Re: kern/49682: reproducable panic when detaching bge (IPv6 related)

[Martin Husemann <martin%duskware.de@localhost>]

The following reply was made to PR kern/49682; it has been noted by GNATS.

From: Martin Husemann <martin%duskware.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/49682: reproducable panic when detaching bge (IPv6 related)
Date: Fri, 20 Feb 2015 17:14:01 +0100

 I made it crash again, drop into ddb and forced a crash dump.
 
 Here is what gdb shows about it:
 
 #8  0xffffffff8053fc54 in defrtrlist_del (dr=0xfffffe813667dc98)
     at ../../../../netinet6/nd6_rtr.c:488
 488             struct nd_ifinfo *ndi = ND_IFINFO(dr->ifp);
 (gdb) p *dr
 $1 = {dr_entry = {tqe_next = 0x0, 
     tqe_prev = 0xffffffff80e97730 <nd_defrouter>}, rtaddr = {__u6_addr = {
       __u6_addr8 = "\376?\000\001\000\000\000\000R\345I\377\376\334\065E", 
       __u6_addr16 = {33022, 256, 0, 0, 58706, 65353, 56574, 17717}, 
       __u6_addr32 = {16810238, 0, 4283032914, 1161157886}}}, flags = 0 '\000', 
   rtlifetime = 1800, expire = 1424449849, ifp = 0xffff800007be3008, 
   installed = 1}
 (gdb) p dr
 $2 = (struct nd_defrouter *) 0xfffffe813667dc98
 (gdb) p dr->ifp
 $3 = (struct ifnet *) 0xffff800007be3008
 (gdb) p *dr->ifp
 $4 = {if_softc = 0xffff800007be3000, if_list = {tqe_next = 0xffff800007033d30, 
     tqe_prev = 0xffffffff80e89630 <ifnet_list>}, if_addrlist = {
     tqh_first = 0x0, tqh_last = 0xffff800007be3020}, 
   if_xname = "bge0", '\000' <repeats 11 times>, if_pcount = 0, if_bpf = 0x0, 
   if_index = 1, if_timer = 0, if_flags = -30718, if__pad1 = 0, if_data = {
     ifi_type = 6 '\006', ifi_addrlen = 6 '\006', ifi_hdrlen = 14 '\016', 
     ifi_link_state = 2, ifi_mtu = 1500, ifi_metric = 0, 
     ifi_baudrate = 1000000000, ifi_ipackets = 699, ifi_ierrors = 0, 
     ifi_opackets = 523, ifi_oerrors = 0, ifi_collisions = 0, 
     ifi_ibytes = 93654, ifi_obytes = 73498, ifi_imcasts = 222, 
     ifi_omcasts = 11, ifi_iqdrops = 0, ifi_noproto = 0, ifi_lastchange = {
       tv_sec = 1424448224, tv_nsec = 983391989}}, 
   if_output = 0xffffffff803ab28c <ether_output>, 
   if_input = 0xffffffff803aacc0 <ether_input>, 
   if_start = 0xffffffff8038ef11 <bge_start>, 
   if_ioctl = 0xffffffff804cfc8c <enxio>, 
   if_init = 0xffffffff80393721 <bge_init>, 
   if_stop = 0xffffffff8039317e <bge_stop>, if_slowtimo = 0x0, if_drain = 0x0, 
   if_snd = {ifq_head = 0x0, ifq_tail = 0x0, ifq_len = 0, ifq_maxlen = 511, 
     ifq_drops = 0, ifq_lock = 0x0, altq_type = 0, altq_flags = 0, 
     altq_disc = 0x0, altq_ifp = 0x0, altq_enqueue = 0x0, altq_dequeue = 0x0, 
     altq_request = 0x0, altq_clfier = 0x0, altq_classify = 0x0, 
     altq_tbr = 0x0, altq_cdnr = 0x0}, if_dl = 0x0, if_sadl = 0x0, 
   if_hwdl = 0x0, 
   if_broadcastaddr = 0xffffffff809414de <etherbroadcastaddr> "\377\377\377\377\377\377", if_bridge = 0x0, if_bridgeif = 0x0, if_dlt = 1, 
   if_pfil = 0xfffffe810721bc48, if_capabilities = 16256, if_capenable = 0, 
   if_carp_ptr = {carp_s = 0x0, carp_d = 0x0}, if_csum_flags_tx = 0, 
   if_csum_flags_rx = 0, if_afdata = {0x0 <repeats 35 times>}, if_mowner = 0x0, 
   if_agrprivate = 0x0, if_pf_kif = 0x0, if_pf_groups = 0x0, if_index_gen = 0, 
   if_sysctl_log = 0x0, if_initaddr = 0x0, if_mcastop = 0x0, if_setflags = 0x0, 
   if_ioctl_lock = 0xfffffe8107153188, if_slowtimo_ch = 0xfffffe810719fac8}
 [..]
    0xffffffff8053fc46 <defrtrlist_del+11>:      mov    %rdi,%rbx
    0xffffffff8053fc49 <defrtrlist_del+14>:      mov    0x30(%rdi),%rax
    0xffffffff8053fc4d <defrtrlist_del+18>:      mov    0x2b0(%rax),%r13
 => 0xffffffff8053fc54 <defrtrlist_del+25>:      mov    0x10(%r13),%rdi
 (gdb) info reg rax rbx rdi  r13
 rax            0xffff800007be3008       -140737358450680
 rbx            0xfffffe813667dc98       -1644059698024
 rdi            0xfffffe813667dc98       -1644059698024
 r13            0x0      0
 
 
 Martin