[Bug 233535] Machines lost ping6 after adding same IPv6 address

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=233535

--- Comment #18 from Hans Petter Selasky <hselasky at FreeBSD.org> ---
Documenting yet another related crash scenario:

#12 0xffffffff80e292f0 in mld_change_state (inm=0xfffff802eb1f5800, delay=0)
    at /usr/img/freebsd/sys/netinet6/mld6.c:1909
#13 0xffffffff80e1546a in in6_joingroup_locked (ifp=<optimized out>, 
    mcaddr=0xfffffe008da78618, imf=0x0, pinm=0xfffff8000415a960, delay=0)
    at /usr/img/freebsd/sys/netinet6/in6_mcast.c:1321
#14 0xffffffff80e14f74 in in6_joingroup (ifp=0xffffffff81e95368 <cnputs_mtx>, 
    mcaddr=0x80, imf=<optimized out>, pinm=0x80, delay=16)
    at /usr/img/freebsd/sys/netinet6/in6_mcast.c:1248
#15 0xffffffff80e0ce20 in in6_joingroup_legacy (ifp=<optimized out>, 
    mcaddr=0x40002ff, delay=18, errorp=<optimized out>)
    at /usr/img/freebsd/sys/netinet6/in6.c:752
#16 in6_update_ifa_join_mc (ifp=<optimized out>, ifra=<optimized out>, 
    ia=<optimized out>, flags=<optimized out>, in6m_sol=<optimized out>)
    at /usr/img/freebsd/sys/netinet6/in6.c:848
#17 in6_broadcast_ifa (ifp=<optimized out>, ifra=<optimized out>, 
    ia=<optimized out>, flags=<optimized out>)
    at /usr/img/freebsd/sys/netinet6/in6.c:1227
#18 in6_update_ifa (ifp=<optimized out>, ifra=<optimized out>, 
    ia=<optimized out>, flags=<optimized out>)
    at /usr/img/freebsd/sys/netinet6/in6.c:910
#19 0xffffffff80e0ae7b in in6_control (so=<optimized out>, 
--Type <RET> for more, q to quit, c to continue without paging--
    data=<optimized out>, ifp=<optimized out>, td=<optimized out>)
    at /usr/img/freebsd/sys/netinet6/in6.c:564
#20 0xffffffff80cd13db in ifioctl (so=<optimized out>, cmd=2156423451,
data=0xfffff80006ea3b00 "mce0", 
    td=0xfffff8011cc9a000) at /usr/img/freebsd/sys/net/if.c:3098
#21 0xffffffff80c3c41b in fo_ioctl (fp=<optimized out>, com=<optimized out>,
data=0x1d0, active_cred=0x80, 
    td=<optimized out>) at /usr/img/freebsd/sys/sys/file.h:330
#22 kern_ioctl (td=<optimized out>, fd=<optimized out>, com=2156423451, 
    data=0x1d0 <error: Cannot access memory at address 0x1d0>) at
/usr/img/freebsd/sys/kern/sys_generic.c:800
#23 0xffffffff80c3c10d in sys_ioctl (td=0xfffff8011cc9a000,
uap=0xfffff8011cc9a3c0)
    at /usr/img/freebsd/sys/kern/sys_generic.c:712
#24 0xffffffff8109deb2 in syscallenter (td=0xfffff8011cc9a000)
    at /usr/img/freebsd/sys/amd64/amd64/../../kern/subr_syscall.c:135
#25 amd64_syscall (td=0xfffff8011cc9a000, traced=0) at
/usr/img/freebsd/sys/amd64/amd64/trap.c:1154


#12 0xffffffff80e292f0 in mld_change_state (inm=0xfffff802eb1f5800, delay=0) at
/usr/img/freebsd/sys/netinet6/mld6.c:1909
1909            KASSERT(inm->in6m_ifp == ifp, ("%s: bad ifp", __func__));
(kgdb) list
1904                    return (0);
1905            /*
1906             * Sanity check that netinet6's notion of ifp is the
1907             * same as net's.
1908             */
1909            KASSERT(inm->in6m_ifp == ifp, ("%s: bad ifp", __func__));
1910    
1911            MLD_LOCK();
1912            mli = MLD_IFINFO(ifp);
1913            KASSERT(mli != NULL, ("%s: no mld_ifsoftc for ifp %p",
__func__, ifp));
(kgdb) print *inm
$3 = {
  in6m_addr = {
    __u6_addr = {
      __u6_addr8 =
"\377\002\000\004\000\000\000\000\000\000\000\002\340\312\325\032", 
      __u6_addr16 = {767, 1024, 0, 0, 0, 512, 51936, 6869}, 
      __u6_addr32 = {67109631, 0, 33554432, 450218720}
    }
  }, 
  in6m_ifp = 0x0, 
  in6m_ifma = 0xfffff80006969080, 
  in6m_refcount = 1, 
  in6m_state = 0, 
  in6m_timer = 0, 
  in6m_mli = 0xfffff800067e0900, 
  in6m_nrele = {
    sle_next = 0x0
  }, 
  in6m_srcs = {
    rbh_root = 0x0
  }, 
  in6m_nsrc = 0, 
  in6m_scq = {
    mq_head = {
      stqh_first = 0x0, 
      stqh_last = 0xfffff802eb1f5850
    }, 
    mq_len = 0, 
    mq_maxlen = 24
  }, 
  in6m_lastgsrtv = {
    tv_sec = 0, 
    tv_usec = 0
  }, 
  in6m_sctimer = 0, 
  in6m_scrv = 0, 
  in6m_st = {{
      iss_fmode = 0, 
      iss_asm = 0, 
      iss_ex = 0, 
      iss_in = 0, 
      iss_rec = 0
    }, {
      iss_fmode = 2, 
      iss_asm = 1, 
      iss_ex = 1, 
      iss_in = 0, 
      iss_rec = 0
    }}
}

-- 
You are receiving this mail because:
You are the assignee for the bug.