6.0BETA3 panic in ip_output (vlan/RIP related?)

Hi,

I've just managed to panic an amd64 machine running 6.0BETA3.

wiggum# ifconfig vlan76 destroy
wiggum# Aug 31 12:02:48 wiggum routed[244]: IP_DROP_MEMBERSHIP ALLHOSTS: Can't assign requested address
wiggum#
wiggum# ifconfig vlan76 create
wiggum# ifconfig vlan76 vlan 76 vlandev bge0
wiggum# ifconfig vlan76 inet x.y.76.59 netmask 255.255.254.0


Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x8:0xffffffff80429420
stack pointer           = 0x10:0xffffffffb260b600
frame pointer           = 0x10:0xffffffffb260b710
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 244 (routed)
[thread pid 244 tid 100077 ]
Stopped at      strlen: cmpb    $0,0(%rdi)
db> tr
Tracing pid 244 tid 100077 td 0xffffff0078c74980
strlen() at strlen
vsnprintf() at vsnprintf+0x2e
panic() at panic+0x14b
_mtx_lock_flags() at _mtx_lock_flags+0xd6
ip_output() at ip_output+0x692
rip_output() at rip_output+0x161
rip_send() at rip_send+0x65
sosend() at sosend+0x654
kern_sendit() at kern_sendit+0x104
sendit() at sendit+0x66
sendto() at sendto+0x54
syscall() at syscall+0x4b2
Xfast_syscall() at Xfast_syscall+0xa8
--- syscall (133, FreeBSD ELF64, sendto), rip = 0x800799dfc, rsp =
0x7fffffffeb28, rbp = 0x413112 ---
db>

(kgdb) where
#23 0xffffffff803d3d5e in vsnprintf (str=0x0, size=0, format=0x0, ap=0x0) at /usr/src/sys/kern/subr_prf.c:408
#24 0xffffffff803b3efb in panic (fmt=0xffffffff80615639 "%s _at_ %s:%d") at /usr/src/sys/kern/kern_shutdown.c:520
#25 0xffffffff803ab6e6 in _mtx_lock_flags (m=0xffffff00622dec78, opts=0, file=0xffffffff80628080 "/usr/src/sys/netinet/ip_output.c",
    line=296) at /usr/src/sys/kern/kern_mutex.c:268
#26 0xffffffff80464a52 in ip_output (m=0xffffff005e402300, opt=0xffffff0042432000, ro=0xffffffffb260b8d0, flags=32, imo=0xffffff007b8aa500,
    inp=0xffffff0061bf2000) at /usr/src/sys/netinet/ip_output.c:296
#27 0xffffffff80465791 in rip_output (m=0xffffff005e402300, so=0x0, dst=64) at /usr/src/sys/netinet/raw_ip.c:320
#28 0xffffffff80466535 in rip_send (so=0xffffff0061ccf000, flags=0, m=0xffffff005e402300, nam=0xffffff007b5b90f0, control=0x0, td=0x0)
    at /usr/src/sys/netinet/raw_ip.c:785
#29 0xffffffff803f95c4 in sosend (so=0xffffff0061ccf000, addr=0xffffff007b5b90f0, uio=0xffffffffb260ba80, top=0xffffff005e402300,
    control=0x0, flags=0, td=0xffffff0078c74980) at /usr/src/sys/kern/uipc_socket.c:829
#30 0xffffffff80400534 in kern_sendit (td=0xffffff0078c74980, s=5, mp=0xffffffffb260bb50, flags=0, control=0x0, segflg=8)
    at /usr/src/sys/kern/uipc_syscalls.c:772
#31 0xffffffff804016f6 in sendit (td=0xffffff0078c74980, s=5, mp=0xffffffffb260bb50, flags=0) at /usr/src/sys/kern/uipc_syscalls.c:712
#32 0xffffffff80401ab4 in sendto (td=0x0, uap=0x0) at /usr/src/sys/kern/uipc_syscalls.c:830
#33 0xffffffff80570042 in syscall (frame=
      {tf_rdi = 5, tf_rsi = 140737488350080, tf_rdx = 8, tf_rcx = 0, tf_r8 = 140737488350016, tf_r9 = 16, tf_rax = 133, tf_rbx = 5367808, tf)
    at /usr/src/sys/amd64/amd64/trap.c:796
#34 0xffffffff8055d468 in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:272

(kgdb) f 25
#25 0xffffffff803ab6e6 in _mtx_lock_flags (m=0xffffff00622dec78, opts=0, file=0xffffffff80628080 "/usr/src/sys/netinet/ip_output.c",
    line=296) at /usr/src/sys/kern/kern_mutex.c:268
268             KASSERT(m->mtx_object.lo_class == &lock_class_mtx_sleep,
(kgdb) l
263     void
264     _mtx_lock_flags(struct mtx *m, int opts, const char *file, int line)
265     {
266
267             MPASS(curthread != NULL);
268             KASSERT(m->mtx_object.lo_class == &lock_class_mtx_sleep,
269                 ("mtx_lock() of spin mutex %s _at_ %s:%d", m->mtx_object.lo_name,
270                 file, line));
271             WITNESS_CHECKORDER(&m->mtx_object, opts | LOP_NEWORDER | LOP_EXCLUSIVE,
272                 file, line);
(kgdb) up
#26 0xffffffff80464a52 in ip_output (m=0xffffff005e402300, opt=0xffffff0042432000, ro=0xffffffffb260b8d0, flags=32, imo=0xffffff007b8aa500,
    inp=0xffffff0061bf2000) at /usr/src/sys/netinet/ip_output.c:296
296                     IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);
(kgdb) l
291                             if (ia != NULL)
292                                     ip->ip_src = IA_SIN(ia)->sin_addr;
293                     }
294
295                     IN_MULTI_LOCK();
296                     IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);
297                     if (inm != NULL &&
298                        (imo == NULL || imo->imo_multicast_loop)) {
299                             IN_MULTI_UNLOCK();
300                             /*

I've got the core file if anyone wants any more info.

Gavin