panic: mtx_lock() of destroyed mutex @ /usr/src/sys/net/route.c:1306

[Andrey V. Elsukov]

> Dan Nelson wrote:
> >> panic: mtx_lock() of destroyed mutex @ /usr/src/sys/net/route.c:1306
> >> cpuid = 0
> >> KDB: enter: panic
> >> Physical memory: 3575 MB
> >> Dumping 324 MB: 309 293 277 261 245 229 213 197 181 165 149 133 117 101
> >> 85 69 53 37 21 5
> > 
> > I just booted today's -current and got the same panic with a similar
> > stack trace.  I've actually been getting it once a week or so since I
> > switched to -current in June, but it's bugging me today.

I think my problem is related to routing code too.
http://lists.freebsd.org/pipermail/freebsd-current/2007-August/076270.html

(kgdb) l *0xc0585ee5
0xc0585ee5 is in _mtx_lock_sleep (/usr/src/sys/kern/kern_mutex.c:363).
358                      * If the current owner of the lock is executing on another
359                      * CPU, spin instead of blocking.
360                      */
361                     owner = (struct thread *)(v & ~MTX_FLAGMASK);
362     #ifdef ADAPTIVE_GIANT
363                     if (TD_IS_RUNNING(owner)) 
364     #else
365                     if (m != &Giant && TD_IS_RUNNING(owner)) 
366     #endif
367                     {
(kgdb) f 10
#10 0xc0585ee5 in _mtx_lock_sleep (m=0xc3696b28, tid=3281945120, opts=0, file=0x0, line=0) at /usr/src/sys/kern/kern_mutex.c:361
361                     owner = (struct thread *)(v & ~MTX_FLAGMASK);
(kgdb) p *m
$1 = {lock_object = {lo_name = 0xc0807e84 "rtentry", lo_type = 0xc0807e84 "rtentry", lo_flags = 21102592, lo_witness_data = {lod_list = {
        stqe_next = 0x0}, lod_witness = 0x0}}, mtx_lock = 6, mtx_recurse = 0}


The mtx_lock value is 6 - this is MTX_DESTROYED.
My coredump and kernel is here:
http://butcher.heavennet.ru/panic/

--
WBR, Andrey V. Elsukov