Re: panic: bogus refcnt 0 on lle 0xfffff80121a13a00

On Tue, Jul 12, 2016 at 10:55:31AM +0200, Hans Petter Selasky wrote:
> On 07/12/16 10:37, Peter Holm wrote:
> > Exiting from single-user mode triggers this:
> >
> > ifa_maintain_loopback_route: deletion failed for interface igb0: 3
> > panic: bogus refcnt 0 on lle 0xfffff80121a13a00
> > cpuid = 9
> > KDB: stack backtrace:
> > db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe1048c63470
> > vpanic() at vpanic+0x182/frame 0xfffffe1048c634f0
> > kassert_panic() at kassert_panic+0x126/frame 0xfffffe1048c63560
> > llentry_free() at llentry_free+0x136/frame 0xfffffe1048c63590
> > in_lltable_free_entry() at in_lltable_free_entry+0xb0/frame 0xfffffe1048c635c0
> > htable_prefix_free() at htable_prefix_free+0xce/frame 0xfffffe1048c63620
> > lltable_prefix_free() at lltable_prefix_free+0x5d/frame 0xfffffe1048c63660
> > in_scrubprefix() at in_scrubprefix+0x290/frame 0xfffffe1048c63700
> > in_difaddr_ioctl() at in_difaddr_ioctl+0x285/frame 0xfffffe1048c63750
> > in_control() at in_control+0x96/frame 0xfffffe1048c637d0
> > ifioctl() at ifioctl+0xda1/frame 0xfffffe1048c63860
> > kern_ioctl() at kern_ioctl+0x246/frame 0xfffffe1048c638c0
> > sys_ioctl() at sys_ioctl+0x171/frame 0xfffffe1048c639a0
> > amd64_syscall() at amd64_syscall+0x2f6/frame 0xfffffe1048c63ab0
> > Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe1048c63ab0
> > --- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x800fd2eba, rsp = 0x7fffffffe468, rbp = 0x7fffffffe4b0 -
> >
> > Details _at_ https://people.freebsd.org/~pho/stress/log/bogus_refcnt.txt
> >
> 
> FYI:
> https://reviews.freebsd.org/D4605
> 
> Might be related.
> 
> --HPS

No difference with this patch (- netinet6/nd6.c).

BTW The problem is really easy to reproduce: init 1 followed by
"exit" in the single-user shell.

-- 
Peter