panic in RELENG_5 UMA

[Gleb Smirnoff]

On Tue, Jun 21, 2005 at 11:28:36AM +0200, Jeremie Le Hen wrote:
J> > IMHO, this looks like a race. The route is not locked, when
J> > its llinfo is edited.
J> > 
J> > Probably the mbuf was freed when arp reply arrived and la_hold was send.
J> > Look into in_arpinput() near 736:
J> > 
J> >                         (*ifp->if_output)(ifp, la->la_hold, rt_key(rt), rt);
J> >                         la->la_hold = 0;
J> > 
J> > Yeah, I have just triggered another panic running 15 instances of this
J> > script on SMP box:
J> > 
J> > (
J> > while (true); do
J> > 	arp -d 81.19.64.111  >/dev/null 2>&1;
J> > 	ping -c 1 -t 1 81.19.64.111 >/dev/null 2>&1;
J> > done
J> > ) &
J> > 
J> > But my duplicate free is in fxp_txeof(). This means that output thread has
J> > won the race.
J> 
J> This explanation sounds good but my box is an UP with PREEMPTION.
J> Is is supposed to be also possible in this case ?

I guess yes, because of preemption.

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE