panic in RELENG_5 UMA

[Jeremie Le Hen]

Hi Gleb,

> IMHO, this looks like a race. The route is not locked, when
> its llinfo is edited.
> 
> Probably the mbuf was freed when arp reply arrived and la_hold was send.
> Look into in_arpinput() near 736:
> 
>                         (*ifp->if_output)(ifp, la->la_hold, rt_key(rt), rt);
>                         la->la_hold = 0;
> 
> Yeah, I have just triggered another panic running 15 instances of this
> script on SMP box:
> 
> (
> while (true); do
> 	arp -d 81.19.64.111  >/dev/null 2>&1;
> 	ping -c 1 -t 1 81.19.64.111 >/dev/null 2>&1;
> done
> ) &
> 
> But my duplicate free is in fxp_txeof(). This means that output thread has
> won the race.

This explanation sounds good but my box is an UP with PREEMPTION.
Is is supposed to be also possible in this case ?

Regards,
-- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >