panic: negative refcount after dhclient during boot

[Ermal Luçi]

On Tue, Jul 7, 2015 at 6:11 PM, Rink Springer <rink at freebsd.org> wrote:

> Hi eri@,
>
> On Mon, Jul 06, 2015 at 09:21:54AM +0200, Rink Springer wrote:
> > On Sun, Jul 05, 2015 at 12:45:25PM -0700, Garrett Cooper wrote:
> > > On Jul 5, 2015, at 8:16, Rink Springer <rink at freebsd.org> wrote:
> > >
> > > > Hi all,
> > > >
> > > > On my FreeBSD/mips machine (it's a RouterStation Pro), I get the
> > > > following panic during boot:
> > >
> > > ?
> > >
> > > > This reproduces 100%. I'm at:
> > > >
> > > > FreeBSD 11.0-CURRENT #0 r285099: Sun Jul  5 12:31:47 CEST 2015
> > > >
> > > > Let me know what I can do to help track this down; I only started
> > > > getting the panic after 'gateway_enable=YES' in /etc/rc.conf
> > > >
> > > > The kernel has INVARIANTS but no WITNESS. Config available at
> > > > http://rink.nu/tmp/FRINGE - boot log at
> http://rink.nu/tmp/fringe.txt
> > >
> > > Please file a bug!
> >
> > Done, 201371.
>
> After a suggestion by adrian@, it seems reverting r285051 fixes the
> problem for me (i.e. the system boots now)
>
>
Can you please try with this patch and let me know if it fixes the issue.

Index: sys/netinet/ip_output.c
===================================================================
--- sys/netinet/ip_output.c     (revision 285271)
+++ sys/netinet/ip_output.c     (working copy)
@@ -660,6 +660,13 @@
 done:
        if (ro == &iproute)
                RO_RTFREE(ro);
+       else if (rte == NULL)
+               /*
+                * If the caller supplied a route but somehow the reference
+                * to it has been released need to prevent the caller
+                * calling RTFREE on it again.
+                */
+               ro->ro_rt = NULL;
        if (have_ia_ref)
                ifa_free(&ia->ia_ifa);
        return (error);


> Regards,
> Rink
>



-- 
Ermal