[Bug 233535] Machines lost ping6 after adding same IPv6 address

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=233535

--- Comment #19 from Hans Petter Selasky <hselasky at FreeBSD.org> ---
Just before the panic above, the following functions were called. It turns out
there is a race that mld_fasttimo() can be called during in6_joingroup().

--HPS

acquire_locked - post inc - 0xfffff802eb1f5800->in6m_refcount = 2
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe008da78410
in6_joingroup_locked() at in6_joingroup_locked+0x1b4/frame 0xfffffe008da784a0
in6_joingroup() at in6_joingroup+0x44/frame 0xfffffe008da784d0
in6_update_ifa() at in6_update_ifa+0x1880/frame 0xfffffe008da78680
in6_control() at in6_control+0x9eb/frame 0xfffffe008da78760
ifioctl() at ifioctl+0x57b/frame 0xfffffe008da78830
kern_ioctl() at kern_ioctl+0x29b/frame 0xfffffe008da788a0
sys_ioctl() at sys_ioctl+0x15d/frame 0xfffffe008da78970
amd64_syscall() at amd64_syscall+0x272/frame 0xfffffe008da78ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe008da78ab0
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x800fdd5ca, rsp =
0x7fffffffe248, rbp = 0x7fffffffe290 ---
rele_locked - post dec - 0xfffff802eb1f5800->in6m_refcount = 1
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe000055a830
mld_fasttimo() at mld_fasttimo+0x8be/frame 0xfffffe000055a900
pffasttimo() at pffasttimo+0x54/frame 0xfffffe000055a930
softclock_call_cc() at softclock_call_cc+0x140/frame 0xfffffe000055a9e0
softclock() at softclock+0x7c/frame 0xfffffe000055aa10
ithread_loop() at ithread_loop+0x136/frame 0xfffffe000055aa70
fork_exit() at fork_exit+0x84/frame 0xfffffe000055aab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe000055aab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
panic: mld_change_state: bad ifp

-- 
You are receiving this mail because:
You are the assignee for the bug.