NetBSD Problem Report #51828

From hf@spg.tu-darmstadt.de  Wed Jan 11 15:43:42 2017
Return-Path: <hf@spg.tu-darmstadt.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id CEC157A270
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 11 Jan 2017 15:43:42 +0000 (UTC)
Message-Id: <20170111164335126497.e744a845@spg.tu-darmstadt.de>
Date: Wed, 11 Jan 2017 16:43:35 +0100
From: Hauke Fath <hf@spg.tu-darmstadt.de>
Reply-To: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: Panic after configuring vlan on nonexistent phys interface

>Number:         51828
>Category:       kern
>Synopsis:       Panic after configuring vlan on nonexistent phys interface
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 11 15:45:00 +0000 2017
>Closed-Date:    Mon Jan 16 08:29:36 +0000 2017
>Last-Modified:  Mon Jan 16 13:40:01 +0000 2017
>Originator:     Hauke Fath
>Release:        NetBSD 7.99.57
>Organization:
Technische Universitaet Darmstadt
>Environment:


System: NetBSD 7.99.57 (FIFI-$Revision$) #0: Tue Jan 10 15:12:17 CET 
2017

hf@Hochstuhl:/var/obj/netbsd-builds/developer/amd64/sys/arch/amd64/compile/FIFI
Architecture: x86_64
Machine: amd64
>Description:

	For testing purposes, I brought a NetBSD 7 pf / pfsync / carp
	setup to a different machine. Some of its physical interfaces
	are disconnected.

	The netbsd-7 kernel complained, and moved on.

	A netbsd-current DIAGNOSTIC / DEBUG kernel panics:

[...]
IPv6 mode: host
Configuring network interfaces: wm0 wm1wm1: link state DOWN (was 
UNKNOWN)
 wm3wm3: link state DOWN (was UNKNOWN)
 vlan2 vlan3 vlan7 vlan8 vlan9 vlan10 vlan11 vlan12 carp0ifconfig: 
SIOCAIFADDR_IN6: Can'tfatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff804655c6 cs 8 rflags 10207 cr2 d56 
ilevel 5 rsp fffffe8040093db0
curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
panic: trap
cpu4: Begin traceback...
vpanic() at netbsd:vpanic+0x140
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xb86
--- trap (number 6) ---
psref_acquire() at netbsd:psref_acquire+0x65
in6ifa_ifpforlinklocal_psref() at 
netbsd:in6ifa_ifpforlinklocal_psref+0x3a
mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
mld_start_listening() at netbsd:mld_start_listening+0x89
mld_timeo() at netbsd:mld_timeo+0x6f
callout_softclock() at netbsd:callout_softclock+0x201
softint_dispatch() at netbsd:softint_dispatch+0xd9
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
cpu4: End traceback...

dumping to dev 18,1 (offset=3903183, size=1048102):
dump  assign requested address
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff80118d2a cs 8 rflags 10246 cr2 38 ilevel 
8 rsp fffffe8040093ac0
curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
Skipping crash dump on recursive panic
panic: trap
cpu4: Begin traceback...
vpanic() at netbsd:vpanic+0x140
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xb86
--- trap (number 6) ---
sparse_dump_mark() at netbsd:sparse_dump_mark+0x10c
dump_seg_prep() at netbsd:dump_seg_prep+0x22
dodumpsys() at netbsd:dodumpsys+0xbe
dumpsys() at netbsd:dumpsys+0x1d
vpanic() at netbsd:vpanic+0x149
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xb86
--- trap (number 6) ---
psref_acquire() at netbsd:psref_acquire+0x65
in6ifa_ifpforlinklocal_psref() at 
netbsd:in6ifa_ifpforlinklocal_psref+0x3a
mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
mld_start_listening() at netbsd:mld_start_listening+0x89
mld_timeo() at netbsd:mld_timeo+0x6f
callout_softclock() at netbsd:callout_softclock+0x201
softint_dispatch() at netbsd:softint_dispatch+0xd9
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
cpu4: End traceback...
rebooting...



