From owner-freebsd-net@FreeBSD.ORG Wed Jul 18 06:56:17 2012 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E3408106566C for ; Wed, 18 Jul 2012 06:56:17 +0000 (UTC) (envelope-from andrey@zonov.org) Received: from mail-lb0-f182.google.com (mail-lb0-f182.google.com [209.85.217.182]) by mx1.freebsd.org (Postfix) with ESMTP id 6023A8FC12 for ; Wed, 18 Jul 2012 06:56:17 +0000 (UTC) Received: by lbon10 with SMTP id n10so2133140lbo.13 for ; Tue, 17 Jul 2012 23:56:16 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding :x-gm-message-state; bh=jO2ojx6ve52ifGojoVl+gKEEMOAi0Tvg1AemDASx+YA=; b=nX0E/sy9Bf6n9bVs8N52krxddokSYbpw1YJ1A7kORQECF1WTp82hGFjh1VBo1Ti2Je prmhMyMwvzK5SeDgh3UjHW6QAxDafaaak72fxObnsT3Dn82I+3bmKGF61YqtkiqJr9dQ X1BXiUHkdcW2rSjfKiGgfCOuW1uZ1p4vXWZ/m4WKDgZE32Ajj598q6b4SSE7AgIcEbry v1XxEVSN720Yarp+T26RIFEJbDh8VW1xVY42EPD1xMEuTb6wnS4yrgwHMnu/uLXtxlgb 5EbyWU7ft3Zv63zqRMcKxmZj8MCoWY6h3N3q1zKo+LHsSkjHQvMCDDuTI3Qb5rFDJ3/b GYyw== Received: by 10.152.112.233 with SMTP id it9mr1985744lab.40.1342594576185; Tue, 17 Jul 2012 23:56:16 -0700 (PDT) Received: from zont-osx.local (ppp95-165-134-208.pppoe.spdop.ru. [95.165.134.208]) by mx.google.com with ESMTPS id s3sm4544740lbk.11.2012.07.17.23.56.14 (version=SSLv3 cipher=OTHER); Tue, 17 Jul 2012 23:56:15 -0700 (PDT) Message-ID: <50065E0E.50903@zonov.org> Date: Wed, 18 Jul 2012 10:56:14 +0400 From: Andrey Zonov User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 MIME-Version: 1.0 To: "freebsd-net@freebsd.org" References: <5003EDC4.3050100@zonov.org> <50048A34.10304@zonov.org> In-Reply-To: <50048A34.10304@zonov.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Gm-Message-State: ALoCoQm5zSY/1y/ZB3mbXlEGZ9OSiNcjQvHgjj6uQQiib2qk43t2/wIpg/hSRWt+vmYYETUFPUT0 Subject: Re: panic: negative refcount 0xfffffe0007f1b4d4 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Jul 2012 06:56:18 -0000 On 7/17/12 1:40 AM, Andrey Zonov wrote: > On 7/16/12 2:32 PM, Andrey Zonov wrote: >> Hi, >> >> I've got about 30 machines which panic sometimes in different places but >> with the same panic message: "negative refcount 0xfffffe0007f1b4d4". >> They are running under 9.0-STABLE@r234600M. >> > [snip] >> >> Is this known issue? If it is not, I've got textdumps and can send to >> anyone who wants to help me. >> >> Thanks in advance. >> > > So, this is the one more ifa leak. > It happens when "goto again" is called in ip_output(), in my case under IPFIREWALL_FORWARD. I'm doing source routing with "ipfw fwd". There are no leaks with this patch applied: Index: sys/netinet/ip_output.c =================================================================== --- sys/netinet/ip_output.c (revision 234600) +++ sys/netinet/ip_output.c (working copy) @@ -203,6 +203,8 @@ again: * The address family should also be checked in case of sharing the * cache with IPv6. */ + if (ia != NULL) + ifa_free(&ia->ia_ifa); rte = ro->ro_rt; if (rte && ((rte->rt_flags & RTF_UP) == 0 || rte->rt_ifp == NULL || I also want to propose this patch: Index: sys/sys/refcount.h =================================================================== --- sys/sys/refcount.h (revision 234600) +++ sys/sys/refcount.h (working copy) @@ -51,6 +51,7 @@ static __inline void refcount_acquire(volatile u_int *count) { + KASSERT(*count < 0xffffff00, ("refcount %p is overflowed", count)); atomic_add_acq_int(count, 1); } It will give better diagnostic when refcount is overflowed, instead of "negative refcount". -- Andrey Zonov