Re: ARP panic in HEAD

[Greg Troxel <gdt%lexort.com@localhost>]

Manuel Bouyer <bouyer%antioche.eu.org@localhost> writes:

> I just got a panic in a current kernel (updated today)
> [ 7710.0533258] panic: kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/dsk/l1/misc/bouyer/HEAD/clean/src/sys/netinet/if_arp.c", line 801 
> [ 7710.0996509] cpu0: Begin traceback...
> [ 7710.1108929] vpanic() at netbsd:vpanic+0x18d
> [ 7710.1236555] kern_assert() at netbsd:kern_assert+0x61
> [ 7710.1340323] in_arpinput() at netbsd:in_arpinput+0x4b9
> [ 7710.1553295] arpintr() at netbsd:arpintr+0x12e
> [ 7710.1646365] softint_dispatch() at netbsd:softint_dispatch+0x124
> [ 7710.1891263] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffde00695cd0f0
> [ 7710.2147638] Xsoftintr() at netbsd:Xsoftintr+0x4c
> [ 7710.2272680] --- interrupt ---

No but a quick ksrccode_skim() reveals:

 in_arpinput(), which appears to process an mbuf with contents taht
 arrrived over the wire, has

   KASSERT(op == ARPOP_REPLY || op == ARPOP_REQUEST);

 and this is "obviously wrong" as asserts are only for internal
 consistency checks (things you think you should be able to prove by
 static analysis, ish).  If the incoming packet has a bad opcode, that
 should just be cause to discard the packet and probably increment some
 stat counter.  However.... arpintr has that same check with a
 discard/statinc, and only calls in_arpinput if it's one of those two.
 So it's fine.  This is confusing because in_arpinput doesn't document
 the precondition.   I'd wonder if it were called  from elsewhere, but
 your stack trace shows it from arpintr.


This was changed in July by riastradh@.  I read the code in arpintr and
in_arpinput and I can't see anything wrong.

I wonder

  - if your system is MP, and if you have any non-default MPSAFE stuff
  - are there hosts on your LAN trying to do trailers (cue vax
    flashbacks)?
  - what did you update from?
  - how many times has it happened

  - did you get a crash dump, and what is in the arp packet in the mbuf?
    What's ar_op?  ar_pro?  Is it otherwise sane?