kern/50629: netbsd-7 kernel panic

[6bone%6bone.informatik.uni-leipzig.de@localhost]

>Number:         50629
>Category:       kern
>Synopsis:       netbsd-7 kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 06 06:40:00 +0000 2016
>Originator:     Uwe Toenjes
>Release:        netbsd-7
>Organization:
University of Leipzig
>Environment:
NetBSD gate.ipv6.uni-leipzig.de 7.0_STABLE NetBSD 7.0_STABLE (MYCONF7.gdb) #1: Mon Nov  2 09:58:45 CET 2015  root%gate.ipv6.uni-leipzig.de@localhost:/usr/obj/sys/arch/amd64/compile/MYCONF7.gdb amd64
>Description:
on routers with high network load kernel panics can occur

panic: kernel diagnostic assertion "(m)->m_type != MT_FREE" failed: file "/usr/src/sys/kern/uipc_mbuf.c", line 652
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x13c
kern_assert() at netbsd:kern_assert+0x4f
m_freem() at netbsd:m_freem+0xa7
ipf_fastroute() at netbsd:ipf_fastroute+0x397
ipf_send_ip() at netbsd:ipf_send_ip+0x13c
ipf_send_icmp_err() at netbsd:ipf_send_icmp_err+0x1fa
ipf_check() at netbsd:ipf_check+0x88c
pfil_run_hooks() at netbsd:pfil_run_hooks+0xc4
ip6_input() at netbsd:ip6_input+0x307
ip6intr() at netbsd:ip6intr+0x48
softint_dispatch() at netbsd:softint_dispatch+0xd3
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe813a5efff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
cpu0: End traceback...

dumping to dev 4,1 (offset=4589220, size=8388067):
dump

#####

Reading symbols from /netbsd...done.
(gdb) target kvm /tmp/netbsd.23.core
0xffffffff80689f9f in cpu_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:671
671                     dumpsys();
(gdb) bt
#0  0xffffffff80689f9f in cpu_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:671
#1  0xffffffff808b72b4 in vpanic (
    fmt=0xffffffff80d000f8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=ap@entry=0xfffffe813a5ef9f0) at /usr/src/sys/kern/subr_prf.c:340
#2  0xffffffff80a53b83 in kern_assert (
    fmt=fmt@entry=0xffffffff80d000f8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ") at /usr/src/sys/lib/libkern/kern_assert.c:51
#3  0xffffffff8096830b in m_freem (m=0xfffffe8826a7f000)
    at /usr/src/sys/kern/uipc_mbuf.c:652
#4  0xffffffff8056f758 in ipf_fastroute (m0=0xfffffe8826a7f000,
    mpp=mpp@entry=0xfffffe813a5efb70, fin=fin@entry=0xfffffe813a5efb78,
    fdp=fdp@entry=0x0)
    at /usr/src/sys/external/bsd/ipf/netinet/ip_fil_netbsd.c:1073
#5  0xffffffff8056eb4d in ipf_send_ip (fin=fin@entry=0xfffffe813a5efd50,
    m=m@entry=0xfffffe8826a7f000)
    at /usr/src/sys/external/bsd/ipf/netinet/ip_fil_netbsd.c:849
#6  0xffffffff8056f033 in ipf_send_icmp_err (type=<optimized out>,
    type@entry=3, fin=fin@entry=0xfffffe813a5efd50, dst=dst@entry=0)
    at /usr/src/sys/external/bsd/ipf/netinet/ip_fil_netbsd.c:1033
#7  0xffffffff80356917 in ipf_check (ctx=0xffffffff81106600 <ipfmain>,
    ip=<optimized out>, hlen=<optimized out>, ifp=<optimized out>,
    out=<optimized out>, mp=0xfffffe813a5efea0)
    at /usr/src/sys/external/bsd/ipf/netinet/fil.c:3072
#8  0xffffffff8074d2ef in pfil_run_hooks (ph=<optimized out>,
    mp=mp@entry=0xfffffe813a5efee8, ifp=0xfffffe8826bfd410, dir=dir@entry=1)
    at /usr/src/sys/net/pfil.c:266
#9  0xffffffff8055a8b1 in ip6_input (m=0xfffffe8821193000)
    at /usr/src/sys/netinet6/ip6_input.c:350
#10 0xffffffff8055b265 in ip6intr (arg=<optimized out>)
    at /usr/src/sys/netinet6/ip6_input.c:238
#11 0xffffffff8061aa98 in softint_execute (l=<optimized out>, s=4,
    si=0xffff80023b4e7230) at /usr/src/sys/kern/kern_softint.c:589
#12 softint_dispatch (pinned=<optimized out>, s=4)
    at /usr/src/sys/kern/kern_softint.c:871
#13 0xffffffff8011412f in Xsoftintr ()

>How-To-Repeat:

>Fix: