_ASSERT() in rt_setgate(). The RT_REMREF macro does this. - In rtfree() convert panics to KASSERTs. - Strict the routing API: rtfree() should be called only in a case when we are completely sure we've got the last reference on the rtentry. In all other cases RTFREE_LOCKED() macro should be used. If the reference isn't the last one spit out a warning printf. Correct the only(?) case for this in rt_check(). - Fix typos in comments. Revision Changes Path 1.119 +15 -22 src/sys/net/route.c -- /tut