Date: Sat, 10 Aug 1996 21:05:21 +0200 (MET DST) From: J Wunsch <j@uriah.heep.sax.de> To: freebsd-current@FreeBSD.org (FreeBSD-current users) Cc: fenner@parc.xerox.com (Bill Fenner) Subject: Re: Crash in rtrequest() Message-ID: <199608101905.VAA02585@uriah.heep.sax.de> In-Reply-To: <96Aug10.114311pdt.177517@crevenia.parc.xerox.com> from Bill Fenner at "Aug 10, 96 11:43:08 am"
next in thread | previous in thread | raw e-mail | index | archive | help
As Bill Fenner wrote:
> Do you think I could have access to this core dump? I'd like to see exactly
> what rt0 looks like, and who actually called rt_setgate. Your fix only hides
> the problem, and this is code that I wrote in route.c , so I'd like to get to
> the bottom of it.
D*mn, i've already removed the coredump. :-(
Anyway, the stacktrace i've been quoting was fairly complete:
(kgdb) backtrace
[...]
#10 0xf01bab61 in calltrap ()
#11 0xf0143967 in rt_setgate (rt0=0xf0f39800, dst=0xf0f3a730, gate=0xf0e17450)
at ../../net/route.c:682
#12 0xf01435be in rtrequest (req=11, dst=0xf0f3a730, gateway=0x0, netmask=0x0,
flags=0, ret_nrt=0xefbffe68) at ../../net/route.c:468
#13 0xf0142f21 in rtalloc1 (dst=0xf0f3a730, report=1, ignflags=0)
at ../../net/route.c:130
#14 0xf0142e6b in rtalloc (ro=0xf0f3a72c) at ../../net/route.c:98
#15 0xf01490fd in in_pcbladdr ()
#16 0xf015197e in tcp_connect ()
#17 0xf0151363 in tcp_usr_connect ()
#18 0xf012458f in soconnect ()
#19 0xf01270ef in connect ()
[...]
The ``calltrap'' is actually the crashing instance of rtrequest(), but
rt_setgate() has been called by another instance of rtrequest:
makeroute:
R_Malloc(rt, struct rtentry *, sizeof(*rt));
if (rt == 0)
senderr(ENOBUFS);
Bzero(rt, sizeof(*rt));
rt->rt_flags = RTF_UP | flags;
if (rt_setgate(rt, dst, gateway)) { <<=== here
Free(rt);
senderr(ENOBUFS);
}
I've been analyzing rt0 (but forgot to quote _this_), it was almost
entirely zero except of the rt_flags field 131079 = RTF_WASCLONED |
RTF_UP | RTF_GATEWAY | RTF_HOST. Maybe one of the pointers also was
nonempty, i eventually forgot this detail.
rtrequest (req=11, dst=0xf0f3a730, gateway=0x0, netmask=0x0, flags=0, ...)
RTM_RESOLVE? ^^^^^^^
This looks suspicous since there's
RTF_GATEWAY set?!
--
cheers, J"org
joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199608101905.VAA02585>