From owner-freebsd-current@freebsd.org Wed Jul 8 15:09:14 2015 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E4C46996B98 for ; Wed, 8 Jul 2015 15:09:13 +0000 (UTC) (envelope-from ermal.luci@gmail.com) Received: from mail-yk0-x229.google.com (mail-yk0-x229.google.com [IPv6:2607:f8b0:4002:c07::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id A394A1959; Wed, 8 Jul 2015 15:09:13 +0000 (UTC) (envelope-from ermal.luci@gmail.com) Received: by ykee186 with SMTP id e186so9987720yke.2; Wed, 08 Jul 2015 08:09:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=BzAaQKiA7yU5evYalhz1Pu0xTVJYrs99wEgsHTumTgY=; b=p2BdKfNAnZqKwsnu+t2fpmE2gVVOyoNM/MVJLsHznDxHz5HoykQCLFJxeNPv//a94g n/tQJ/AZDLj6W5/guVoqJxXkALPDigtG7FEu8noeqm7mJuIftqrFPAJ7SY8iIUKD/w7M etlYBQA4imOisSqHZhUNFqQ6Ql5uttnEpK4hz0XBM0CIUbQFT8mLGgGP9gzIsSG+AaNQ KGSFOHbeMZo7fpzPMAjDX7tNshrwQSNHJQzTjeW45HC+yDGwx5PzXEiKQTeE739p8wKa hUOgDOPQzit2T8atF3czzQzL7ytgwaKRflzw/Z2fMFPdEMvWvDVms1kL5dW2MXBqyKq8 3YuA== MIME-Version: 1.0 X-Received: by 10.129.82.130 with SMTP id g124mr12243040ywb.9.1436368152770; Wed, 08 Jul 2015 08:09:12 -0700 (PDT) Sender: ermal.luci@gmail.com Received: by 10.129.83.139 with HTTP; Wed, 8 Jul 2015 08:09:12 -0700 (PDT) In-Reply-To: <20150707161107.GE86301@rink.nu> References: <20150705151541.GC45822@rink.nu> <20150706072154.GA86301@rink.nu> <20150707161107.GE86301@rink.nu> Date: Wed, 8 Jul 2015 17:09:12 +0200 X-Google-Sender-Auth: e4dpwT29QN5ReOGuKKaGABavpZ0 Message-ID: Subject: Re: panic: negative refcount after dhclient during boot From: =?UTF-8?Q?Ermal_Lu=C3=A7i?= To: Rink Springer Cc: "freebsd-current@freebsd.org" Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jul 2015 15:09:14 -0000 On Tue, Jul 7, 2015 at 6:11 PM, Rink Springer wrote: > Hi eri@, > > On Mon, Jul 06, 2015 at 09:21:54AM +0200, Rink Springer wrote: > > On Sun, Jul 05, 2015 at 12:45:25PM -0700, Garrett Cooper wrote: > > > On Jul 5, 2015, at 8:16, Rink Springer wrote: > > > > > > > Hi all, > > > > > > > > On my FreeBSD/mips machine (it's a RouterStation Pro), I get the > > > > following panic during boot: > > > > > > ? > > > > > > > This reproduces 100%. I'm at: > > > > > > > > FreeBSD 11.0-CURRENT #0 r285099: Sun Jul 5 12:31:47 CEST 2015 > > > > > > > > Let me know what I can do to help track this down; I only started > > > > getting the panic after 'gateway_enable=YES' in /etc/rc.conf > > > > > > > > The kernel has INVARIANTS but no WITNESS. Config available at > > > > http://rink.nu/tmp/FRINGE - boot log at > http://rink.nu/tmp/fringe.txt > > > > > > Please file a bug! > > > > Done, 201371. > > After a suggestion by adrian@, it seems reverting r285051 fixes the > problem for me (i.e. the system boots now) > > Can you please try with this patch and let me know if it fixes the issue. Index: sys/netinet/ip_output.c =================================================================== --- sys/netinet/ip_output.c (revision 285271) +++ sys/netinet/ip_output.c (working copy) @@ -660,6 +660,13 @@ done: if (ro == &iproute) RO_RTFREE(ro); + else if (rte == NULL) + /* + * If the caller supplied a route but somehow the reference + * to it has been released need to prevent the caller + * calling RTFREE on it again. + */ + ro->ro_rt = NULL; if (have_ia_ref) ifa_free(&ia->ia_ifa); return (error); > Regards, > Rink > -- Ermal