panics on 6.3-RELEASE in IP stack

[John Baldwin]

On Monday 07 April 2008 12:16:53 pm Petr Holub wrote:
> Hi all,
>
> I started to play with RAT application (ports: mbone/rat + an SVN version)
> and
> it seems to crash my 6.3-RELEASE-p1 box in rather deterministic way. Crash
> details are shown below. Has anyone seen a problem like this?

Yes, there's an off-by-one reference count bug in the multicast stuff.  You 
need 1.85.2.10 of sys/netinet/in.c:

Index: in.c
===================================================================
RCS file: /host/cvs/usr/cvs/src/sys/netinet/in.c,v
retrieving revision 1.85.2.9
retrieving revision 1.85.2.10
diff -u -r1.85.2.9 -r1.85.2.10
--- in.c        7 Jul 2007 00:54:46 -0000       1.85.2.9
+++ in.c        22 Feb 2008 19:13:56 -0000      1.85.2.10
@@ -991,7 +991,6 @@
         * a new record.  Otherwise, we are done.
         */
        if (ifma->ifma_protospec != NULL) {
-               if_delmulti_ent(ifma);  /* We don't need another reference */
                IN_MULTI_UNLOCK();
                IFF_UNLOCKGIANT(ifp);
                return ifma->ifma_protospec;

Given how simple the patch is and that if fixes a known panic this might be 
worthy of an errata notice or errata candidate.  (At least a note in the 
errata pointing to the 1.85.2.10 commit if not an actual patch to 
RELENG_6_3.)

-- 
John Baldwin