>How-To-Repeat:

	Run a DEBUG/DIAGNOSTIC -current kernel with multiple network 
interfaces, some with conflicting setup.


>Fix:
	No idea.



>Release-Note:

>Audit-Trail:
From: Ryota Ozaki <ozaki-r@netbsd.org>
To: Hauke Fath <hf@spg.tu-darmstadt.de>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org, 
	gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Thu, 12 Jan 2017 12:38:19 +0900

 On Thu, Jan 12, 2017 at 12:45 AM, Hauke Fath <hf@spg.tu-darmstadt.de> wrote:
 >>Number:         51828
 >>Category:       kern
 >>Synopsis:       Panic after configuring vlan on nonexistent phys interface
 >>Confidential:   no
 >>Severity:       critical
 >>Priority:       medium
 >>Responsible:    kern-bug-people
 >>State:          open
 >>Class:          sw-bug
 >>Submitter-Id:   net
 >>Arrival-Date:   Wed Jan 11 15:45:00 +0000 2017
 >>Originator:     Hauke Fath
 >>Release:        NetBSD 7.99.57
 >>Organization:
 > Technische Universitaet Darmstadt
 >>Environment:
 >
 >
 > System: NetBSD 7.99.57 (FIFI-$Revision$) #0: Tue Jan 10 15:12:17 CET
 > 2017
 >
 > hf@Hochstuhl:/var/obj/netbsd-builds/developer/amd64/sys/arch/amd64/compile/FIFI
 > Architecture: x86_64
 > Machine: amd64
 >>Description:
 >
 >         For testing purposes, I brought a NetBSD 7 pf / pfsync / carp
 >         setup to a different machine. Some of its physical interfaces
 >         are disconnected.
 >
 >         The netbsd-7 kernel complained, and moved on.
 >
 >         A netbsd-current DIAGNOSTIC / DEBUG kernel panics:
 >
 > [...]
 > IPv6 mode: host
 > Configuring network interfaces: wm0 wm1wm1: link state DOWN (was
 > UNKNOWN)
 >  wm3wm3: link state DOWN (was UNKNOWN)
 >  vlan2 vlan3 vlan7 vlan8 vlan9 vlan10 vlan11 vlan12 carp0ifconfig:
 > SIOCAIFADDR_IN6: Can'tfatal page fault in supervisor mode
 > trap type 6 code 0 rip ffffffff804655c6 cs 8 rflags 10207 cr2 d56
 > ilevel 5 rsp fffffe8040093db0
 > curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
 > panic: trap
 > cpu4: Begin traceback...
 > vpanic() at netbsd:vpanic+0x140
 > snprintf() at netbsd:snprintf
 > trap() at netbsd:trap+0xb86
 > --- trap (number 6) ---
 > psref_acquire() at netbsd:psref_acquire+0x65
 > in6ifa_ifpforlinklocal_psref() at
 > netbsd:in6ifa_ifpforlinklocal_psref+0x3a
 > mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
 > mld_start_listening() at netbsd:mld_start_listening+0x89
 > mld_timeo() at netbsd:mld_timeo+0x6f
 > callout_softclock() at netbsd:callout_softclock+0x201
 > softint_dispatch() at netbsd:softint_dispatch+0xd9
 > DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
 > Xsoftintr() at netbsd:Xsoftintr+0x4f
 > --- interrupt ---
 > 0:
 > cpu4: End traceback...
 >
 > dumping to dev 18,1 (offset=3903183, size=1048102):
 > dump  assign requested address
 > fatal page fault in supervisor mode
 > trap type 6 code 0 rip ffffffff80118d2a cs 8 rflags 10246 cr2 38 ilevel
 > 8 rsp fffffe8040093ac0
 > curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
 > Skipping crash dump on recursive panic
 > panic: trap
 > cpu4: Begin traceback...
 > vpanic() at netbsd:vpanic+0x140
 > snprintf() at netbsd:snprintf
 > trap() at netbsd:trap+0xb86
 > --- trap (number 6) ---
 > sparse_dump_mark() at netbsd:sparse_dump_mark+0x10c
 > dump_seg_prep() at netbsd:dump_seg_prep+0x22
 > dodumpsys() at netbsd:dodumpsys+0xbe
 > dumpsys() at netbsd:dumpsys+0x1d
 > vpanic() at netbsd:vpanic+0x149
 > snprintf() at netbsd:snprintf
 > trap() at netbsd:trap+0xb86
 > --- trap (number 6) ---
 > psref_acquire() at netbsd:psref_acquire+0x65
 > in6ifa_ifpforlinklocal_psref() at
 > netbsd:in6ifa_ifpforlinklocal_psref+0x3a
 > mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
 > mld_start_listening() at netbsd:mld_start_listening+0x89
 > mld_timeo() at netbsd:mld_timeo+0x6f
 > callout_softclock() at netbsd:callout_softclock+0x201
 > softint_dispatch() at netbsd:softint_dispatch+0xd9
 > DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
 > Xsoftintr() at netbsd:Xsoftintr+0x4f
 > --- interrupt ---
 > 0:
 > cpu4: End traceback...
 > rebooting...
 >
 >
 >
 >>How-To-Repeat:
 >
 >         Run a DEBUG/DIAGNOSTIC -current kernel with multiple network
 > interfaces, some with conflicting setup.

