IPv6 panic page fault nd6_cache_lladdr/nd6_ns_input

Hello,

After upgrading a system to -CURRENT of yesterday night, making IPv6
connections to another host in the same subnet does not work (remains in
[connec] state). Some messing about with routes solved that, but it
panicked quickly thereafter. After a reboot it panicked again with a
similar panic. I'm running an older kernel now.

The machine is a dual Athlon MP 2000+, 1GB RAM.

Relevant lines from /etc/rc.conf:

ipv6_enable="YES"
ipv6_ifconfig_xl1='2001:610:1108:5012::2 prefixlen 64'
ipv6_network_interfaces="auto"
ipv6_static_routes="nfsrtfix"
ipv6_route_nfsrtfix="2001:610:1108:5012::/64 -iface xl1"

ipv6_firewall_enable="YES"
ipv6_firewall_type="/etc/ip6fw.rules"

The IPv6 firewall rules are very simple (no stateful stuff in there).

Also we do in /etc/rc.local:

sysctl net.inet6.ip6.accept_rtadv=1
rtsol xl0

Results from gdb (first panic, second is very similar, except that it
has softupdate trouble after getting the initial page fault):

Script started on Mon Oct  6 15:21:34 2003
# gdb -k kernel.debug.9 vmcore.9
GNU gdb 5.2.1 (FreeBSD)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-undermydesk-freebsd"...
panic: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic.id = 01000000
fault virtual address	= 0xac
fault code		= supervisor write, page not present
instruction pointer	= 0x8:0xc0599601
stack pointer	        = 0x10:0xe0084a8c
frame pointer	        = 0x10:0xe0084ad8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 15 (swi1: net)
trap number		= 12
panic: page fault
cpuid = 0; lapic.id = 01000000
boot() called on cpu#0

syncing disks, buffers remaining... 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 
giving up on 809 buffers
Uptime: 11m17s
Dumping 1023 MB
 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 304 320 336 352 368 384 400 416 432 448 464 480 496 512 528 544 560 576 592 608 624 640 656 672 688 704 720 736 752 768 784 800 816 832 848 864 880 896 912 928 944 960 976 992 1008
---
Reading symbols from /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/acpi/acpi.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/acpi/acpi.ko.debug
Reading symbols from /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/fdescfs/fdescfs.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/fdescfs/fdescfs.ko.debug
Reading symbols from /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/linux/linux.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/linux/linux.ko.debug
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
240		dumping++;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc04d6ff1 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:372
#2  0xc04d7448 in panic () at /usr/src/sys/kern/kern_shutdown.c:550
#3  0xc0655cd6 in trap_fatal (frame=0xe0084a4c, eva=0)
    at /usr/src/sys/i386/i386/trap.c:819
#4  0xc0655952 in trap_pfault (frame=0xe0084a4c, usermode=0, eva=172)
    at /usr/src/sys/i386/i386/trap.c:733
#5  0xc06554ad in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 1, tf_esi = -536327200, tf_ebp = -536327464, tf_isp = -536327560, tf_ebx = 0, tf_edx = -1034105584, tf_ecx = 4, tf_eax = -1034105584, tf_trapno = 12, tf_err = 2, tf_eip = -1067870719, tf_cs = 8, tf_eflags = 66050, tf_esp = -950171904, tf_ss = 1})
    at /usr/src/sys/i386/i386/trap.c:418
#6  0xc063d678 in calltrap () at {standard input}:103
#7  0xc059a774 in nd6_cache_lladdr (ifp=0xc6544000, from=0x0, 
    lladdr=0xc3275852 "", lladdrlen=8, type=135, code=0)
    at /usr/src/sys/netinet6/nd6.c:1654
#8  0xc059ba3d in nd6_ns_input (m=0xc25ef100, off=40, icmp6len=-965550080)
    at /usr/src/sys/netinet6/nd6_nbr.c:306
#9  0xc058072b in icmp6_input (mp=0x0, offp=0xe0084c68, proto=58)
    at /usr/src/sys/netinet6/icmp6.c:790
#10 0xc0591e1b in ip6_input (m=0xc25eef00)
    at /usr/src/sys/netinet6/ip6_input.c:825
#11 0xc0554b59 in netisr_processqueue (ni=0xc06e7538)
---Type <return> to continue, or q <return> to quit---
    at /usr/src/sys/net/netisr.c:140
#12 0xc0555048 in swi_net (dummy=0x0) at /usr/src/sys/net/netisr.c:246
#13 0xc04c0d88 in ithread_loop (arg=0xc25c9c00)
    at /usr/src/sys/kern/kern_intr.c:534
#14 0xc04bf9c1 in fork_exit (callout=0xc04c0bb0 <ithread_loop>, arg=0x0, 
    frame=0x0) at /usr/src/sys/kern/kern_fork.c:796
(kgdb) frame 7
#7  0xc059a774 in nd6_cache_lladdr (ifp=0xc6544000, from=0x0, 
    lladdr=0xc3275852 "", lladdrlen=8, type=135, code=0)
    at /usr/src/sys/netinet6/nd6.c:1654
1654			rt = nd6_lookup(from, 1, ifp);
(kgdb) l
1649			/* nothing must be done if there's no lladdr */
1650			if (!lladdr || !lladdrlen)
1651				return NULL;
1652	#endif
1653	
1654			rt = nd6_lookup(from, 1, ifp);
1655			is_newentry = 1;
1656		} else {
1657			/* do nothing if static ndp is set */
1658			if (rt->rt_flags & RTF_STATIC)
(kgdb) p from
$1 = (struct in6_addr *) 0x0
(kgdb) up
#8  0xc059ba3d in nd6_ns_input (m=0xc25ef100, off=40, icmp6len=-965550080)
    at /usr/src/sys/netinet6/nd6_nbr.c:306
306		nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, ND_NEIGHBOR_SOLICIT, 0);
(kgdb) p &saddr6
$2 = (struct in6_addr *) 0xe0084be0
(kgdb) # ^D
Script done on Mon Oct  6 15:25:17 2003

If you need more information, just ask.

-- 
Jilles Tjoelker