kern/39664: Stopping mrouted causes kernel panic

[khym%azeotrope.org@localhost]

>Number:         39664
>Category:       kern
>Synopsis:       Stopping mrouted causes kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 01 11:15:01 +0000 2008
>Originator:     Dave Huang
>Release:        NetBSD 4.99.72
>Organization:
Name: Dave Huang         |  Mammal, mammal / their names are called /
INet: khym%azeotrope.org@localhost |  they raise a paw / the bat, the cat /
FurryMUCK: Dahan         |  dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 31 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++
>Environment:
        
        
System: NetBSD yerfable.azeotrope.org 4.99.72 NetBSD 4.99.72 (YERFABLE) #0: Sat 
Sep 27 21:42:24 CDT 2008 
khym%cheetah.azeotrope.org@localhost:/usr/obj.alpha/sys/arch/alpha/compile/YERFABLE
 alpha
Architecture: alpha
Machine: alpha
>Description:
        Killing mrouted causes the kernel to crash with a fatal page
fault in supervisor mode. A stack trace points to ip_mrouter_done() as
the culprit.

>How-To-Repeat:
        Configure /etc/mrouted.conf, start mrouted, then kill it.
>Fix:
        I think if mfchashtbl was allocated with hashinit(9), it
should be freed with hashdone(9), rather than free(9), right?

Index: ip_mroute.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/ip_mroute.c,v
retrieving revision 1.115
diff -u -r1.115 ip_mroute.c
--- ip_mroute.c 6 Aug 2008 15:01:23 -0000       1.115
+++ ip_mroute.c 1 Oct 2008 11:02:17 -0000
@@ -694,7 +694,7 @@
        }
 
        bzero((void *)nexpire, sizeof(nexpire));
-       free(mfchashtbl, M_MRTABLE);
+       hashdone(mfchashtbl, HASH_LIST, mfchash);
        mfchashtbl = NULL;
 
        bw_upcalls_n = 0;

>Unformatted: