mpd5/Netgraph issues after upgrading to 7.4

[Przemyslaw Frasunek]

> It's way better now. I had no crash since IPv6 is disabled.

After reenabling IPv6, the crash occurred within 6 hours. This time, crashdump
was properly saved (thanks to patch suggested by Eugene).

As already stated by bz, panic is definitely related to races in IPv6 code:

(kgdb) bt
#0  doadump () at pcpu.h:224
#1  0xffffffff80376ae3 in boot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:448
#2  0xffffffff80377017 in panic (fmt=0x1 <Address 0x1 out of bounds>)
    at /usr/src/sys/kern/kern_shutdown.c:639
#3  0xffffffff8053c380 in trap_fatal (frame=0x9, eva=Variable "eva" is not
available.
)
    at /usr/src/sys/amd64/amd64/trap.c:848
#4  0xffffffff8053c8d1 in trap (frame=0xffffff818562c4a0)
    at /usr/src/sys/amd64/amd64/trap.c:600
#5  0xffffffff80523654 in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:228
#6  0xffffffff804b72bd in prelist_remove (pr=0xffffff0006d3d980)
    at /usr/src/sys/netinet6/nd6_rtr.c:966
#7  0xffffffff804b077a in nd6_purge (ifp=0xffffff004c927800)
    at /usr/src/sys/netinet6/nd6.c:802
#8  0xffffffff8049d0d4 in in6_ifdetach (ifp=0xffffff004c927800)
    at /usr/src/sys/netinet6/in6_ifattach.c:792
#9  0xffffffff80420888 in if_detach (ifp=0xffffff004c927800)
    at /usr/src/sys/net/if.c:919
#10 0xffffffff8044345e in ng_iface_shutdown (node=0xffffff004c086700)
    at /usr/src/sys/netgraph/ng_iface.c:803
#11 0xffffffff8043ec65 in ng_rmnode (node=0xffffff004c086700, dummy1=Variable
"dummy1" is not available.
)
    at /usr/src/sys/netgraph/ng_base.c:752
#12 0xffffffff8043f66d in ng_apply_item (node=0xffffff004c086700,
    item=0xffffff002407ae00, rw=1) at /usr/src/sys/netgraph/ng_base.c:2453
#13 0xffffffff804404be in ng_snd_item (item=Variable "item" is not available.
)
    at /usr/src/sys/netgraph/ng_base.c:2250
#14 0xffffffff8044df24 in ngc_send (so=Variable "so" is not available.
)
    at /usr/src/sys/netgraph/ng_socket.c:317
#15 0xffffffff803e1a97 in sosend_generic (so=0xffffff0004a71aa0,
    addr=0xffffff004c4d11e0, uio=0xffffff818562ca00, top=0xffffff00046ac700,
    control=0x0, flags=Variable "flags" is not available.
) at /usr/src/sys/kern/uipc_socket.c:1295
#16 0xffffffff803e6535 in kern_sendit (td=0xffffff000428e000, s=5,
    mp=0xffffff818562cad0, flags=0, control=0x0, segflg=Variable "segflg" is not
available.
)
    at /usr/src/sys/kern/uipc_syscalls.c:785
#17 0xffffffff803e66fc in sendit (td=0xffffff000428e000, s=5,
    mp=0xffffff818562cad0, flags=0) at /usr/src/sys/kern/uipc_syscalls.c:717
#18 0xffffffff803e67ed in sendto (td=Variable "td" is not available.
) at /usr/src/sys/kern/uipc_syscalls.c:837
#19 0xffffffff8053bb32 in amd64_syscall (td=0xffffff000428e000, traced=0)
    at subr_syscall.c:114
#20 0xffffffff8052394c in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:387
(kgdb) frame 6
#6  0xffffffff804b72bd in prelist_remove (pr=0xffffff0006d3d980)
    at /usr/src/sys/netinet6/nd6_rtr.c:966
966             LIST_REMOVE(pr, ndpr_entry);
(kgdb) list
961                     return;         /* notice here? */
962
963             s = splnet();
964
965             /* unlink ndpr_entry from nd_prefix list */
966             LIST_REMOVE(pr, ndpr_entry);
967
968             /* free list of routers that adversed the prefix */
969             LIST_FOREACH_SAFE(pfr, &pr->ndpr_advrtrs, pfr_entry, next) {
970                     free(pfr, M_IP6NDP);
(kgdb) print *pr
$1 = {ndpr_ifp = 0xdeadc0dedeadc0de, ndpr_entry = {
    le_next = 0xdeadc0dedeadc0de, le_prev = 0xdeadc0dedeadc0de},
  ndpr_prefix = {sin6_len = 222 '�', sin6_family = 192 '�', sin6_port = 57005,
    sin6_flowinfo = 3735929054, sin6_addr = {__u6_addr = {
        __u6_addr8 = "������������", __u6_addr16 = {49374, 57005, 49374,
          57005, 49374, 57005, 49374, 57005}, __u6_addr32 = {3735929054,
          3735929054, 3735929054, 3735929054}}}, sin6_scope_id = 3735929054},
  ndpr_mask = {__u6_addr = {__u6_addr8 = "������������", __u6_addr16 = {
        49374, 57005, 49374, 57005, 49374, 57005, 49374, 57005},
      __u6_addr32 = {3735929054, 3735929054, 3735929054, 3735929054}}},
  ndpr_vltime = 3735929054, ndpr_pltime = 3735929054,
  ndpr_expire = -2401050962867404578, ndpr_preferred = -2401050962867404578,
  ndpr_lastupdate = -2401050962867404578, ndpr_flags = {onlink = 0 '\0',
    autonomous = 1 '\001', reserved = 55 '7'}, ndpr_stateflags = 3735929054,
  ndpr_advrtrs = {lh_first = 0xdeadc0dedeadc0de}, ndpr_plen = 224 '�',
  ndpr_refcnt = -1}