Jarek Poplawski wrote, On 05/15/2009 12:12 PM:

On Fri, May 15, 2009 at 12:54:14PM +0400, Alexander V. Lukyanov wrote:

quoted

On Fri, May 15, 2009 at 08:06:49AM +0000, Jarek Poplawski wrote:

quoted

On Fri, May 15, 2009 at 11:19:46AM +0400, Alexander V. Lukyanov wrote:
...

quoted

Looks like 2.6.28.10 does not have this refcnt problem. Also, after I have
reversed net/ipv4/route.c changes from 2.6.29, the problem does not occur either.

Very nice work! It should be a piece of cake now - there were not much
changes. I'll look at it, as usual ;-), but, of course if it's
possible, it would be great to try "in the meantime" with reverted the
biggest of them append below.

I suspect the problem occurs when cand==rthi.

Looks like good catch! (But there could be more than this.) Then, of
course it would be interesting to try first some fix (like nulling
rthi after rt_free(cand), I guess).

On the other hand, since this looks like quite obvious bug (even if it
doesn't fix your problem), feel free to send here a patch fixing it any
way you like without waiting for the final test results (Cc-ing authors
of the offending patch, I hope).

Jarek P.