svn commit: r278472 - in head/sys: netinet netinet6

[randall]

Peter:

I am not sure what you mean.. :-)

The in6_lltable_lookup() is right at the line where the
code has done:

LLE_WLOCK(lle);
lle->la_flags |= LLE_DELETED;<-----

Now without seeing the registers and having a bit more details
I can't say.

My guess is lle is NULL or 0xdeadcode..

If so this may be a different reference counting bug.

R
On 2/9/15 3:41 PM, Peter Holm wrote:
>
> Could this be yours?
>
> db:0:pho> bt
> Tracing pid 9629 tid 100639 td 0xfffff8011cce14a0
> in6_lltable_lookup() at in6_lltable_lookup+0x11a/frame
> 0xfffffe081e426200
> nd6_output() at nd6_output+0x15d/frame 0xfffffe081e426290
> ip6_output() at ip6_output+0x2128/frame 0xfffffe081e426790
> tcp_output() at tcp_output+0x2dae/frame 0xfffffe081e426c30
> tcp_usr_send() at tcp_usr_send+0x2fe/frame 0xfffffe081e426cb0
> sosend_generic() at sosend_generic+0x414/frame 0xfffffe081e426d60
> clnt_vc_call() at clnt_vc_call+0x477/frame 0xfffffe081e426ec0
> clnt_reconnect_call() at clnt_reconnect_call+0x46c/frame
> 0xfffffe081e426f70
> newnfs_request() at newnfs_request+0x9ba/frame 0xfffffe081e4270d0
> nfscl_request() at nfscl_request+0x72/frame 0xfffffe081e427120
> nfsrpc_lookup() at nfsrpc_lookup+0x213/frame 0xfffffe081e4272a0
> nfs_lookup() at nfs_lookup+0x467/frame 0xfffffe081e4275c0
> VOP_LOOKUP_APV() at VOP_LOOKUP_APV+0x10f/frame 0xfffffe081e4275f0
> lookup() at lookup+0x5d5/frame 0xfffffe081e427680
> namei() at namei+0x536/frame 0xfffffe081e427740
> kern_statat() at kern_statat+0xae/frame 0xfffffe081e427900
> sys_fstatat() at sys_fstatat+0x2c/frame 0xfffffe081e4279a0
> amd64_syscall() at amd64_syscall+0x29c/frame 0xfffffe081e427ab0
>
> http://people.freebsd.org/~pho/stress/log/rrs003.txt
>
> - Peter
>
>