kern/60777: panic: rn_init 2

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60777
>Category:       kern
>Synopsis:       panic: rn_init 2
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Sep 23 15:10:01 +0000 2026
>Originator:     Taylor R Campbell
>Release:        11
>Organization:
Acme Crash-Test Daemons Ltd.
>Environment:
>Description:

	Every few hundred or thousand times I try running some rumpy
	test programs, it crashes at boot with a panic:

[   1.0000000] entropy: ready
[   1.0000050] panic: rn_init 2
[   1.0000050] rump kernel halting...

	Stack trace:

Core was generated by `t_fdrestart'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007af35b4ec95a in _lwp_kill () from /usr/lib/libc.so.12
[Current thread is 1 (process 13134)]
#0  0x00007af35b4ec95a in _lwp_kill () from /usr/lib/libc.so.12
#1  0x00007af35b4f8d94 in abort () at /home/riastradh/netbsd/current/src/lib/libc/stdlib/abort.c:74
#2  0x00007af35b7be74f in rumpuser_exit (rv=rv@entry=-1) at /home/riastradh/netbsd/current/src/lib/librumpuser/rumpuser.c:236
#3  0x00007af35b8b3bc8 in cpu_reboot (howto=<optimized out>, bootstr=<optimized out>) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/emul.c:447
#4  0x00007af35b85a06b in kern_reboot (howto=4, bootstr=0x0) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/../../../kern/kern_reboot.c:91
#5  0x00007af35b85945f in vpanic (fmt=<optimized out>, ap=ap@entry=0x7f7fff508a68) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/../../../kern/subr_prf.c:288
#6  0x00007af35b859530 in panic (fmt=<optimized out>) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/../../../kern/subr_prf.c:209
#7  0x00007af35b930458 in rn_init () at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpnet/../../../net/radix.c:1138
#8  0x00007af35ba03c76 in rt_init () at /home/riastradh/netbsd/current/src/sys/rump/net/lib/libnet/../../../../net/route.c:494
#9  0x00007af35ba0296e in route_init () at /home/riastradh/netbsd/current/src/sys/rump/net/lib/libnet/../../../../net/rtsock_shared.c:1729
#10 0x00007af35b9448ca in domain_attach (dp=0x7af35ba31e20 <rumpns_routedomain>) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpnet/../../../kern/uipc_domain.c:151
#11 0x00007af35b9787b0 in rumpcompinitRUMP_COMPONENT_NET_ROUTE () at /home/riastradh/netbsd/current/src/sys/rump/net/lib/libnet/net_component.c:59
#12 0x00007af35b8b4030 in rump_component_init (type=type@entry=RUMP_COMPONENT_NET_ROUTE) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/rump.c:615
#13 0x00007af35b931a13 in rumpcompinitRUMP__FACTION_NET () at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpnet/rump_net.c:56
#14 0x00007af35b8b4030 in rump_component_init (type=type@entry=RUMP__FACTION_NET) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/rump.c:615
#15 0x00007af35b8b469f in rump_init_callback (cpuinit_callback=cpuinit_callback@entry=0x0) at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/rump.c:436
#16 0x00007af35b8b49e2 in rump_init () at /home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/rump.c:505
#17 0x000000000094af92 in atfu_fifo_pollwrite_body (tc=<optimized out>) at /home/riastradh/netbsd/current/src/tests/kernel/t_fdrestart.c:507
#18 0x00007af35b79e1cf in atf_tc_run (tc=0xb50238 <atfu_fifo_pollwrite_tc>, resfile=<optimized out>) at /home/riastradh/netbsd/current/src/external/bsd/atf/dist/atf-c/tc.c:1024
#19 0x00007af35b79b00e in atf_tp_run (tp=tp@entry=0x7f7fff508ef0, tcname=<optimized out>, resfile=<optimized out>) at /home/riastradh/netbsd/current/src/external/bsd/atf/dist/atf-c/tp.c:205
#20 0x00007af35b79ab95 in run_tc (tp=0x7f7fff508ef0, p=0x7f7fff508f10, exitcode=<synthetic pointer>) at /home/riastradh/netbsd/current/src/external/bsd/atf/dist/atf-c/detail/tp_main.c:510
#21 controlled_main (argc=<optimized out>, argv=<optimized out>, add_tcs_hook=0x94b03e <atfu_tp_add_tcs>, exitcode=<synthetic pointer>) at /home/riastradh/netbsd/current/src/external/bsd/atf/dist/atf-c/detail/tp_main.c:580
#22 atf_tp_main (argc=<optimized out>, argv=<optimized out>, add_tcs_hook=add_tcs_hook@entry=0x94b03e <atfu_tp_add_tcs>) at /home/riastradh/netbsd/current/src/external/bsd/atf/dist/atf-c/detail/tp_main.c:610
#23 0x000000000094c8c6 in main (argc=<optimized out>, argv=<optimized out>) at /home/riastradh/netbsd/current/src/tests/kernel/t_fdrestart.c:781
#24 0x000000000094a649 in ___start (cleanup=<optimized out>, ps_strings=0x7f7fff509fe0) at /home/riastradh/netbsd/current/src/lib/csu/common/crt0-common.c:376
#25 0x00007f7ff7589780 in ?? () from /usr/libexec/ld.elf_so
#26 0x0000000000000005 in ?? ()
#27 0x00007f7fff5095a0 in ?? ()
#28 0x00007f7fff5095ac in ?? ()
#29 0x00007f7fff5095c6 in ?? ()
#30 0x00007f7fff5095da in ?? ()
#31 0x00007f7fff5095f5 in ?? ()
#32 0x0000000000000000 in ?? ()
Stack trace complete

	This happens presumably because the underlying allocation is a
	malloc(M_NOWAIT) allocation:

   1137 	if (rn_inithead((void *)&mask_rnhead, 0) == 0)
   1138 		panic("rn_init 2");

	https://nxr.netbsd.org/xref/src/sys/net/radix.c?r=1.49#1137

   1065 int
   1066 rn_inithead(void **head, int off)
   1067 {
   1068 	struct radix_node_head *rnh;
   1069 
   1070 	if (*head != NULL)
   1071 		return 1;
   1072 	R_Malloc(rnh, struct radix_node_head *, sizeof (*rnh));
   1073 	if (rnh == NULL)
   1074 		return 0;

	https://nxr.netbsd.org/xref/src/sys/net/radix.c?r=1.49#1065

    130 #define R_Malloc(p, t, n) (p = (t) malloc((size_t)(n), M_RTABLE, M_NOWAIT))

	https://nxr.netbsd.org/xref/src/sys/net/radix.h?r=1.23#130

>How-To-Repeat:

	cd /usr/tests/kernel && while atf-run t_fdrestart; do :; done

>Fix:

	Perhaps it should be changed to an M_WAITOK allocation, either
	generally in R_Malloc, or just in rn_inithead, or specifically
	in rn_inithead when called from rn_init.