Subject: Reproducable panic: Digital Unix 4.0B, mrouted.

From: Christopher Samuel <[email-masked]>
Date: Fri, 13 Jun 1997 15:13:53 +0100

Current situation:

DEC Alpha 500/266, DU 4.0B (with current patch cluster), either shipped
mrouted or mrouted-3.9-beta2 configured with at least one tunnel.
OSF1 cray.eris.dera.gov.uk V4.0 564 alpha

Can be reproduced using genvmunix, as well as reconfig'd kernels.

Tools such as mtrace and mrinfo work fine, however as soon as sdr is
started up on its network it panics with a "kernel memory fault".

Traceback is:

>  0 boot(0x0, 0xfffffc0003eed340, 0x2100000021, 0x6700000021, 0x8)
     ["../../../../src/kernel/arch/alpha/machdep.c":2484, 0xfffffc0000492dcc]
   1 panic(s = 0xfffffc0000610190 = "kernel memory fault")
     ["../../../../src/kernel/bsd/subr_prf.c":791, 0xfffffc000027ac6c]
   2 trap()
     ["../../../../src/kernel/arch/alpha/trap.c":1520, 0xfffffc000049ac68]
   3 _XentMM(0x0, 0xfffffc000029fb30, 0xfffffc000063c110, 0x0,
     0xfffffc00025a2100)
     ["../../../../src/kernel/arch/alpha/locore.s":1424, 0xfffffc000048ed34]
   4 lock_holder(l = (nil))
     ["../../../../src/kernel/kern/lock.c":1715, 0xfffffc000029fb2c]
   5 socket_send(s = 0xfffffc0000f12780, mm = 0xfffffc00025a2100,
     src = 0xfffffc00005fd840)
     ["../../../../src/kernel/netinet/ip_mroute.c":1204, 0xfffffc000039e850]
   6 ip_mforward(ip = 0xfffffc000063c110, ifp = 0xfffffc000065f1a8,
     m = 0xfffffc00025a2100)
     ["../../../../src/kernel/netinet/ip_mroute.c":1446, 0xfffffc000039ede8]
   7 ipintr(0xfffffc000039b228, 0xfffffc0000644260, 0xfffffc0000661370,
     0xfffffc0000643c90, 0xfffffc000069b188)
     ["../../../../src/kernel/netinet/ip_input.c":797
     , 0xfffffc000039ba38]
   8 netisr_thread() ["../../../../src/kernel/net/netisr.c":841,
     0xfffffc00002b6570]

I suspect that mrouted is tickling a bug in 4.0B that's more general
than multicasting as I've seen other panic's from unrelated code before
I started playing with multicast, but this is the first crash-on-demand
panic I've had.

It goes without saying that I'm going to report this to Digital directly
as well.

cheers,
Chris
-- 
 Christopher Samuel,   IT Vulnerabilities Group,   [email-masked]
 N-115, Defence Research Agency, St Andrews Road, Great Malvern, England, UK
 DISCLAIMER: I write only for myself, not for DRA.    Phone: +44 1684 894644
 +MIME+                           +QMAIL+                              +PGP+

---

From: Ajay Kachrani USG <[email-masked]>
Date: Tue, 17 Jun 1997 10:57:53 -0500 (EDT)

There is a fix available as a patch for V4.x from regular Digital Support 
channels for this problem (as Bill mentioned, problem w/ locking in 
ip_mroute.o a kernel module). 

I will post a patch number etc...in a day or so.

--Ajay Kachrani