From owner-freebsd-net@FreeBSD.ORG Thu Mar 3 12:00:38 2011 Return-Path: Delivered-To: freebsd-net@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4870D1065673 for ; Thu, 3 Mar 2011 12:00:38 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 1D04F8FC1A for ; Thu, 3 Mar 2011 12:00:38 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p23C0bLJ013302 for ; Thu, 3 Mar 2011 12:00:37 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p23C0b9U013268; Thu, 3 Mar 2011 12:00:37 GMT (envelope-from gnats) Date: Thu, 3 Mar 2011 12:00:37 GMT Message-Id: <201103031200.p23C0b9U013268@freefall.freebsd.org> To: freebsd-net@FreeBSD.org From: Luiz Otavio O Souza Cc: Subject: Re: kern/155177: [route] [panic] Panic when inject routes in kernel X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Luiz Otavio O Souza List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Mar 2011 12:00:38 -0000 The following reply was made to PR kern/155177; it has been noted by GNATS. From: Luiz Otavio O Souza To: bug-followup@FreeBSD.org, eschoedler@gmail.com Cc: Subject: Re: kern/155177: [route] [panic] Panic when inject routes in kernel Date: Thu, 3 Mar 2011 08:30:55 -0300 Hello, The culprit here is RADIX_MPATH. When the kernel is built with it, it = crashes with the following backtrace (missing on PR): #0 doadump () at pcpu.h:224 224 pcpu.h: No such file or directory. in pcpu.h (kgdb) #0 doadump () at pcpu.h:224 #1 0xffffffff803c8bee in boot (howto=3D260) at /usr/src/sys/kern/kern_shutdown.c:419 #2 0xffffffff803c9021 in panic (fmt=3DVariable "fmt" is not available. ) at /usr/src/sys/kern/kern_shutdown.c:592 #3 0xffffffff8049cc15 in rtfree (rt=3DVariable "rt" is not available. ) at /usr/src/sys/net/route.c:446 #4 0xffffffff804a0856 in route_output (m=3D0xffffff006f14ab00,=20 so=3D0xffffff004dfbd7f8) at /usr/src/sys/net/rtsock.c:863 #5 0xffffffff804321e1 in sosend_generic (so=3D0xffffff004dfbd7f8, = addr=3D0x0,=20 uio=3D0xffffff824413ca90, top=3D0xffffff006f14ab00, control=3D0x0, = flags=3D0,=20 td=3D0xffffff00062a6460) at /usr/src/sys/kern/uipc_socket.c:1260 #6 0xffffffff804126c2 in soo_write (fp=3DVariable "fp" is not = available. ) at /usr/src/sys/kern/sys_socket.c:102 #7 0xffffffff8040b23b in dofilewrite (td=3D0xffffff00062a6460, fd=3D4,=20= fp=3D0xffffff00063fe2d0, auio=3D0xffffff824413ca90, offset=3DVariable = "offset" is not available. ) at file.h:239 #8 0xffffffff8040b550 in kern_writev (td=3D0xffffff00062a6460, fd=3D4,=20= auio=3D0xffffff824413ca90) at /usr/src/sys/kern/sys_generic.c:447 #9 0xffffffff8040b5d5 in write (td=3DVariable "td" is not available. ) at /usr/src/sys/kern/sys_generic.c:363 #10 0xffffffff804077a5 in syscallenter (td=3D0xffffff00062a6460,=20 sa=3D0xffffff824413cba0) at /usr/src/sys/kern/subr_trap.c:315 #11 0xffffffff8064a6ab in syscall (frame=3D0xffffff824413cc40) at /usr/src/sys/amd64/amd64/trap.c:944 #12 0xffffffff80632c52 in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:381 #13 0x0000000800bc5b3c in ?? () Previous frame inner to this frame (corrupt stack?) (kgdb)=20 Looks like it is leaking the 'rt->rt_refcnt' and as result it = crashes/panic at RTFREE() on the end of route_output(). I don't have access to this live system to dig further (i.e. reduce the = test case). Cheers, Luiz=