kern/155177: [route] [panic] Panic when inject routes in kernel

[Luiz Otavio O Souza]

The following reply was made to PR kern/155177; it has been noted by GNATS.

From: Luiz Otavio O Souza <lists.br at gmail.com>
To: bug-followup at FreeBSD.org,
 eschoedler at gmail.com
Cc:  
Subject: Re: kern/155177: [route] [panic] Panic when inject routes in kernel
Date: Thu, 3 Mar 2011 08:30:55 -0300

 Hello,
 
 The culprit here is RADIX_MPATH. When the kernel is built with it, it =
 crashes with the following backtrace (missing on PR):
 
 #0  doadump () at pcpu.h:224
 224	pcpu.h: No such file or directory.
 	in pcpu.h
 (kgdb) #0  doadump () at pcpu.h:224
 #1  0xffffffff803c8bee in boot (howto=3D260)
     at /usr/src/sys/kern/kern_shutdown.c:419
 #2  0xffffffff803c9021 in panic (fmt=3DVariable "fmt" is not available.
 )
     at /usr/src/sys/kern/kern_shutdown.c:592
 #3  0xffffffff8049cc15 in rtfree (rt=3DVariable "rt" is not available.
 ) at /usr/src/sys/net/route.c:446
 #4  0xffffffff804a0856 in route_output (m=3D0xffffff006f14ab00,=20
     so=3D0xffffff004dfbd7f8) at /usr/src/sys/net/rtsock.c:863
 #5  0xffffffff804321e1 in sosend_generic (so=3D0xffffff004dfbd7f8, =
 addr=3D0x0,=20
     uio=3D0xffffff824413ca90, top=3D0xffffff006f14ab00, control=3D0x0, =
 flags=3D0,=20
     td=3D0xffffff00062a6460) at /usr/src/sys/kern/uipc_socket.c:1260
 #6  0xffffffff804126c2 in soo_write (fp=3DVariable "fp" is not =
 available.
 )
     at /usr/src/sys/kern/sys_socket.c:102
 #7  0xffffffff8040b23b in dofilewrite (td=3D0xffffff00062a6460, fd=3D4,=20=
 
     fp=3D0xffffff00063fe2d0, auio=3D0xffffff824413ca90, offset=3DVariable =
 "offset" is not available.
 ) at file.h:239
 #8  0xffffffff8040b550 in kern_writev (td=3D0xffffff00062a6460, fd=3D4,=20=
 
     auio=3D0xffffff824413ca90) at /usr/src/sys/kern/sys_generic.c:447
 #9  0xffffffff8040b5d5 in write (td=3DVariable "td" is not available.
 ) at /usr/src/sys/kern/sys_generic.c:363
 #10 0xffffffff804077a5 in syscallenter (td=3D0xffffff00062a6460,=20
     sa=3D0xffffff824413cba0) at /usr/src/sys/kern/subr_trap.c:315
 #11 0xffffffff8064a6ab in syscall (frame=3D0xffffff824413cc40)
     at /usr/src/sys/amd64/amd64/trap.c:944
 #12 0xffffffff80632c52 in Xfast_syscall ()
     at /usr/src/sys/amd64/amd64/exception.S:381
 #13 0x0000000800bc5b3c in ?? ()
 Previous frame inner to this frame (corrupt stack?)
 (kgdb)=20
 
 
 Looks like it is leaking the 'rt->rt_refcnt' and as result it =
 crashes/panic at RTFREE() on the end of route_output().
 
 I don't have access to this live system to dig further (i.e. reduce the =
 test case).
 
 Cheers,
 Luiz=