Bug 85780 - 'panic: bogus refcnt 0' in routing/ipv6
Summary: 'panic: bogus refcnt 0' in routing/ipv6
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-09-06 05:10 UTC by Kris Kennaway
Modified: 2018-01-03 05:16 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kris Kennaway freebsd_committer 2005-09-06 05:10:11 UTC
This panic occurred on an SMP sparc64 machine.

> panic: bogus refcnt 0
> cpuid = 0
> KDB: enter: panic
> [thread pid 15 tid 100003 ]
> Stopped at      kdb_enter+0x3c: ta              %xcc, 1
> db> wh
> Tracing pid 15 tid 100003 td 0xfffff8001fb75680
> panic() at panic+0x164
> rtfree() at rtfree+0x7c
> nd6_na_output() at nd6_na_output+0x4d0
> nd6_ns_input() at nd6_ns_input+0x704
> icmp6_input() at icmp6_input+0xc38
> ip6_input() at ip6_input+0xf5c
> netisr_processqueue() at netisr_processqueue+0x7c
> swi_net() at swi_net+0xdc
> ithread_loop() at ithread_loop+0x18c
> fork_exit() at fork_exit+0x94
> fork_trampoline() at fork_trampoline+0x8

  It uses ipv6 to e.g. mount nfs /home directories and for ssh traffic, but the machine seems to have been idle at the time of panic (no other processes active on the other CPUs, and nothing much else running on the system either).  core available.

How-To-Repeat: It's only happened once so far.
Comment 1 Kris Kennaway 2005-09-07 07:16:59 UTC
On Tue, Sep 06, 2005 at 04:00:34AM +0000, Kris Kennaway wrote:

> This panic occurred on an SMP sparc64 machine.
> 
> > panic: bogus refcnt 0
> > cpuid = 0
> > KDB: enter: panic
> > [thread pid 15 tid 100003 ]
> > Stopped at      kdb_enter+0x3c: ta              %xcc, 1
> > db> wh
> > Tracing pid 15 tid 100003 td 0xfffff8001fb75680
> > panic() at panic+0x164
> > rtfree() at rtfree+0x7c
> > nd6_na_output() at nd6_na_output+0x4d0
> > nd6_ns_input() at nd6_ns_input+0x704
> > icmp6_input() at icmp6_input+0xc38
> > ip6_input() at ip6_input+0xf5c
> > netisr_processqueue() at netisr_processqueue+0x7c
> > swi_net() at swi_net+0xdc
> > ithread_loop() at ithread_loop+0x18c
> > fork_exit() at fork_exit+0x94
> > fork_trampoline() at fork_trampoline+0x8

I have a core from this panic.  I also got another one on a different
machine:

panic() at panic+0x164
rtfree() at rtfree+0x7c
nd6_ns_output() at nd6_ns_output+0x48c
nd6_timer() at nd6_timer+0x244
softclock() at softclock+0x22c
ithread_loop() at ithread_loop+0x18c
fork_exit() at fork_exit+0x94
fork_trampoline() at fork_trampoline+0x8

(core also available).

Kris
Comment 2 Herve Boulouis 2006-10-11 17:33:00 UTC
I got the following panic on a i386 6.2-PRELEASE system :

Machine was nearly idle at the time and has no ipv6 services (but
a completely configured ipv6 stack)

panic: bogus refcnt 0
Uptime: 1d14h3m32s
Dumping 511 MB (2 chunks)
  chunk 0: 1MB (160 pages) ... ok
  chunk 1: 511MB (130800 pages) 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

backtrace :

(kgdb) bt
#0  0xc05e069c in doadump ()
#1  0xc05e0c12 in boot ()
#2  0xc05e0f4d in panic ()
#3  0xc067079c in rtfree ()
#4  0xc06b7247 in nd6_na_output ()
#5  0xc06b5f93 in nd6_ns_input ()
#6  0xc069a788 in icmp6_input ()
#7  0xc06a99bb in ip6_input ()
#8  0xc066c13e in netisr_processqueue ()
#9  0xc066c353 in swi_net ()
#10 0xc05c8e18 in ithread_execute_handlers ()
#11 0xc05c8f93 in ithread_loop ()
#12 0xc05c7b61 in fork_exit ()

kernel config :

machine         i386
cpu             I686_CPU
ident           GENERIC-NERIM

# To statically compile in device wiring instead of /boot/device.hints
#hints          "GENERIC.hints"         # Default places to look for devices.

