From nobody@FreeBSD.org  Thu Nov  8 09:35:56 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E2CE716A479
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  8 Nov 2007 09:35:56 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id C2EC113C4B6
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  8 Nov 2007 09:35:56 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.1/8.14.1) with ESMTP id lA89ZduX026285
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 8 Nov 2007 09:35:39 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.1/8.14.1/Submit) id lA89Zd1h026284;
	Thu, 8 Nov 2007 09:35:39 GMT
	(envelope-from nobody)
Message-Id: <200711080935.lA89Zd1h026284@www.freebsd.org>
Date: Thu, 8 Nov 2007 09:35:39 GMT
From: Stefan Lambrev <stefan.lambrev@moneybookers.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: rtfree() is being called where RTFREE_LOCKED() should be used.
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         117913
>Category:       kern
>Synopsis:       rtfree() is being called where RTFREE_LOCKED() should be used.
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    jhb
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 08 09:40:01 UTC 2007
>Closed-Date:    Wed Mar 05 20:36:26 UTC 2008
>Last-Modified:  Wed Mar 05 20:36:26 UTC 2008
>Originator:     Stefan Lambrev
>Release:        FreeBSD 7-BETA2
>Organization:
Moneybookers LTD
>Environment:
FreeBSD mb7.intra.net 7.0-BETA2 FreeBSD 7.0-BETA2 #7: Wed Nov  7 11:24:22 CET 2007     root@mb7.intra.net:/usr/obj/usr/src/sys/CORE  i386

>Description:
rtfree() is being called where RTFREE_LOCKED() should be used.
The results is: rtfree: %p has %lu refs..

So far this happens only when the GW sends ICMP redirect messages to the host. This problem exist only in FreeBSD7.

I added kbd_backtrace to rtfree (in src/sys/net/route.c) and here is what it reports:

rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743da00,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743da00,c743da00,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743da00,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743da00,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743da00,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743c500,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743c500,c743c500,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743c500,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743c500,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743c500,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743c100,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743c100,c743c100,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743c100,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743c100,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743c100,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743ba00,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743ba00,c743ba00,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743ba00,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743ba00,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743ba00,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,c6dee880,e59d1b14,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743b600,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743b600,c743b600,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743b600,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743b600,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743b600,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743b000,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743b000,c743b000,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743b000,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743b000,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743b000,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743ab00,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743ab00,c743ab00,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743ab00,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743ab00,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743ab00,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7439400,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7439400,c7439400,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7439400,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7439400,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7439400,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7439000,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7439000,c7439000,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7439000,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7439000,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7439000,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7438700,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7438700,c7438700,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7438700,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7438700,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7438700,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,e59d1b4c,e59d1b44,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7438300,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7438300,c7438300,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7438300,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7438300,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7438300,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7437000,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7437000,c7437000,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7437000,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7437000,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7437000,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,c6dee880,0,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7257b00,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7257b00,c7257b00,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7257b00,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7257b00,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7257b00,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c748d500,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c748d500,c748d500,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c748d500,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c748d500,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c748d500,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c748c400,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c748c400,c748c400,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c748c400,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c748c400,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c748c400,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c748c000,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c748c000,c748c000,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c748c000,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c748c000,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c748c000,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c748b700,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c748b700,c748b700,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c748b700,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c748b700,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c748b700,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c748b100,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c748b100,c748b100,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c748b100,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c748b100,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c748b100,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,0,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c748a100,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c748a100,c748a100,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c748a100,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c748a100,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c748a100,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7489500,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7489500,c7489500,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7489500,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7489500,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7489500,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7488300,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7488300,c7488300,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7488300,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7488300,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7488300,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7488000,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7488000,c7488000,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7488000,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7488000,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7488000,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7487a00,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7487a00,c7487a00,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7487a00,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7487a00,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7487a00,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7487700,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7487700,c7487700,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7487700,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7487700,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7487700,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7486200,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7486200,c7486200,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7486200,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7486200,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7486200,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c743f400,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c743f400,c743f400,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c743f400,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c743f400,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c743f400,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7514b00,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7514b00,c7514b00,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7514b00,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7514b00,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7514b00,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,c6dee880,e59d1b14,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7513600,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7513600,c7513600,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7513600,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7513600,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7513600,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7512d00,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7512d00,c7512d00,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7512d00,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7512d00,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7512d00,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7512200,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7512200,c7512200,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7512200,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7512200,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7512200,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7511800,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7511800,c7511800,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7511800,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7511800,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7511800,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) at kdb_backtrace+0x29
rtfree(c74e6258,c6f4d570,10,0,c070a4f4,...) at rtfree+0xd5
rtredirect(e59d1bb8,e59d1ba8,0,6,e59d1b98,...) at rtredirect+0x1a3
icmp_input(c7511400,14,c0775620,e59d1c04,c054fe54,...) at icmp_input+0x4ee
ip_input(c7511400,c7511400,800,c6ef0c00,800,...) at ip_input+0x64a
netisr_dispatch(2,c7511400,10,3,0,...) at netisr_dispatch+0x6c
ether_demux(c6ef0c00,c7511400,3,0,3,...) at ether_demux+0x1d4
ether_input(c6ef0c00,c7511400,c06fbb7b,bc4,e59d1cc4,...) at ether_input+0x387
bge_intr(c6f3a000,0,c0708331,471,c6e30164,...) at bge_intr+0x7c5
ithread_loop(c6f05be0,e59d1d38,c07080a0,314,c6eea2a8,...) at ithread_loop+0x1a5
fork_exit(c0540fa0,c6f05be0,e59d1d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe59d1d70, ebp = 0 ---
rtfree: 0xc74e6258 has 1 refs
KDB: stack backtrace:
db_trace_self_wrapper(c070e5d9,e59d1af0,c05efdce,c0718d8f,c06e7f6d,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c0718d8f,c06e7f6d,c74e6258,1,c74e6264,...) apanic: sched_priority: invalid priority 224: nice 0, ticks 21273056 ftick 15171 ltick 26026 tick pri 44
cpuid = 2
KDB: enter: panic
[thread pid 712 tid 100074 ]
Stopped at      kdb_enter+0x32: leave 

>How-To-Repeat:
set for your RELENG_7 host, default gateway IP that sits on carp interface.
create a shorter route (for the host) to another network (using second local gateway for example), but introduce this route only on the carp gateway.
Every time when the host try to access this network, the gateway will send icmp type 5 redirect message, which will be ignored by the host, beacuese it's come from the IP of the network card of the GW instead of the IP of the carp interface.
I can trigger the problem just by redirecting all syslogd traffic to remote syslogd that leaves in this new network.
>Fix:
Because of the BUG(?) of carp, shorter routes are not added on the host, but instead 
        if (error)
                goto done;

on line 345 of src/sys/net/route.c is triggered.

which calls:

        if (rt)
                rtfree(rt);

At this time rtfree is still locked (I'm not sure why, may be a race, may be not even checked)
So the proper solution is to check if rt is locked before calling rtfree(rt)?

>Release-Note:
>Audit-Trail:

From: Per olof Ljungmark <peo@intersonic.se>
To: bug-followup@FreeBSD.org,  stefan.lambrev@moneybookers.com
Cc:  
Subject: Re: kern/117913: rtfree() is being called where RTFREE_LOCKED() should
 be used.
Date: Thu, 08 Nov 2007 13:40:27 +0100

 The problem is not limited to CARP I think, we see exactly this 
 behaviour after an ICMP redirect but not using carp on fw.
 
 A packet that *could* trigger the issue looks like this example from a 
 remote rsync session:
 
 13:28:58.616390 IP (tos 0x0, ttl 255, id 33766, offset 0, flags [none], 
 proto: ICMP (1), length: 56) 192.168.1.254 > 192.168.1.8: ICMP redirect 
 172.16.2.17 to host 192.168.1.254, length 36
          IP (tos 0x8, ttl  64, id 18099, offset 0, flags [none], proto: 
 TCP (6), length: 52) 192.168.1.8.49865 > 172.16.2.17.22: [|tcp]
 
 I have not been able to sort out exactly which single packet that 
 triggers the rtfree message yet, in case it would differ from the above. 
 What is established in agreement with the OP is the type, ICMP Redirect.
 
Responsible-Changed-From-To: freebsd-bugs->kmacy 
Responsible-Changed-By: kmacy 
Responsible-Changed-When: Fri Nov 16 07:43:03 UTC 2007 
Responsible-Changed-Why:  

I have a number of fixes pending. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=117913 

From: Stefan Lambrev <stefan.lambrev@moneybookers.com>
To: bug-followup@FreeBSD.org
Cc: kip.macy@gmail.com
Subject: Re: kern/117913: rtfree() is being called where RTFREE_LOCKED() should
 be used.
Date: Thu, 20 Dec 2007 14:48:05 +0200

 This is a multi-part message in MIME format.
 --------------040902020707040700010909
 Content-Type: text/plain; charset=windows-1251; format=flowed
 Content-Transfer-Encoding: 7bit
 
 Hi,
 
 The attached patch seems to solve this issue.
 Let me know, if I did something stupid :)
 
 -- 
 
 Best Wishes,
 Stefan Lambrev
 ICQ# 24134177
 
 
 --------------040902020707040700010909
 Content-Type: text/x-patch;
  name="route.patch"
 Content-Transfer-Encoding: 7bit
 Content-Disposition: inline;
  filename="route.patch"
 
 --- sys/net/route.c.orig	2007-12-19 13:21:08.000000000 +0100
 +++ sys/net/route.c	2007-12-19 13:21:19.000000000 +0100
 @@ -396,7 +396,7 @@
  		error = EHOSTUNREACH;
  done:
  	if (rt)
 -		rtfree(rt);
 +		RTFREE_LOCKED(rt);
  out:
  	if (error)
  		rtstat.rts_badredirect++;
 
 --------------040902020707040700010909--

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/117913: commit references a PR
Date: Wed, 13 Feb 2008 16:58:03 +0000 (UTC)

 jhb         2008-02-13 16:57:58 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/net              route.c 
   Log:
   Use RTFREE_LOCKED() instead of rtfree() when releasing a reference on the
   'rt' route in rtredirect() as 'rt' is always locked.
   
   MFC after:      1 week
   PR:             kern/117913
   Submitted by:   Stefan Lambrev  stefan.lambrev of moneybookers.com
   
   Revision  Changes    Path
   1.126     +1 -1      src/sys/net/route.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: linimon 
State-Changed-When: Thu Feb 28 00:25:55 UTC 2008 
State-Changed-Why:  
A patch has been committed. 


Responsible-Changed-From-To: kmacy->jhb 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Thu Feb 28 00:25:55 UTC 2008 
Responsible-Changed-Why:  
Since jhb committed the patch, assign it to him.  kmacy: you'll need to 
work with him to iron out any issues of overlap, I guess. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=117913 
State-Changed-From-To: patched->closed 
State-Changed-By: jhb 
State-Changed-When: Wed Mar 5 20:33:54 UTC 2008 
State-Changed-Why:  
Patch merged to 7.x.  Will not merge to 6.x as 6.x doesn't have the warning 
message and the change is not a bug fix, just an optimization in 7. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=117913 
>Unformatted:
