From owner-freebsd-bugs@FreeBSD.ORG Thu Apr 29 02:00:34 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9B94816A4CE for ; Thu, 29 Apr 2004 02:00:34 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7DD4343D46 for ; Thu, 29 Apr 2004 02:00:34 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i3T90YRt015629 for ; Thu, 29 Apr 2004 02:00:34 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id i3T90YKB015628; Thu, 29 Apr 2004 02:00:34 -0700 (PDT) (envelope-from gnats) Resent-Date: Thu, 29 Apr 2004 02:00:34 -0700 (PDT) Resent-Message-Id: <200404290900.i3T90YKB015628@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Niki Denev Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C8BAE16A4CE for ; Thu, 29 Apr 2004 01:57:22 -0700 (PDT) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id A559543D46 for ; Thu, 29 Apr 2004 01:57:22 -0700 (PDT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.12.11/8.12.11) with ESMTP id i3T8vMor058735 for ; Thu, 29 Apr 2004 01:57:22 -0700 (PDT) (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.12.11/8.12.11/Submit) id i3T8vMrU058734; Thu, 29 Apr 2004 01:57:22 -0700 (PDT) (envelope-from nobody) Message-Id: <200404290857.i3T8vMrU058734@www.freebsd.org> Date: Thu, 29 Apr 2004 01:57:22 -0700 (PDT) From: Niki Denev To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Subject: kern/66079: route change default causes panic in certain situations X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Apr 2004 09:00:34 -0000 >Number: 66079 >Category: kern >Synopsis: route change default causes panic in certain situations >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Apr 29 02:00:34 PDT 2004 >Closed-Date: >Last-Modified: >Originator: Niki Denev >Release: -Current from 28.04.2004 >Organization: >Environment: FreeBSD phobos.totalterror.net 5.2-CURRENT FreeBSD 5.2-CURRENT #1: Wed Apr 28 18:40:12 EEST 2004 root@phobos.totalterror.net:/usr/obj/usr/src/sys/GENERIC i386 >Description: probable locking problem in the routing code, maybe caused due to recent LOR fixes. when i bring up my wireless interface, then the ethernet interface, and then bring down my wireless interface, both with the same IP address, and issue route change default with the same default gw as before, the machine panics. dmesg can be found at : www.totalterror.net/freebsd/ >How-To-Repeat: # ifconfig ndis0 ssid my_ssid wepmode on wepkey 0x************************** # ifconfig ndis0 10.0.0.6 netmask 255.255.255.240 up # route add default 10.0.0.1 # ping -c 10.0.0.1 PING 10.0.0.1 (10.0.0.1): 56 data bytes 64 bytes from 10.0.0.1: icmp_seq=0 ttl=255 time=0.249 ms --- 10.0.0.1 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.249/0.249/0.249/0.000 ms # ifconfig fxp0 10.0.0.6 netmask 255.255.255.240 ifconfig: ioctl (SIOCAIFADDR): File exists kernel: arp: **:**:**:**:**:** is using my IP address 10.0.0.6! # ifconfig ndis0 down # route change default 10.0.0.1 panic: _mtx_lock_sleep: recursed on non-recursive mutex rtentry @ /usr/src/sys/net/route.c:1057 at line 437 in file /usr/src/sys/kern/kern_mutex.c cpuid = 0; Debugger("panic"); Stopped at Debugger+0x46: xchgl %ebx,in_Debugger.0 db> trace Debugger(c07c28d5) at Debugger+0x46 __panic(c07c1cb0,1b5,c07c1d9e,c07cc1f8,c07cc111) at __panic+0x13d _mtx_lock_sleep(c499d260,0,c07cc111,421) at _mtx_lock_sleep+0xab _mtx_lock_flags(c499d260,0,c07cc111,421,c49b62ec) at _mtx_lock_flags+0x90 rt_setgate(c499d200,c4e40960,c49b62ec,0,c499d200) at rt_setgate+0x230 route_output(c1996800,c4734b40,80,c1996800,1f80) at route_output+0x5be raw_usend(c4734b40,0,c1996800,0,0,c46b3bd0) at raw_usend+0x6c rts_send(c4734b40,0,c1996800,0,0) at rts_send+0x1b sosend(c4734b40,0,e7f2ec88,c1996800,0) at sosend+0x3fd soo_write(c46db264,e7f2ec88,c49b6500,0,c46b3bd0) at soo_write+0x46 dofilewrite(c46b3bd0,c46db264,3,804e5e0,80) at dofilewrite+0xbb write(c46b3bd0,e7f2ed14,3,0,296) at write+0x3e syscall(2f,2f,2f,804e63c,80) at syscall+0x217 Xint0x80_syscall() at Xint0x80_syscall+0x1f --- syscall (4, FreeBSD ELF32, write), eip = 0x280c54cb, esp = 0xbfbfecbc, ebp = 0xbfbfece8 --- db> >Fix: >Release-Note: >Audit-Trail: >Unformatted: