kern/47881: diagnostic panic in6_delmulti()

[kardel%netbsd.org@localhost]

>Number:         47881
>Category:       kern
>Synopsis:       kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || 
>c->c_cpu->cc_active != c" failed
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 03 07:40:00 +0000 2013
>Originator:     Frank Kardel
>Release:        NetBSD 6.99.20
>Organization:
        
>Environment:
        
        
System: NetBSD gateway.kardel.name 6.99.20 NetBSD 6.99.20 (GATEWAY) #3: Sat May 
25 15:10:16 CEST 2013 
kardel%pip.kardel.name@localhost:/fs/raid1a/src/NetBSD/cur/src/obj.amd64/sys/arch/amd64/compile/GATEWAY
 amd64
Architecture: x86_64
Machine: amd64
>Description:
        While running an IPv6 tunnel (freenet6) occasionally the kernel crashe 
with following panic.

          #0  0xffffffff805a32d3 in cpu_reboot (howto=260, bootstr=<optimized 
out>) at /fs/raid1a/src/NetBSD/cur/src/sys/arch/amd64/amd64/machdep.c:705
          #1  0xffffffff80795bcd in vpanic (fmt=0xffffffff80b677d8 "kernel 
%sassertion \"%s\" failed: file \"%s\", line %d ", ap=0xffff80005be338e0) at 
/fs/raid1a/src/NetBSD/cur/src/sys/kern/subr_prf.c:284
          #2  0xffffffff80914c98 in kern_assert (fmt=<unavailable>) at 
/fs/raid1a/src/NetBSD/cur/src/sys/lib/libkern/kern_assert.c:50
          #3  0xffffffff80546a87 in callout_destroy (cs=0xffff800006e83398) at 
/fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_timeout.c:313
          #4  0xffffffff805c6e21 in in6_delmulti (in6m=0xffff800006e83348) at 
/fs/raid1a/src/NetBSD/cur/src/sys/netinet6/mld6.c:744
          #5  0xffffffff805c6f91 in in6_leavegroup (imm=0xffff800006d7b428) at 
/fs/raid1a/src/NetBSD/cur/src/sys/netinet6/mld6.c:777
          #6  0xffffffff804946fe in ip6_freemoptions (im6o=0xffff800006c19fa8) 
at /fs/raid1a/src/NetBSD/cur/src/sys/netinet6/ip6_output.c:2589
          #7  0xffffffff8047936d in in6_pcbdetach (in6p=0xffff800005451570) at 
/fs/raid1a/src/NetBSD/cur/src/sys/netinet6/in6_pcb.c:610
          #8  0xffffffff8080f4cb in udp6_usrreq (so=0xffff80000e9e4b70, 
req=<optimized out>, m=0x0, addr6=0x0, control=0x0, l=<optimized out>) at 
/fs/raid1a/src/NetBSD/cur/src/sys/netinet6/udp6_usrreq.c:410
          #9  0xffffffff8047a46a in udp6_usrreq_wrapper (a=0xffff80000e9e4b70, 
b=1, c=0x0, d=0x0, e=<optimized out>, f=<optimized out>) at 
/fs/raid1a/src/NetBSD/cur/src/sys/netinet6/in6_proto.c:139
          #10 0xffffffff8083bb5f in soclose (so=0xffff80000e9e4b70) at 
/fs/raid1a/src/NetBSD/cur/src/sys/kern/uipc_socket.c:743
          #11 0xffffffff807b08c5 in soo_close (fp=0xffff800006ada340) at 
/fs/raid1a/src/NetBSD/cur/src/sys/kern/sys_socket.c:257
          #12 0xffffffff8050e803 in closef (fp=0xffff800006ada340) at 
/fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_descrip.c:824
          #13 0xffffffff8050eae5 in fd_close (fd=11) at 
/fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_descrip.c:709
          #14 0xffffffff807a4641 in sys_close (l=0xffff8000069e70c0, 
uap=0xffff80005be33c80, retval=<optimized out>) at 
/fs/raid1a/src/NetBSD/cur/src/sys/kern/sys_descrip.c:488
          #15 0xffffffff807b0dc1 in sy_call (rval=0xffff80005be33c30, 
uap=0xffff80005be33c80, l=0xffff8000069e70c0, sy=0xffffffff80ec3ca0) at 
/fs/raid1a/src/NetBSD/cur/src/sys/sys/syscallvar.h:61
          #16 syscall (frame=0xffff80005be33c80) at 
/fs/raid1a/src/NetBSD/cur/src/sys/arch/x86/x86/syscall.c:161
          #17 0xffffffff801006a1 in do_syscall ()
          #18 0x000000000000000b in ?? ()
          #19 0x0000000000000000 in ?? ()
          (gdb) print panicstr
          $1 = 0xffffffff80f6f7c0 "kernel diagnostic assertion 
\"c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c\" failed: file 
\"/fs/raid1a/src/NetBSD/cur/src/sys/kern/kern_timeout.c\", line 313 "
>How-To-Repeat:
        run 6.99.20 with a freenet6 tunnel (gogoc tunnelbroker client).
>Fix:

>Unformatted: