kern/155177: [route] [panic] Panic when inject routes in kernel

[Eduardo Schoedler]

Hello,

I've found another (easy) way to reproduce the problem with two scripts:
routes-add.sh and routes-remove.sh.
First run routes-add.sh for a while; then execute routes-remove.sh.
Cancel with CTRL+C and execute routes-remove.sh again.

Scripts:
========

# cat routes-add.sh 
#!/usr/local/bin/bash

for a in {11..16}; do
 for b in {1..255}; do
  for c in {1..255}; do
    echo -n Adding route $a.$b.$c.0/24...
    route -q delete -net $a.$b.$c.0/24
    echo OK.
  done
 done
done


# cat routes-remove.sh
#!/usr/local/bin/bash

for a in {11..16}; do
 for b in {1..255}; do
  for c in {1..255}; do
    echo -n Removing route $a.$b.$c.0/24...
    route -q delete -net $a.$b.$c.0/24
    echo OK.
  done
 done
done


Backtrace:
==========

# cat /var/crash/core.txt.1
<snip>
Unread portion of the kernel message buffer:
panic: rtfree 2
cpuid = 4
KDB: stack backtrace:
#0 0xffffffff80416e43 at kdb_backtrace+0x5e
#1 0xffffffff803e68a8 at panic+0x182
#2 0xffffffff804b2274 at rtalloc1_fib+0
#3 0xffffffff804b5b92 at route_output+0x304
#4 0xffffffff8044b776 at sosend_generic+0x366
#5 0xffffffff8042cd5c at soo_write+0x54
#6 0xffffffff80425bee at dofilewrite+0x7a
#7 0xffffffff80425ec1 at kern_writev+0x52
#8 0xffffffff80425f3f at write+0x4e
#9 0xffffffff80422408 at syscallenter+0x186
#10 0xffffffff8065b4f7 at syscall+0x40
#11 0xffffffff806449f2 at Xfast_syscall+0xe2
Uptime: 37m16s
Physical memory: 4084 MB
Dumping 497 MB:VOP_STRATEGY: bp is not locked but should be
 482 466 450 434 418 402 386 370 354 338 322 306 290 274 258 242 226 210 194
178 162 146 130 114 98 82 66 50 34 18 2

#0  doadump () at pcpu.h:224
224     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump () at pcpu.h:224
#1  0xffffffff803e6425 in boot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:419
#2  0xffffffff803e6892 in panic (fmt=Variable "fmt" is not available.
)
    at /usr/src/sys/kern/kern_shutdown.c:592
#3  0xffffffff804b2274 in rtfree (rt=Variable "rt" is not available.
) at /usr/src/sys/net/route.c:446
#4  0xffffffff804b5b92 in route_output (m=0xffffff0004790700,
    so=0xffffff00b07ead48) at /usr/src/sys/net/rtsock.c:863
#5  0xffffffff8044b776 in sosend_generic (so=0xffffff00b07ead48, addr=0x0,
    uio=0xffffff830ff98a90, top=0xffffff0004790700, control=0x0, flags=0,
    td=0xffffff0004a13000) at /usr/src/sys/kern/uipc_socket.c:1260
#6  0xffffffff8042cd5c in soo_write (fp=Variable "fp" is not available.
)
    at /usr/src/sys/kern/sys_socket.c:102
#7  0xffffffff80425bee in dofilewrite (td=0xffffff0004a13000, fd=3,
    fp=0xffffff0004977af0, auio=0xffffff830ff98a90, offset=Variable "offset"
is not available.
) at file.h:239
#8  0xffffffff80425ec1 in kern_writev (td=0xffffff0004a13000, fd=3,
    auio=0xffffff830ff98a90) at /usr/src/sys/kern/sys_generic.c:447
#9  0xffffffff80425f3f in write (td=Variable "td" is not available.
) at /usr/src/sys/kern/sys_generic.c:363
#10 0xffffffff80422408 in syscallenter (td=0xffffff0004a13000,
    sa=0xffffff830ff98ba0) at /usr/src/sys/kern/subr_trap.c:315
#11 0xffffffff8065b4f7 in syscall (frame=0xffffff830ff98c40)
    at /usr/src/sys/amd64/amd64/trap.c:944
#12 0xffffffff806449f2 in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:381
#13 0x0000000800735afc in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb)
<snip>

Again, removing RADIX_MPATH from kernel, it's working fine.


Regards,

--
Eduardo Schoedler