NetBSD Problem Report #60120

From www@netbsd.org  Sun Mar 22 23:46:20 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R12" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 994B91A923D
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 22 Mar 2026 23:46:20 +0000 (UTC)
Message-Id: <20260322234619.BBAC01A923E@mollari.NetBSD.org>
Date: Sun, 22 Mar 2026 23:46:19 +0000 (UTC)
From: alnsn@protonmail.ch
Reply-To: alnsn@protonmail.ch
To: gnats-bugs@NetBSD.org
Subject: Stopping mrouted crashes the kernel
X-Send-Pr-Version: www-1.0
X-From4GNATS: "alnsn@protonmail.ch via gnats" <gnats-admin@NetBSD.org>

>Number:         60120
>Category:       kern
>Synopsis:       Stopping mrouted crashes the kernel
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Mar 22 23:50:00 +0000 2026
>Originator:     Alex Nasonov
>Release:        10.1
>Organization:
N/A
>Environment:
NetBSD nebeda 10.1_STABLE NetBSD 10.1_STABLE (GENERIC) #0: Thu Mar 19 00:17:47 GMT 2026  alnsn@nebeda:/scratch/alnsn/netbsd-usrsrc/obj/sys/arch/amd64/compile/GENERIC 
>Description:
Kernel compiled with MROUTING crashes in reset_vif -> encap_detach when I stop mrouted. It's a simple NULL-pointer dereference.
>How-To-Repeat:
1. Compile GENERIC wtih MROUTING
2. Setup two network interfaces with multicast enabled
3. Run 'service mrouted onestart'
4. Run 'service mrouted onestop'
5. Boom!
>Fix:
This fix seems to fix the issue but I'm not familiar with those protocols to commit it myself without a review:


        if (vifp->v_flags & VIFF_TUNNEL) {
                /* detach this vif from decapsulator dispatch table */
                encap_lock_enter();
                encap_detach(vifp->v_encap_cookie);
                encap_lock_exit();
                vifp->v_encap_cookie = NULL;
        }

Home	PR Database Search