 Does the panic happen without DEBUG?

 It seems that a DEBUG code in psref causes the panic. I don't have any
 ideas why it happens for now though...

 Thanks,
   ozaki-r

From: christos@zoulas.com (Christos Zoulas)
To: gnats-bugs@NetBSD.org, kern-bug-people@netbsd.org, 
	gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, 
	Hauke Fath <hf@spg.tu-darmstadt.de>
Cc: 
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Wed, 11 Jan 2017 22:46:08 -0500

 On Jan 12,  3:40am, ozaki-r@netbsd.org (Ryota Ozaki) wrote:
 -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys 

 Does the KASSERT I added fire?

 christos

From: "Ryota Ozaki" <ozaki-r@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/51828 CVS commit: src/sys/netinet6
Date: Thu, 12 Jan 2017 04:43:59 +0000

 Module Name:	src
 Committed By:	ozaki-r
 Date:		Thu Jan 12 04:43:59 UTC 2017

 Modified Files:
 	src/sys/netinet6: in6.c

 Log Message:
 Prevent in6_ifaddr from being freed with holding its psref

 This is a possible fix for PR kern/51828.


 To generate a diff of this commit:
 cvs rdiff -u -r1.232 -r1.233 src/sys/netinet6/in6.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Ryota Ozaki <ozaki-r@netbsd.org>
To: Christos Zoulas <christos@zoulas.com>, Hauke Fath <hf@spg.tu-darmstadt.de>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org, 
	gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Thu, 12 Jan 2017 13:55:07 +0900

 On Thu, Jan 12, 2017 at 12:46 PM, Christos Zoulas <christos@zoulas.com> wrote:
 > On Jan 12,  3:40am, ozaki-r@netbsd.org (Ryota Ozaki) wrote:
 > -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys
 >
 > Does the KASSERT I added fire?

 I don't think ifp can be NULL in the call path because in6m->in6m_ifp is always
 non-NULL.

 I've committed a possible fix. Hauke, can you try again with the latest change
 (sys/netinet6/in6.c,v 1.233)?

 Thanks,
   ozaki-r

From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys
 interface
Date: Thu, 12 Jan 2017 11:43:54 +0100

 On Thu, 12 Jan 2017 05:00:01 +0000 (UTC), Ryota Ozaki wrote:
 >  I've committed a possible fix. Hauke, can you try again with the 
 > latest change (sys/netinet6/in6.c,v 1.233)?

 Yep, works fine. Thanks!

 hauke

From: christos@zoulas.com (Christos Zoulas)
To: Hauke Fath <hf@spg.tu-darmstadt.de>, gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Thu, 12 Jan 2017 06:28:16 -0500

 On Jan 12, 11:43am, hf@spg.tu-darmstadt.de (Hauke Fath) wrote:
 -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys 

 | On Thu, 12 Jan 2017 05:00:01 +0000 (UTC), Ryota Ozaki wrote:
 | >  I've committed a possible fix. Hauke, can you try again with the 
 | > latest change (sys/netinet6/in6.c,v 1.233)?
 | 
 | Yep, works fine. Thanks!

 Remove the KASSERT then (that I added)?

 christos

From: Ryota Ozaki <ozaki-r@netbsd.org>
To: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, 
	Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Thu, 12 Jan 2017 23:47:26 +0900

 On Thu, Jan 12, 2017 at 8:30 PM, Christos Zoulas <christos@zoulas.com> wrote:
 > The following reply was made to PR kern/51828; it has been noted by GNATS.
 >
 > From: christos@zoulas.com (Christos Zoulas)
 > To: Hauke Fath <hf@spg.tu-darmstadt.de>, gnats-bugs@NetBSD.org
 > Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
 > Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
 > Date: Thu, 12 Jan 2017 06:28:16 -0500
 >
 >  On Jan 12, 11:43am, hf@spg.tu-darmstadt.de (Hauke Fath) wrote:
 >  -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys
 >
 >  | On Thu, 12 Jan 2017 05:00:01 +0000 (UTC), Ryota Ozaki wrote:
 >  | >  I've committed a possible fix. Hauke, can you try again with the
 >  | > latest change (sys/netinet6/in6.c,v 1.233)?
 >  |
 >  | Yep, works fine. Thanks!
 >
 >  Remove the KASSERT then (that I added)?

 Yes please.

   ozaki-r

From: christos@zoulas.com (Christos Zoulas)
To: gnats-bugs@NetBSD.org, kern-bug-people@netbsd.org, 
	gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, 
	Hauke Fath <hf@spg.tu-darmstadt.de>
Cc: 
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Thu, 12 Jan 2017 11:17:01 -0500

 On Jan 12,  2:50pm, ozaki-r@netbsd.org (Ryota Ozaki) wrote:
 -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys 

 |    ozaki-r

 You already did it, right?

 christos

State-Changed-From-To: open->closed
State-Changed-By: ozaki-r@NetBSD.org
State-Changed-When: Mon, 16 Jan 2017 08:29:36 +0000
State-Changed-Why:
The report confirmed the fix. Thanks.


From: Ryota Ozaki <ozaki-r@netbsd.org>
To: Christos Zoulas <christos@zoulas.com>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org, 
	gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, 
	Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Mon, 16 Jan 2017 17:27:34 +0900

 On Fri, Jan 13, 2017 at 1:17 AM, Christos Zoulas <christos@zoulas.com> wrote:
 > On Jan 12,  2:50pm, ozaki-r@netbsd.org (Ryota Ozaki) wrote:
 > -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys
 >
 > |    ozaki-r
 >
 > You already did it, right?

 No. I did it now. I think I misunderstood your question.

   ozaki-r

From: christos@zoulas.com (Christos Zoulas)
To: Ryota Ozaki <ozaki-r@netbsd.org>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, 
	kern-bug-people@netbsd.org, gnats-admin@netbsd.org, 
	netbsd-bugs@netbsd.org, Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Mon, 16 Jan 2017 08:37:09 -0500

 On Jan 16,  5:27pm, ozaki-r@netbsd.org (Ryota Ozaki) wrote:
 -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys 

 | On Fri, Jan 13, 2017 at 1:17 AM, Christos Zoulas <christos@zoulas.com> wrote:
 | > On Jan 12,  2:50pm, ozaki-r@netbsd.org (Ryota Ozaki) wrote:
 | > -- Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys
 | >
 | > |    ozaki-r
 | >
 | > You already did it, right?
 | 
 | No. I did it now. I think I misunderstood your question.

 Ok!

 christos

>Unformatted:

Home	PR Database Search