[Bug 228501] [VIMAGE JAIL] panic: negative refcount 0xfffff8002717643c (when stopping jail)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=228501

--- Comment #8 from Marie Helene Kvello-Aune <marieheleneka at gmail.com> ---
Confirmed: There's no panic when repeatidly starting&stopping the jail w/o an
IP assigned to epair0b.

If I assign an IP to epair0b (I did so through the jails rc.conf), start the
jail, then stop it; there's an immediate panic: negative refcount.

During this test, no network daemons were enabled, sendmail was explicitly
disabled, and syslogd were passed the "-ss" flags upon startup.

== Panic summary ==
panic: negative refcount 0xfffff8001d12803c
cpuid = 0
time = 1527428596
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0077b96660
vpanic() at vpanic+0x1a3/frame 0xfffffe0077b966c0
doadump() at doadump/frame 0xfffffe0077b96740
ifa_free() at ifa_free+0x35/frame 0xfffffe0077b96760
in_difaddr_ioctl() at in_difaddr_ioctl+0x460/frame 0xfffffe0077b967c0
in_ifscrub_all() at in_ifscrub_all+0xff/frame 0xfffffe0077b96850
ip_destroy() at ip_destroy+0xbd/frame 0xfffffe0077b96870
vnet_destroy() at vnet_destroy+0x12c/frame 0xfffffe0077b968a0
prison_deref() at prison_deref+0x29d/frame 0xfffffe0077b968e0
taskqueue_run_locked() at taskqueue_run_locked+0x14c/frame 0xfffffe0077b96940
taskqueue_thread_loop() at taskqueue_thread_loop+0x88/frame 0xfffffe0077b96970
fork_exit() at fork_exit+0x84/frame 0xfffffe0077b969b0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0077b969b0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic


Additional info about jail:
# jexec devsamba sockstat -l
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
root     casperd    28345 7  stream /var/run/casper
root     syslogd    26069 5  dgram  /var/run/log
root     syslogd    26069 6  dgram  /var/run/logpriv

-- 
You are receiving this mail because:
You are the assignee for the bug.