options         SCHED_4BSD              # 4BSD scheduler
options         PREEMPTION              # Enable kernel thread preemption
options         INET                    # InterNETworking
options         INET6                   # IPv6 communications protocols
options         FFS                     # Berkeley Fast Filesystem
options         SOFTUPDATES             # Enable FFS soft updates support
options         UFS_ACL                 # Support for access control lists
options         UFS_DIRHASH             # Improve performance on big directories
options         UFS_EXTATTR
options         UFS_EXTATTR_AUTOSTART
options         MD_ROOT                 # MD is a potential root device
options         NFSCLIENT               # Network Filesystem Client
options         NFSSERVER               # Network Filesystem Server
options         NFS_ROOT                # NFS usable as /, requires NFSCLIENT
options         MSDOSFS                 # MSDOS Filesystem
options         CD9660                  # ISO 9660 Filesystem
options         UDF
options         PROCFS                  # Process filesystem (requires PSEUDOFS)
options         PSEUDOFS                # Pseudo-filesystem framework
options         GEOM_GPT                # GUID Partition Tables.
options         COMPAT_43               # Compatible with BSD 4.3 [KEEP THIS!]
options         COMPAT_FREEBSD4         # Compatible with FreeBSD4
options         SCSI_DELAY=5000 # Delay (in ms) before probing SCSI
options         KTRACE                  # ktrace(1) support
options         SYSVSHM                 # SYSV-style shared memory
options         SYSVMSG                 # SYSV-style message queues
options         SYSVSEM                 # SYSV-style semaphores
options         _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options         KBD_INSTALL_CDEV        # install a CDEV entry in /dev
options         AHC_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~128k to driver.
options         AHD_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~215k to driver.
options         ADAPTIVE_GIANT          # Giant mutex is adaptive.

device          apic                    # I/O APIC

# Bus support.  Do not remove isa, even if you have no isa slots
device          isa
device          eisa
device          pci

# Floppy drives
device          fdc

# ATA and ATAPI devices
device          ata
device          atadisk         # ATA disk drives
device          ataraid         # ATA RAID drives
device          atapicd         # ATAPI CDROM drives
device          atapifd         # ATAPI floppy drives
options         ATA_STATIC_ID   # Static device numbering

# SCSI Controllers
device          ahc             # AHA2940 and onboard AIC7xxx devices
device          ahd             # AHA39320/29320 and onboard AIC79xx devices
device          amd             # AMD 53C974 (Tekram DC-390(T))
device          isp             # Qlogic family
device          sym             # NCR/Symbios Logic (newer chipsets + those of `ncr')
device          trm             # Tekram DC395U/UW/F DC315U adapters

# SCSI peripherals
device          scbus           # SCSI bus (required for SCSI)
device          da              # Direct Access (disks)
device          sa              # Sequential Access (tape etc)
device          cd              # CD
device          pass            # Passthrough device (direct SCSI access)
device          ses             # SCSI Environmental Services (and SAF-TE)

# RAID controllers interfaced to the SCSI subsystem
device          amr             # AMI MegaRAID
device          asr             # DPT SmartRAID V, VI and Adaptec SCSI RAID
device          mly             # Mylex AcceleRAID/eXtremeRAID
# RAID controllers
device          aac             # Adaptec FSA RAID
device          mpt

# atkbdc0 controls both the keyboard and the PS/2 mouse
device          atkbdc          # AT keyboard controller
device          atkbd           # AT keyboard
device          psm             # PS/2 mouse

device          vga             # VGA video card driver
device          splash          # Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device          sc

# Floating point support - do not disable.
device          npx

# Add suspend/resume support for the i8254.
device          pmtimer

# Serial (COM) ports
device          sio             # 8250, 16[45]50 based serial ports

# If you've got a "dumb" serial or parallel PCI card that is
# supported by the puc(4) glue driver, uncomment the following
# line to enable it (connects to the sio and/or ppc drivers):
#device         puc

# PCI Ethernet NICs.
device          de              # DEC/Intel DC21x4x (``Tulip'')
device          em              # Intel PRO/1000 adapter Gigabit Ethernet Card
device          sk              # some embedded 3com chipsets
device          bge             # Broadcom BCM570x (``Tigon III'')

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device          miibus          # MII bus support
device          dc              # DEC/Intel 21143 and various workalikes
device          fxp             # Intel EtherExpress PRO/100B (82557, 82558)
device          rl              # RealTek 8129/8139
device          vr              # VIA Rhine, Rhine II
device          xl              # 3Com 3c90x (``Boomerang'', ``Cyclone'')

# Pseudo devices.
device          loop            # Network loopback
device          mem             # Memory and kernel memory devices
device          io              # I/O device
device          random          # Entropy device
device          ether           # Ethernet support
device          ppp             # Kernel PPP
device          tun             # Packet tunnel.
device          pty             # Pseudo-ttys (telnet etc)
device          md              # Memory "disks"
device          gif             # IPv6 and IPv4 tunneling
device          vlan            #VLAN support (needs miibus)

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
device          bpf             # Berkeley packet filter

# SMB bus
device          smbus           # Bus support, required for smb below.
device          intpm           # Intel PIIX4 (82371AB, 82443MX) Power Management Unit
device          ichsmb          # Intel ICH SMBus controller chips (82801AA, 82801AB, 82801BA)
device          smb             # standard io through /dev/smb*

# i2c bus
device          iicbus          # Bus support, required for ic/iic/iicsmb below.
device          iicbb

device          ic              # i2c network interface
device          iic             # i2c standard io
device          iicsmb          # smb over i2c bridge

# firewall 

options         IPFILTER
options         IPFILTER_LOG

options         ZERO_COPY_SOCKETS
options         NBUF=0

options   INVARIANTS
options   INVARIANT_SUPPORT

kernel & vmcore available on request.

-- 
Herve Boulouis
Comment 3 Bruce Cran freebsd_committer 2009-03-25 12:33:50 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-net

Over to maintainer(s).
Comment 4 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 08:00:32 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped