From nobody@FreeBSD.ORG Wed Aug 18 12:02:03 1999
Return-Path: <nobody@FreeBSD.ORG>
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 7D5EF157EF; Wed, 18 Aug 1999 12:02:03 -0700 (PDT)
Message-Id: <19990818190203.7D5EF157EF@hub.freebsd.org>
Date: Wed, 18 Aug 1999 12:02:03 -0700 (PDT)
From: colle@krtkg1.rug.ac.be
Sender: nobody@FreeBSD.ORG
To: freebsd-gnats-submit@freebsd.org
Subject: panic("rtfree"); when sending bootp requests to machine
X-Send-Pr-Version: www-1.0

>Number:         13232
>Category:       kern
>Synopsis:       panic("rtfree"); when sending bootp requests to machine
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    ceri
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Aug 18 12:10:01 PDT 1999
>Closed-Date:    Sun Jun 08 11:00:45 PDT 2003
>Last-Modified:  Sun Jun 08 11:00:45 PDT 2003
>Originator:     Christophe Colle
>Release:        3.2-RELEASE.
>Organization:
>Environment:
FreeBSD portable.is.cool 3.2-RELEASE FreeBSD 3.2-RELEASE #0: Sun Aug 15 20:59:50 CEST 1999     root@portable.is.cool:/usr/src/sys/compile/PORTABLE  i386
>Description:
Machine crashes when sending bootp-packets to a machine,
without a defaultroute and where the entry for the bootpclient 
is not complete (incomplete in the sense that the hostname could not
be resolved to a valid ip-address)


>How-To-Repeat:
1) enable bootp-service in /etc/inetd
2) create the following /etc/bootptab
mopie:ha=0000e8543231:bf=init:dn=test.net:ds=192.168.1.1:rp=/usr/path:sa=192.168.1.1
3) make sure 'mopie' cannot be resolved
4) delete default route:   route delete default
5) let bootpclient mopie send some bootprequests
and enjoy the core  ;-)

I've seen the same behavior for FreeBD-2.2.6 and FreeBSD-4.0-19990307-SNAP
>Fix:
temporary fix: add a default route, or make sure you don't mistype
hostnames ;-)


>Release-Note:
>Audit-Trail:

From: "Massa.Hatanaka" <hatanaka@open.nm.fujitsu.co.jp>
To: freebsd-gnats-submit@freebsd.org
Cc: colle@krtkg1.rug.ac.be, hatanaka@open.nm.fujitsu.co.jp
Subject: Re: kern/13232: panic("rtfree"); when sending bootp requests to machine
Date: Thu, 16 Sep 1999 11:06:19 JST

 Altough I am not sure to fix, you can try the following fixes.
 Hope that helps.
 
 -Massa. Hatanaka
 
 ==
 [1] For aged bug
 
     route_output():sys/net/rtsock.c
 
 		if ((rnh = rt_tables[dst->sa_family]) == 0) {
 			senderr(EAFNOSUPPORT);
 		} else if (rt = (struct rtentry *)
 				rnh->rnh_lookup(dst, netmask, rnh))
 	#ifdef	notdef
 			rt->rt_refcnt++;
 	#else   /* notdef */
 		{
 			if (rt->rt_nodes[0].rn_flags & RNF_ROOT) {
 				rt = 0;
 				senderr(ESRCH);
 			}
 			rt->rt_refcnt++;
 		}
 	#endif  /* notdef */
 		else
 			senderr(ESRCH);
 
 [2] For young bug
 
     in_matroute():sys/netinet/in_rmx.c
 
 	static struct radix_node *
 	in_matroute(void *v_arg, struct radix_node_head *head)
 	{
 		struct radix_node *rn = rn_match(v_arg, head);
 		struct rtentry *rt = (struct rtentry *)rn;
 
 #ifdef  notdef
 #endif  /* notdef */
 		if (rn && (rn->rn_flags & RNF_ROOT)) {
 			return (rn);
 		}
 #endif  /* notdef */
 		if(rt && rt->rt_refcnt == 0) { /* this is first reference */
 			if(rt->rt_flags & RTPRF_OURS) {
 				rt->rt_flags &= ~RTPRF_OURS;
 				rt->rt_rmx.rmx_expire = 0;
 			}
 		}
 		return rn;
 	}
 
 ===
 Massa. Hatanaka                                Fujitsu Limited, Japan
 /* E-Mail: masoh@itspf.fujitsu.oz.au */
 E-Mail: hatanaka@open.nm.fujitsu.co.jp
 

From: Christophe Colle <colle@pandora.be>
To: "Massa.Hatanaka" <hatanaka@open.nm.fujitsu.co.jp>
Cc: freebsd-gnats-submit@freebsd.org
Subject: Re: kern/13232: panic("rtfree"); when sending bootp requests to
 machine
Date: Wed, 22 Sep 1999 08:12:59 +0200 (MET DST)

 Hi,
 
 I patched the kernel with this updated, and now it seems to work
 fine...
 Thanks!
 
 cc
 
 On Thu, 16 Sep 1999, Massa.Hatanaka wrote:
 
 > Date: Thu, 16 Sep 1999 11:06:18 JST
 > From: Massa.Hatanaka <hatanaka@open.nm.fujitsu.co.jp>
 > To: freebsd-gnats-submit@freebsd.org
 > Cc: colle@krtkg1.rug.ac.be, hatanaka@open.nm.fujitsu.co.jp
 > Subject: Re: kern/13232: panic("rtfree"); when sending bootp requests to
     machine
 > 
 > Altough I am not sure to fix, you can try the following fixes.
 > Hope that helps.
 > 
 > -Massa. Hatanaka
 > 
 > ==
 > [1] For aged bug
 > 
 >     route_output():sys/net/rtsock.c
 > 
 > 		if ((rnh = rt_tables[dst->sa_family]) == 0) {
 > 			senderr(EAFNOSUPPORT);
 > 		} else if (rt = (struct rtentry *)
 > 				rnh->rnh_lookup(dst, netmask, rnh))
 > 	#ifdef	notdef
 > 			rt->rt_refcnt++;
 > 	#else   /* notdef */
 > 		{
 > 			if (rt->rt_nodes[0].rn_flags & RNF_ROOT) {
 > 				rt = 0;
 > 				senderr(ESRCH);
 > 			}
 > 			rt->rt_refcnt++;
 > 		}
 > 	#endif  /* notdef */
 > 		else
 > 			senderr(ESRCH);
 > 
 > [2] For young bug
 > 
 >     in_matroute():sys/netinet/in_rmx.c
 > 
 > 	static struct radix_node *
 > 	in_matroute(void *v_arg, struct radix_node_head *head)
 > 	{
 > 		struct radix_node *rn = rn_match(v_arg, head);
 > 		struct rtentry *rt = (struct rtentry *)rn;
 > 
 > #ifdef  notdef
 > #endif  /* notdef */
 > 		if (rn && (rn->rn_flags & RNF_ROOT)) {
 > 			return (rn);
 > 		}
 > #endif  /* notdef */
 > 		if(rt && rt->rt_refcnt == 0) { /* this is first reference */
 > 			if(rt->rt_flags & RTPRF_OURS) {
 > 				rt->rt_flags &= ~RTPRF_OURS;
 > 				rt->rt_rmx.rmx_expire = 0;
 > 			}
 > 		}
 > 		return rn;
 > 	}
 > 
 > ===
 > Massa. Hatanaka                                Fujitsu Limited, Japan
 > /* E-Mail: masoh@itspf.fujitsu.oz.au */
 > E-Mail: hatanaka@open.nm.fujitsu.co.jp
 > 
 
 ---
 
 you type win, but you lose
 
 The Internet doesn't really need admins that are dumber than 
 the ones we have already.
 ----
 
 Christophe Colle
 
 Telenet, Liersesteenweg 4, 2800 Mechelen, Belgium
     tel:+32(0)15.333.981
     mailto:christophe.colle@telenet.be
     http://krtkg1.rug.ac.be/~colle
 
 
 
 
State-Changed-From-To: open->feedback 
State-Changed-By: iedowse 
State-Changed-When: Fri Nov 16 14:28:39 PST 2001 
State-Changed-Why:  

Hi, do you know if this problem still exists in FreeBSD? The 
particular code doesn't seem to have changed since, so I suspect 
the bug is still there? 


http://www.FreeBSD.org/cgi/query-pr.cgi?pr=13232 
State-Changed-From-To: feedback->closed 
State-Changed-By: ceri 
State-Changed-When: Sun Jun 8 11:00:42 PDT 2003 
State-Changed-Why:  
Feedback timeout (6 months or more). 
I will handle any feedback that this closure generates. 


Responsible-Changed-From-To: freebsd-bugs->ceri 
Responsible-Changed-By: ceri 
Responsible-Changed-When: Sun Jun 8 11:00:42 PDT 2003 
Responsible-Changed-Why:  
Feedback timeout (6 months or more). 
I will handle any feedback that this closure generates. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=13232 
>Unformatted:
