NetBSD Problem Report #50161

From ryo_on@yk.rim.or.jp  Sat Aug 22 11:07:32 2015
Return-Path: <ryo_on@yk.rim.or.jp>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 76485A65BA
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 22 Aug 2015 11:07:32 +0000 (UTC)
Message-Id: <20150822110728.CF00143F45@mail.SiriusCloud.jp>
Date: Sat, 22 Aug 2015 20:07:16 +0900
From: ryoon@NetBSD.org
Reply-To: ryoon@NetBSD.org
To: gnats-bugs@gnats.NetBSD.org
Subject: IPv6 DHCP environment is unstable (panic)
X-Send-Pr-Version: 3.95

>Number:         50161
>Category:       kern
>Synopsis:       IPv6 DHCP environment is unstable (panic)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    ozaki-r
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 22 11:10:00 +0000 2015
>Closed-Date:    Fri Sep 30 07:50:09 +0000 2016
>Last-Modified:  Fri Sep 30 07:50:09 +0000 2016
>Originator:     Ryo ONODERA
>Release:        NetBSD 7.99.21
>Organization:

>Environment:


System: NetBSD angelcake.elements.tetera.org 7.99.21 NetBSD 7.99.21 (DTRACE7) #116: Fri Aug 21 00:04:15 JST 2015 ryo_on@angelcake.elements.tetera.org:/usr/world/7.99/amd64/obj/sys/arch/amd64/compile/DTRACE7 amd64
Architecture: x86_64
Machine: amd64
>Description:
On IPv6 with DHCP environment, I have gotten endless
vmx0: removing route to 2400:402e:a337:8700::/64
vmx0: adding route to 2400:402e:a337:870

And finally have gotten panic.
Aug 19 21:20:38 carrotcake /netbsd: panic: kernel diagnostic assertion "rt->rt_refcnt > 0" failed: file "/mnt/nfs/src-current/src/sys/net/route.c", line 417 
Aug 19 21:20:38 carrotcake /netbsd: cpu0: Begin traceback...
Aug 19 21:20:38 carrotcake /netbsd: vpanic() at netbsd:vpanic+0x13c
Aug 19 21:20:38 carrotcake /netbsd: kern_assert() at netbsd:kern_assert+0x4f
Aug 19 21:20:38 carrotcake /netbsd: rtfree() at netbsd:rtfree+0xf5
Aug 19 21:20:38 carrotcake /netbsd: rtcache_clear() at netbsd:rtcache_clear+0x41
Aug 19 21:20:38 carrotcake /netbsd: rtcache_update() at netbsd:rtcache_update+0x12
Aug 19 21:20:38 carrotcake /netbsd: in6_pcbrtentry() at netbsd:in6_pcbrtentry+0xa4
Aug 19 21:20:38 carrotcake /netbsd: tcp_mss_from_peer() at netbsd:tcp_mss_from_peer+0x50
Aug 19 21:20:38 carrotcake /netbsd: tcp_input() at netbsd:tcp_input+0xc3b
Aug 19 21:20:38 carrotcake /netbsd: tcp6_input() at netbsd:tcp6_input+0x49
Aug 19 21:20:38 carrotcake /netbsd: ip6_input() at netbsd:ip6_input+0x561
Aug 19 21:20:38 carrotcake /netbsd: ip6intr() at netbsd:ip6intr+0x45
Aug 19 21:20:38 carrotcake /netbsd: softint_dispatch() at netbsd:softint_dispatch+0xd3
Aug 19 21:20:38 carrotcake /netbsd: DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe811d2bbff0
Aug 19 21:20:38 carrotcake /netbsd: Xsoftintr() at netbsd:Xsoftintr+0x4f
Aug 19 21:20:38 carrotcake /netbsd: --- interrupt ---
Aug 19 21:20:38 carrotcake /netbsd: 0:
Aug 19 21:20:38 carrotcake /netbsd: cpu0: End traceback...
Aug 19 21:20:38 carrotcake /netbsd: 
Aug 19 21:20:38 carrotcake /netbsd: dumping to dev 4,1 (offset=6256, size=4194191):
Aug 19 21:20:38 carrotcake /netbsd: dump WARNING: negative runtime; monotonic clock has gone backwards
Aug 19 21:20:38 carrotcake /netbsd: succeeded
Aug 19 21:20:38 carrotcake /netbsd: 
Aug 19 21:20:38 carrotcake /netbsd: 
Aug 19 21:20:38 carrotcake /netbsd: rebooting...

This is vmx(4) example, however I have same problem with axe(4).

0::/64
>How-To-Repeat:

Use IPv6 with DHCP on NetBSD/amd64 current.
>Fix:

I have no idea.

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->ozaki-r
Responsible-Changed-By: ozaki-r@NetBSD.org
Responsible-Changed-When: Fri, 28 Aug 2015 03:48:18 +0000
Responsible-Changed-Why:
mine


From: "Ryota Ozaki" <ozaki-r@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/50161 CVS commit: src/sys/netinet6
Date: Thu, 3 Sep 2015 00:54:39 +0000

 Module Name:	src
 Committed By:	ozaki-r
 Date:		Thu Sep  3 00:54:39 UTC 2015

 Modified Files:
 	src/sys/netinet6: nd6.c

 Log Message:
 Fix rtfree in nd6_output

 We have to check and avoid to rtfree the original rtentry passed to
 nd6_output even when manipulating gateway routes.

