INPCB panic....

[Ian Dowse]

In message <200311101159.44366.sam at errno.com>, Sam Leffler writes:
>On Monday 10 November 2003 11:37 am, Larry Rosenman wrote:
>> I removed my wi0 card (with DHCLIENT running), and got the following panic
>> on a -CURRENT from yesterday:
>
>Thanks.  Working on it...

FYI, I've been using the following patch locally which seems to
trigger the printf sometimes when wi0 is ejected. Without the patch,
it used to dereference a stale struct ifnet and crash. I have an
approx 1 week old kernel, so this particular problem may have been
fixed already.

Ian

Index: in_pcb.c
===================================================================
RCS file: /dump/FreeBSD-CVS/src/sys/netinet/in_pcb.c,v
retrieving revision 1.125
diff -u -r1.125 in_pcb.c
--- in_pcb.c	1 Nov 2003 07:30:07 -0000	1.125
+++ in_pcb.c	3 Nov 2003 00:52:41 -0000
@@ -564,10 +564,12 @@
 		 * destination, in case of sharing the cache with IPv6.
 		 */
 		ro = &inp->inp_route;
-		if (ro->ro_rt &&
-		    (ro->ro_dst.sa_family != AF_INET ||
-		     satosin(&ro->ro_dst)->sin_addr.s_addr != faddr.s_addr ||
-		     inp->inp_socket->so_options & SO_DONTROUTE)) {
+		if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
+		    ro->ro_dst.sa_family != AF_INET ||
+		    satosin(&ro->ro_dst)->sin_addr.s_addr != faddr.s_addr ||
+		    inp->inp_socket->so_options & SO_DONTROUTE)) {
+			if ((ro->ro_rt->rt_flags & RTF_UP) == 0)
+				printf("clearing non-RTF_UP route\n");
 			RTFREE(ro->ro_rt);
 			ro->ro_rt = (struct rtentry *)0;
 		}