Date: Mon, 20 Oct 2008 17:00:11 GMT From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: freebsd-bugs@FreeBSD.org Subject: Re: kern/128247: [panic] Fatal Trap 12 in ip6_forward (/usr/src/sys/netinet6/ip6_forward.c:420) Message-ID: <200810201700.m9KH0BkY015630@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/128247; it has been noted by GNATS.
From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
To: bug-followup@FreeBSD.org, m.atkinson@F5.com
Cc:
Subject: Re: kern/128247: [panic] Fatal Trap 12 in ip6_forward
(/usr/src/sys/netinet6/ip6_forward.c:420)
Date: Mon, 20 Oct 2008 16:31:17 +0000 (UTC)
On Mon, 20 Oct 2008, Mark Atkinson wrote:
> #0 doadump () at pcpu.h:221
> 221 __asm __volatile("movl %%fs:0,%0" : "=3Dr" (td));
> (kgdb) l *0xc09af288
> 0xc09af288 is in ip6_forward (/usr/src/sys/netinet6/ip6_forward.c:420).
> 415 * address). We use a local copy of ip6_src, since =
> in6_setscope()
> 416 * will possibly modify its first argument.
> 417 * [draft-ietf-ipngwg-icmp-v3-04.txt, Section 3.1]
> 418 */
> 419 src_in6 =3D ip6->ip6_src;
> 420 if (in6_setscope(&src_in6, rt->rt_ifp, &outzone)) {
> 421 /* XXX: this should not happen */
> 422 V_ip6stat.ip6s_cantforward++;
> 423 V_ip6stat.ip6s_badscope++;
> 424 m_freem(m);
>
> (kgdb) frame 10
> #10 0xc09af288 in ip6_forward (m=3D0xc5ed8300, srcrt=3D0)
> at /usr/src/sys/netinet6/ip6_forward.c:420
> 420 if (in6_setscope(&src_in6, rt->rt_ifp, &outzone)) {
> (kgdb) p rt
> $3 =3D (struct rtentry *) 0x0
and rt comes from
rt = V_ip6_forward_rt.ro_rt;
which is an unprotected (no lock) single global cache in the ipv6
stack. So I guess another packet changed it while this one was
processed. The problem is well known and will hopefully be eliminated
one day along with other caches left.
/bz
--
Bjoern A. Zeeb Stop bit received. Insert coin for new game.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200810201700.m9KH0BkY015630>