 This fixes panic on assertion "ro->_ro_rt ==NULL || ro->_ro_rt->rt_refcnt > 0"
 failure and probably PR kern/50161.


 To generate a diff of this commit:
 cvs rdiff -u -r1.174 -r1.175 src/sys/netinet6/nd6.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: ozaki-r@NetBSD.org
State-Changed-When: Fri, 04 Sep 2015 05:08:11 +0000
State-Changed-Why:
A possible fix has been committed. Could you try again with a latest kernel?


From: Ryo ONODERA <ryo_on@yk.rim.or.jp>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/50161 (IPv6 DHCP environment is unstable (panic))
Date: Mon, 12 Oct 2015 19:14:57 +0900 (JST)

 I have no longer kernel panic.
 However "adding route" and "removing route" are still emitted without end.
 Is this related to your fix?

 Thank you.

 --
 Ryo ONODERA // ryo_on@yk.rim.or.jp
 PGP fingerprint = 82A2 DC91 76E0 A10A 8ABB  FD1B F404 27FA C7D1 15F3

From: Ryota Ozaki <ozaki-r@netbsd.org>
To: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>
Cc: gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, ryoon@netbsd.org
Subject: Re: kern/50161 (IPv6 DHCP environment is unstable (panic))
Date: Tue, 13 Oct 2015 12:37:39 +0900

 On Mon, Oct 12, 2015 at 7:15 PM, Ryo ONODERA <ryo_on@yk.rim.or.jp> wrote:
 > The following reply was made to PR kern/50161; it has been noted by GNATS.
 >
 > From: Ryo ONODERA <ryo_on@yk.rim.or.jp>
 > To: gnats-bugs@netbsd.org
 > Cc:
 > Subject: Re: kern/50161 (IPv6 DHCP environment is unstable (panic))
 > Date: Mon, 12 Oct 2015 19:14:57 +0900 (JST)
 >
 >  I have no longer kernel panic.
 >  However "adding route" and "removing route" are still emitted without end.
 >  Is this related to your fix?

 No. So someone(TM) should investigate the issue...

   ozaki-r

From: Ryo ONODERA <ryo_on@yk.rim.or.jp>
To: gnats-bugs@NetBSD.org, ozaki-r@netbsd.org
Cc: 
Subject: Re: kern/50161 (IPv6 DHCP environment is unstable (panic))
Date: Wed, 14 Oct 2015 05:19:52 +0900 (JST)

 Hi,

 From: Ryota Ozaki <ozaki-r@netbsd.org>, Date: Tue, 13 Oct 2015 03:40:01 +0000 (UTC)

 > The following reply was made to PR kern/50161; it has been noted by GNATS.
 > 
 > From: Ryota Ozaki <ozaki-r@netbsd.org>
 > To: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>
 > Cc: gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, ryoon@netbsd.org
 > Subject: Re: kern/50161 (IPv6 DHCP environment is unstable (panic))
 > Date: Tue, 13 Oct 2015 12:37:39 +0900
 > 
 >  On Mon, Oct 12, 2015 at 7:15 PM, Ryo ONODERA <ryo_on@yk.rim.or.jp> wrote:
 >  > The following reply was made to PR kern/50161; it has been noted by GNATS.
 >  >
 >  > From: Ryo ONODERA <ryo_on@yk.rim.or.jp>
 >  > To: gnats-bugs@netbsd.org
 >  > Cc:
 >  > Subject: Re: kern/50161 (IPv6 DHCP environment is unstable (panic))
 >  > Date: Mon, 12 Oct 2015 19:14:57 +0900 (JST)
 >  >
 >  >  I have no longer kernel panic.
 >  >  However "adding route" and "removing route" are still emitted without end.
 >  >  Is this related to your fix?
 >  
 >  No. So someone(TM) should investigate the issue...

 O.K. Thanks for your reply.
 Please close this PR.

 >    ozaki-r
 >  

 --
 Ryo ONODERA // ryo_on@yk.rim.or.jp
 PGP fingerprint = 82A2 DC91 76E0 A10A 8ABB  FD1B F404 27FA C7D1 15F3

From: Roy Marples <roy@marples.name>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/50161 (IPv6 DHCP environment is unstable (panic))
Date: Fri, 8 Jan 2016 10:41:47 +0000

 > On IPv6 with DHCP environment, I have gotten endless
 > vmx0: removing route to 2400:402e:a337:8700::/64
 > vmx0: adding route to 2400:402e:a337:87

 dhcpcd-6.10.0 just hit current with a fix that should fix this ....
 Can you test and report back please?

 Roy

State-Changed-From-To: feedback->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Fri, 30 Sep 2016 07:50:09 +0000
State-Changed-Why:
closed at submitter's request


>Unformatted:

Home	PR Database Search