Panic with r346530 [Re: svn commit: r346530 - in head/sys: netinet netinet6]

[Kristof Provost]

On 22 Apr 2019, at 12:25, Enji Cooper wrote:
> Either the sys/netinet/ or sys/netipsec/ tests triggered the panic. 
> Not sure which right now.
>
That looks to be happening during a vnet jail teardown, so it’s likely 
the sys/netipsec or sys/netpfil/pf tests.

I’ve done a quick test with the pf tests, and they provoke this panic:

	panic: mtx_lock() of destroyed mutex @ 
/usr/src/sys/netinet/ip_reass.c:628
	cpuid = 0
	time = 1555939645
	KDB: stack backtrace:
	db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 
0xfffffe0091d68530
	vpanic() at vpanic+0x19d/frame 0xfffffe0091d68580
	panic() at panic+0x43/frame 0xfffffe0091d685e0
	__mtx_lock_flags() at __mtx_lock_flags+0x12e/frame 0xfffffe0091d68630
	ipreass_cleanup() at ipreass_cleanup+0x86/frame 0xfffffe0091d68670
	if_detach_internal() at if_detach_internal+0x786/frame 
0xfffffe0091d686f0
	if_detach() at if_detach+0x3d/frame 0xfffffe0091d68710
	lo_clone_destroy() at lo_clone_destroy+0x16/frame 0xfffffe0091d68730
	if_clone_destroyif() at if_clone_destroyif+0x21f/frame 
0xfffffe0091d68780
	if_clone_detach() at if_clone_detach+0xb8/frame 0xfffffe0091d687b0
	vnet_loif_uninit() at vnet_loif_uninit+0x26/frame 0xfffffe0091d687d0
	vnet_destroy() at vnet_destroy+0x124/frame 0xfffffe0091d68800
	prison_deref() at prison_deref+0x29d/frame 0xfffffe0091d68840
	sys_jail_remove() at sys_jail_remove+0x28f/frame 0xfffffe0091d68890
	amd64_syscall() at amd64_syscall+0x276/frame 0xfffffe0091d689b0
	fast_syscall_common() at fast_syscall_common+0x101/frame 
0xfffffe0091d689b0
	--- syscall (508, FreeBSD ELF64, sys_jail_remove), rip = 0x80031e12a, 
rsp = 0x7fffffffe848, rbp = 0x7fffffffe8d0 ---
	KDB: enter: panic
	[ thread pid 1223 tid 100501 ]
	Stopped at      kdb_enter+0x3b: movq    $0,kdb_why
	db>

To reproduce:

     kldload pfsync
     cd /usr/tests/sys/netpfil/pf
     sudo kyua test

Regards,
Kristof