panic in arptimer

[Takahiro Hayashi <t.hash425%gmail.com@localhost>]

Hello,

Kernel panics in arptimer after detaching network interface.
See dmesg below please.
It happened on NetBSD/amd64 on GENERIC.201510182130Z from nyftp.
I think this problem looks like kern/50186.

How-To-Repeat:
1. Boot kernel into single user mode with "boot netbsd -s".
2. sysctl -w net.inet6.ip6.auto_linklocal=0
3. ifconfig interface <ipv4 address>.
4. Send one ping to other host.
5. Detach the interface with "drvctl -d".
6. Wait about 1200 seconds (actually 1200 sec after ping is sent).


I saw following panic after detaching "re0".

fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff808cbf2f cs 8 rflags 10246 cr2 ffff8000073c7368 ilevel 2 rsp fffffe80dabd1f08
curlwp 0xfffffe81071a30c0 pid 0.22 lowest kstack 0xfffffe80dabce2c0
kernel: page fault trap, code=0
Stopped in pid 0.22 (system) at netbsd:arptimer+0xc4:   movq    360(%r15),%rdi
db{1}> bt
arptimer() at netbsd:arptimer+0xc4
callout_softclock() at netbsd:callout_softclock+0x1d0
softint_dispatch() at netbsd:softint_dispatch+0xd3
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe80dabd1ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
db{1}> show reg
ds          1ee8
es          4040
fs          600
gs          3d5e
rdi         fffffe81078c8a00
rsi         f8000000
rbp         fffffe80dabd1f38
rbx         fffffe81078c8908
rdx         0
rcx         7
rax         fffffe81071a30c4
r8          fffffe8107184040
r9          7d
r10         fffffe811eb244f4
r11         246
r12         fffffe81078c8a00
r13         fffffe81078c89b0
r14         0
r15         ffff8000073c7008
rip         ffffffff808cbf2f    arptimer+0xc4
cs          8
rflags      10246
rsp         fffffe80dabd1f08
ss          10
netbsd:arptimer+0xc4:   movq    360(%r15),%rdi
db{1}>


I met folloging panic after "drvctl -d axe0".

fatal page fault in supervisor mode
trap type 6 code 2 rip ffffffff8011bcdd cs 8 rflags 10282 cr2 0 ilevel 2 rsp fffffe80dabd1f00
curlwp 0xfffffe81071a30c0 pid 0.22 lowest kstack 0xfffffe80dabce2c0
kernel: page fault trap, code=0
Stopped in pid 0.22 (system) at netbsd:rw_enter+0x2d:   lock cmpxchgq   %rcx,0(%
rdi)
db{1}> bt
rw_enter() at netbsd:rw_enter+0x2d
callout_softclock() at netbsd:callout_softclock+0x1d0
softint_dispatch() at netbsd:softint_dispatch+0xd3
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe80dabd1ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
db{1}> show reg
ds          1ee8
es          0
fs          fc00
gs          3d5e
rdi         0
rsi         1
rbp         fffffe80dabd1f38
rbx         fffffe811dbc8188
rdx         0
rcx         fffffe81071a30c4
rax         0
r8          fffffe8107184040
r9          7d
r10         fffffe811eb244f4
r11         246
r12         fffffe811dbc8280
r13         fffffe811dbc8230
r14         0
r15         fffffe811de0b010
rip         ffffffff8011bcdd    rw_enter+0x2d
cs          8
rflags      10282
rsp         fffffe80dabd1f00
ss          10
netbsd:rw_enter+0x2d:   lock cmpxchgq   %rcx,0(%rdi)
db{1}>


--
t-hash