kern/171697: [ip6] [ndp] panic when changing routes

[Eugene M. Zheganin]

The following reply was made to PR kern/171697; it has been noted by GNATS.

From: "Eugene M. Zheganin" <emz at norma.perm.ru>
To: bug-followup at FreeBSD.org
Cc:  
Subject: Re: kern/171697: [ip6] [ndp] panic when changing routes
Date: Mon, 17 Sep 2012 14:03:02 +0600

 Actually it's repeatable.
 
 There's a bug in net/bird6 (and net/bird), both aren't directly related 
 to this bug, but bird for some reason doesn't honor on-interface routes 
 and can delete them, so I have to add a filter so it won't do it again 
 and then restore the on-interface route by hand. And in this moment 
 FreeBSD panics.
 
 One more panic:
 
 panic: sin_family 18
 cpuid = 1
 KDB: stack backtrace:
 db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
 kdb_backtrace() at kdb_backtrace+0x37
 panic() at panic+0x1d8
 in6_lltable_lookup() at in6_lltable_lookup+0x44d
 nd6_output_lle() at nd6_output_lle+0x349
 nd6_output() at nd6_output+0x18
 ip6_output() at ip6_output+0x122f
 tcp_output() at tcp_output+0x12c7
 tcp_usr_shutdown() at tcp_usr_shutdown+0xf8
 sys_shutdown() at sys_shutdown+0x75
 amd64_syscall() at amd64_syscall+0x2fa
 Xfast_syscall() at Xfast_syscall+0xf7
 --- syscall (134, FreeBSD ELF64, sys_shutdown), rip = 0x801fee65c, rsp = 
 0x7fffffffd728, rbp = 0x7fffffffd970 ---
 Uptime: 43m28s
 Dumping 545 out of 4079 MB:panic: Bad tailq 
 NEXT(0xfffffe0002a74160->tqh_last) != NULL
 cpuid = 1
 Uptime: 43m28s
 aac0: shutting down controller...