NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/39664: Stopping mrouted causes kernel panic

>Number:         39664
>Category:       kern
>Synopsis:       Stopping mrouted causes kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 01 11:15:01 +0000 2008
>Originator:     Dave Huang
>Release:        NetBSD 4.99.72
Name: Dave Huang         |  Mammal, mammal / their names are called /
INet: |  they raise a paw / the bat, the cat /
FurryMUCK: Dahan         |  dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 31 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++
System: NetBSD 4.99.72 NetBSD 4.99.72 (YERFABLE) #0: Sat 
Sep 27 21:42:24 CDT 2008
Architecture: alpha
Machine: alpha
        Killing mrouted causes the kernel to crash with a fatal page
fault in supervisor mode. A stack trace points to ip_mrouter_done() as
the culprit.

        Configure /etc/mrouted.conf, start mrouted, then kill it.
        I think if mfchashtbl was allocated with hashinit(9), it
should be freed with hashdone(9), rather than free(9), right?

Index: ip_mroute.c
RCS file: /cvsroot/src/sys/netinet/ip_mroute.c,v
retrieving revision 1.115
diff -u -r1.115 ip_mroute.c
--- ip_mroute.c 6 Aug 2008 15:01:23 -0000       1.115
+++ ip_mroute.c 1 Oct 2008 11:02:17 -0000
@@ -694,7 +694,7 @@
        bzero((void *)nexpire, sizeof(nexpire));
-       free(mfchashtbl, M_MRTABLE);
+       hashdone(mfchashtbl, HASH_LIST, mfchash);
        mfchashtbl = NULL;
        bw_upcalls_n = 0;


Home | Main Index | Thread Index | Old Index