| From: | Hiroki Sato <hrs@xxxxxxxxxx> |
| Date: | Sat, 01 Jan 2005 08:09:09 +0900 (JST) |
Jeffrey Hsu <hsu@xxxxxxxxxxx> wrote
in <41d1cb86$0$719$415eb37d@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>:
hsu> I don't think it is a problem for our routing code to call rtrequest(RTM_DELETE) with
hsu> a NULL return route for the last parameter. Are we talking about a recursive call
hsu> from rtfree() to rtfree() or from rtfree() back to rtrequest()? A stack trace
hsu> showing the problem would help illustrate the problem for me. Thanks.
I can reproduce the system panic due to this double free. Specifically,
doing "sysctl net.inet6.ip6.rtexpire=0" and then "ping6 somewhere" will
trigger it. Probably Jinmei-san can explain the reason more precisely,
but when rtq_reallyold == 0, rtfree() can be called twice from the
rtrequest() in in6_clsroute() and somewhere else.
Here is a stack trace when panic is occurred (I think this is not so
useful though...)
#23 0xc03fbef4 in Debugger (msg=0xc046df3c "panic") at machine/cpufunc.h:68
#24 0xc0261848 in panic (fmt=0xc047a720 "rtfree: rn_flags 0x%x ")
at /usr/src/sys/kern/kern_shutdown.c:618
#25 0xc02bb84f in rtfree (rt=0xc172add8) at /usr/src/sys/net/route.c:191
#26 0xc02eb111 in in6_pcbdetach (inp=0xcd81eb00)
at /usr/src/sys/netinet6/in6_pcb.c:610
#27 0xc02f638c in udp6_detach (so=0xcd662bc0)
at /usr/src/sys/netinet6/udp6_usrreq.c:684
#28 0xc0287c53 in netmsg_pru_detach (msg=0xcf337af8)
at /usr/src/sys/kern/uipc_msg.c:494
#29 0xc02b9e75 in netmsg_service_loop (arg=0x0)
at /usr/src/sys/net/netisr.c:200
#30 0xc0266aa0 in lwkt_create () at /usr/src/sys/kern/lwkt_thread.c:1260
If you want other information on this problem, please let me know. Thanks.
--
| Hiroki SATO
Attachment:
pgp00002.pgp
Description: PGP signature