kern/49650: ping6 -mns8000 ::1 kills kernel

[Takahiro HAYASHI <t.hash425%gmail.com@localhost>]

>Number:         49650
>Category:       kern
>Synopsis:       ping6 -mns8000 ::1 kills kernel
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Feb 08 07:40:00 +0000 2015
>Originator:     Takahiro HAYASHI
>Release:        NetBSD 7.99.4 (GENERIC.201502071120Z from nyftp)
>Organization:
>Environment:
System: NetBSD 7.99.4 amd64
Architecture: x86_64
Machine: amd64
>Description:
	"ping6 -mns8000 ::1" kills kernel.
	This happens on current and netbsd-7 kernel.

# ifconfig lo0 127.0.0.1
# ping6 -mns8000 ::1
PING6(8048=40+8+8000 bytes) ::1 --> ::1
WARNING: mclpool limit reached; increase kern.mbuf.nmbclusters
fatal protection fault in supervisor mode
trap type 4 code 0 rip ffffffff802884f5 cs 8 rflags 10206 cr2 0 ilevel 4 rsp fffffe8002ef7ca0
curlwp 0xfffffe803f36d420 pid 0.3 lowest kstack 0xfffffe8002ef42c0
kernel: protection fault trap, code=0
Stopped in pid 0.3 (system) at  netbsd:cpu_in_cksum+0xa5:       movl    0(%rbx),
%ecx
db{0}> show reg
ds          30
es          184
fs          7c98
gs          6ef1
rdi         fffffe8039990e00
rsi         0
rbp         1794
rbx         8b8a898887868584
rdx         0
rcx         a7a6a5a4
rax         0
r8          f297026a46
r9          0
r10         0
r11         fffffffffffffffc
r12         fffffe803eb65e00
r13         81
r14         fffffe8002ef7ce0
r15         1f48
rip         ffffffff802884f5    cpu_in_cksum+0xa5
cs          8
rflags      10206
rsp         fffffe8002ef7ca0
ss          10
netbsd:cpu_in_cksum+0xa5:       movl    0(%rbx),%ecx
db{0}> trace
cpu_in_cksum() at netbsd:cpu_in_cksum+0xa5
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff802ac3f0 cs 8 rflags 10246 cr2 179c ilevel 8 rsp fffffe8002ef7098
curlwp 0xfffffe803f36d420 pid 0.3 lowest kstack 0xfffffe8002ef42c0
kernel: page fault trap, code=0
Faulted in DDB; continuing...
db{0}>

>How-To-Repeat:
	ifconfig lo0 127.0.0.1 (also ipv6 address is configured), and
	then run "ping6 -mns8000 ::1"
>Fix:
	no idea.

-- 
t-hash