"kernel: rtfree: 0xc3c4bd98 has 2 refs" on recent current

[Artem Naluzhny]

> Here is a backtrace:
>
> rtfree: 0xc3c5cca8 has 2 refs
> KDB: stack backtrace:
> db_trace_self_wrapper(c06b84de,e111dad4,c05d18f1,c06be1ff,c069bdd1,...)
at db_trace_self_wrapper+0x26
> kdb_backtrace(c06be1ff,c069bdd1,c3c5cca8,2,c3c5cca8,...) at kdb_backtrace+0x29
> rtfree(c3c5cca8,c3b3a010,10,c05d190b,c3c5cd98,...) at rtfree+0x51
> rtredirect(e111dba0,e111db90,0,6,e111db80,...) at rtredirect+0x1cf
> icmp_input(c3d14400,14,e111dbd8,0,c3c63e00,...) at icmp_input+0x50f
> ip_input(c3d14400,c05bd255,800,c39e5800,800,...) at ip_input+0x6ae
> netisr_dispatch(2,c3d14400,10,3,0,...) at
> netisr_dispatch+0x55
> ether_demux(c39e5800,c3d14400,3,0,3,...) at ether_demux+0x1aa
> ether_input(c39e5800,c3d14400,2,1,c396cc84,...) at ether_input+0x323
> bfe_intr(c39d1000,0,c06b4383,46b,0,...) at bfe_intr+0x41a
> ithread_loop(c39eb730,e111dd38,0,0,0,...) at ithread_loop+0x1ab
> fork_exit(c0511d70,c39eb730,e111dd38) at fork_exit+0x99
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0, eip = 0, esp = 0xe111dd70, ebp = 0 ---
>
>
> Here is an incoming ICMP packet (the last one) causing the "rtfree has
> 2 refs" message (00:19:b9:5a:a3:10 is my host):
>
> 17:47:46.915491 00:0c:29:b2:14:38 > 00:19:b9:5a:a3:10, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl  64, id 48899, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.25 > 192.168.0.55: ICMP redirect 192.168.0.1 to host 192.168.0.1, length 36
>         (tos 0x0, ttl  16, id 0, offset 0, flags [none], proto: UDP (17), length: 328) 192.168.0.55.68 > 192.168.0.1.67:  [|bootp]
>         0x0000:  4500 0038 bf03 0000 4001 3a21 c0a8 0019  E..8.... at .:!....
>         0x0010:  c0a8 0037 0501 48f7 c0a8 0001 4500 0148  ...7..H.....E..H
>         0x0020:  0000 0000 1011 281d c0a8 0037 c0a8 0001  ......(....7....
>         0x0030:  0044 0043 0134 efa2                      .D.C.4..
> 17:47:46.942512 00:19:b9:5a:a3:10 > 00:50:bf:b1:34:a3, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl  64, id 207, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.55 > 192.168.0.1: ICMP 192.168.0.55 udp port 68 unreachable, length 36
>         (tos 0x0, ttl  64, id 14203, offset 0, flags [none], proto: UDP (17), length: 334) 192.168.0.1.67 > 192.168.0.55.68:  [|bootp]
>         0x0000:  4500 0038 00cf 0000 4001 f86d c0a8 0037  E..8.... at ..m...7
>         0x0010:  c0a8 0001 0303 0dbe 0000 0000 4500 014e  ............E..N
>         0x0020:  377b 0000 4011 c09b c0a8 0001 c0a8 0037  7{.. at ..........7
>         0x0030:  0043 0044 013a ed7d                      .C.D.:.}
> 17:47:46.942528 00:19:b9:5a:a3:10 > 00:50:bf:b1:34:a3, ethertype IPv4 (0x0800), length 70: (tos 0x0, ttl  64, id 208, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.0.55 > 192.168.0.1: ICMP 192.168.0.55 udp port 68 unreachable, length 36
>         (tos 0x0, ttl  64, id 14204, offset 0, flags [none], proto: UDP (17), length: 334) 192.168.0.1.67 > 192.168.0.55.68:  [|bootp]
>         0x0000:  4500 0038 00d0 0000 4001 f86c c0a8 0037  E..8.... at ..l...7
>         0x0010:  c0a8 0001 0303 0dbe 0000 0000 4500 014e  ............E..N
>         0x0020:  377c 0000 4011 c09a c0a8 0001 c0a8 0037  7|.. at ..........7
>         0x0030:  0043 0044 013a ed7d                      .C.D.:.}


The behavior was introduced by following commit:

glebius     2007-05-22 16:17:32 UTC

 FreeBSD src repository

 Modified files:
   sys/net              route.c
 Log:
 Some minor cleanups:
 - In rt_check() remove the senderr() macro and the "bad" label. They
   used to simplify code, but now aren't.
 - Remove extra RT_LOCK_ASSERT() in rt_setgate(). The RT_REMREF macro
   does this.
 - In rtfree() convert panics to KASSERTs.
 - Strict the routing API: rtfree() should be called only in a case
   when we are completely sure we've got the last reference on the
   rtentry. In all other cases RTFREE_LOCKED() macro should be used.
   If the reference isn't the last one spit out a warning printf.
   Correct the only(?) case for this in rt_check().
 - Fix typos in comments.

 Revision  Changes    Path
 1.119     +15 -22    src/sys/net/route.c

-- 
/tut