pagefault in IPv6 codepath in defrouter_select()

[hiren panchasara]

We are seeing following panic with "Panic String: page fault" on a month
old stable/10 tree:

kgdb) #0  doadump (textdump=1) at pcpu.h:219
#1  0xffffffff80746307 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:452
#2  0xffffffff807466e4 in panic (fmt=<value optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:759
#3  0xffffffff80a9ab5f in trap_fatal (frame=<value optimized out>, 
    eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:859
#4  0xffffffff80a9ae5d in trap_pfault (frame=0xfffffe000038eef0, 
    usermode=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:676
#5  0xffffffff80a9a4da in trap (frame=0xfffffe000038eef0)
    at /usr/src/sys/amd64/amd64/trap.c:440
#6  0xffffffff80a804e2 in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:236
#7  0xffffffff80744ab3 in __rw_rlock (c=0x100b421, file=0x0, line=0)
    at /usr/src/sys/kern/kern_rwlock.c:378
#8  0xffffffff80887193 in defrouter_select ()
    at /usr/src/sys/netinet6/nd6_rtr.c:640
#9  0xffffffff80885b58 in nd6_ra_input (m=<value optimized out>, 
    off=<value optimized out>, icmp6len=<value optimized out>)
    at /usr/src/sys/netinet6/nd6_rtr.c:796
#10 0xffffffff8085fa9f in icmp6_input (mp=<value optimized out>, 
    offp=0xfffffe000038f66c, proto=<value optimized out>)
    at /usr/src/sys/netinet6/icmp6.c:814
#11 0xffffffff80874e6c in ip6_input (m=0xfffff800269e8a00)
    at /usr/src/sys/netinet6/ip6_input.c:1019
#12 0xffffffff808144a2 in netisr_dispatch_src (proto=<value optimized out>, 
    source=<value optimized out>, m=0x0) at /usr/src/sys/net/netisr.c:972
#13 0xffffffff8080ce66 in ether_demux (ifp=<value optimized out>, 
    m=0xfffff800269e8a00) at /usr/src/sys/net/if_ethersubr.c:851
#14 0xffffffff8080daf9 in ether_nh_input (m=<value optimized out>)
    at /usr/src/sys/net/if_ethersubr.c:646
#15 0xffffffff808144a2 in netisr_dispatch_src (proto=<value optimized out>, 
    source=<value optimized out>, m=0x0) at /usr/src/sys/net/netisr.c:972
#16 0xffffffff80437a98 in igb_rxeof (count=99)
    at /usr/src/sys/dev/e1000/if_igb.c:4808
#17 0xffffffff80438131 in igb_msix_que (arg=0xfffff8000e6efa08)
    at /usr/src/sys/dev/e1000/if_igb.c:1621
#18 0xffffffff80716e4b in intr_event_execute_handlers (
    p=<value optimized out>, ie=0xfffff8000e6ea500)
    at /usr/src/sys/kern/kern_intr.c:1264
#19 0xffffffff807177e6 in ithread_loop (arg=0xfffff8000e6f5e00)
    at /usr/src/sys/kern/kern_intr.c:1277
#20 0xffffffff80714a6a in fork_exit (
    callout=0xffffffff80717750 <ithread_loop>, arg=0xfffff8000e6f5e00, 
    frame=0xfffffe000038fac0) at /usr/src/sys/kern/kern_fork.c:1017
#21 0xffffffff80a80a1e in fork_trampoline ()
    at /usr/src/sys/amd64/amd64/exception.S:611
#22 0x0000000000000000 in ?? ()
Current language:  auto; currently minimal
(kgdb) f 7
#7  0xffffffff80744ab3 in __rw_rlock (c=0x100b421, file=0x0, line=0)
	at /usr/src/sys/kern/kern_rwlock.c:378
378                     spin_cnt++;
(kgdb) p spin_cnt 
$6 = 1
(kgdb) 

This is 3rd occurence of this panic. What could be the cause?
I have vmcore and can provide more info if needed.

Cheers,
Hiren
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 618 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20150325/03ed6b92/attachment.sig>