From owner-freebsd-current@freebsd.org Tue Jul 12 09:44:18 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2095CB908A8 for ; Tue, 12 Jul 2016 09:44:18 +0000 (UTC) (envelope-from pho@holm.cc) Received: from relay01.pair.com (relay01.pair.com [209.68.5.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E700E1B7D for ; Tue, 12 Jul 2016 09:44:17 +0000 (UTC) (envelope-from pho@holm.cc) Received: from x2.osted.lan (87-58-223-204-dynamic.dk.customer.tdc.net [87.58.223.204]) by relay01.pair.com (Postfix) with ESMTP id 46A06D0083D; Tue, 12 Jul 2016 05:44:16 -0400 (EDT) Received: from x2.osted.lan (localhost [127.0.0.1]) by x2.osted.lan (8.14.9/8.14.9) with ESMTP id u6C9iDj9081593 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 12 Jul 2016 11:44:14 +0200 (CEST) (envelope-from pho@x2.osted.lan) Received: (from pho@localhost) by x2.osted.lan (8.14.9/8.14.9/Submit) id u6C9iDfH081592; Tue, 12 Jul 2016 11:44:13 +0200 (CEST) (envelope-from pho) Date: Tue, 12 Jul 2016 11:44:13 +0200 From: Peter Holm To: Hans Petter Selasky Cc: freebsd-current@FreeBSD.org Subject: Re: panic: bogus refcnt 0 on lle 0xfffff80121a13a00 Message-ID: <20160712094413.GA81279@x2.osted.lan> References: <20160712083746.GA78547@x2.osted.lan> <29dd874b-075f-8ba7-4e0d-144ebdb8b283@selasky.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <29dd874b-075f-8ba7-4e0d-144ebdb8b283@selasky.org> User-Agent: Mutt/1.5.23 (2014-03-12) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jul 2016 09:44:18 -0000 On Tue, Jul 12, 2016 at 10:55:31AM +0200, Hans Petter Selasky wrote: > On 07/12/16 10:37, Peter Holm wrote: > > Exiting from single-user mode triggers this: > > > > ifa_maintain_loopback_route: deletion failed for interface igb0: 3 > > panic: bogus refcnt 0 on lle 0xfffff80121a13a00 > > cpuid = 9 > > KDB: stack backtrace: > > db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe1048c63470 > > vpanic() at vpanic+0x182/frame 0xfffffe1048c634f0 > > kassert_panic() at kassert_panic+0x126/frame 0xfffffe1048c63560 > > llentry_free() at llentry_free+0x136/frame 0xfffffe1048c63590 > > in_lltable_free_entry() at in_lltable_free_entry+0xb0/frame 0xfffffe1048c635c0 > > htable_prefix_free() at htable_prefix_free+0xce/frame 0xfffffe1048c63620 > > lltable_prefix_free() at lltable_prefix_free+0x5d/frame 0xfffffe1048c63660 > > in_scrubprefix() at in_scrubprefix+0x290/frame 0xfffffe1048c63700 > > in_difaddr_ioctl() at in_difaddr_ioctl+0x285/frame 0xfffffe1048c63750 > > in_control() at in_control+0x96/frame 0xfffffe1048c637d0 > > ifioctl() at ifioctl+0xda1/frame 0xfffffe1048c63860 > > kern_ioctl() at kern_ioctl+0x246/frame 0xfffffe1048c638c0 > > sys_ioctl() at sys_ioctl+0x171/frame 0xfffffe1048c639a0 > > amd64_syscall() at amd64_syscall+0x2f6/frame 0xfffffe1048c63ab0 > > Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe1048c63ab0 > > --- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x800fd2eba, rsp = 0x7fffffffe468, rbp = 0x7fffffffe4b0 - > > > > Details @ https://people.freebsd.org/~pho/stress/log/bogus_refcnt.txt > > > > FYI: > https://reviews.freebsd.org/D4605 > > Might be related. > > --HPS No difference with this patch (- netinet6/nd6.c). BTW The problem is really easy to reproduce: init 1 followed by "exit" in the single-user shell. -- Peter