kern/51467: detaching USB network interface panics

[mlelstv%serpens.de@localhost]

>Number:         51467
>Category:       kern
>Synopsis:       detaching USB network interface panics
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 11 15:15:00 +0000 2016
>Originator:     Michael van Elst
>Release:        NetBSD 7.99.36
>Organization:
	
>Environment:
	
	
System: NetBSD tazz 7.99.36 NetBSD 7.99.36 (TAZZ) #7: Sun Sep 11 16:12:19 CEST 2016 mlelstv@gossam:/home/netbsd-current/obj.amd64/home/netbsd-current/src/sys/arch/amd64/compile/TAZZ amd64
Architecture: x86_64
Machine: amd64
>Description:
Detaching a configured run(4) interface resulted in a panic.

DDB shows:

find_pfxlist_reachable_router.isra.6() at find_pfxlist_reachable_router.isra.6+0x11
pfxlist_onlink_check() at pfxlist_onlink_check+0x132
nd6_purge() at nd6_purge+0x103
in6_ifdetach() at in6_ifdetach+0x1b
udp6_purgeif_wrapper() at udp6_purgeif_wrapper+0x39
if_detach() at if_detach+0x264
run_detach() at run_detach+0x75
config_detach() at config_detach+0xf8
usb_disconnect_port() at usb_disconnect_port+0x18b
uhub_explore() at uhub_explore+0x1fe
uhub_explore() at uhub_explore+0xac
usb_discover() at usb_discover+0x6f
usb_event_thread() at usb_event_thread+0x238

GDB shows more detail:

#8  0xffffffff80566be7 in find_pfxlist_reachable_router (pr=<optimized out>)
    at /home/netbsd-current/src/sys/netinet6/nd6_rtr.c:1416
#9  0xffffffff80567a07 in pfxlist_onlink_check () at /home/netbsd-current/src/sys/netinet6/nd6_rtr.c:1576
#10 0xffffffff8056800c in prelist_remove (pr=<optimized out>)
    at /home/netbsd-current/src/sys/netinet6/nd6_rtr.c:1058
#11 0xffffffff805610d6 in nd6_purge (ifp=ifp@entry=0xffff8000070f3008, ext=0xfffffe811e16aab8, ext@entry=0x0)
    at /home/netbsd-current/src/sys/netinet6/nd6.c:866
#12 0xffffffff8054cf7f in in6_ifdetach (ifp=ifp@entry=0xffff8000070f3008)
    at /home/netbsd-current/src/sys/netinet6/in6_ifattach.c:815

   0xffffffff80566bd6 <find_pfxlist_reachable_router>:  push   %rbp
   0xffffffff80566bd7 <find_pfxlist_reachable_router+1>:        mov    %rsp,%rbp
   0xffffffff80566bda <find_pfxlist_reachable_router+4>:        push   %rbx
   0xffffffff80566bdb <find_pfxlist_reachable_router+5>:        sub    $0x8,%rsp
   0xffffffff80566bdf <find_pfxlist_reachable_router+9>:        mov    %rdi,%rbx
   0xffffffff80566be2 <find_pfxlist_reachable_router+12>:       test   %rdi,%rdi
   0xffffffff80566be5 <find_pfxlist_reachable_router+15>:       je     0xffffffff80566c38 <find_pfxlist_reachable_router+98>
=> 0xffffffff80566be7 <find_pfxlist_reachable_router+17>:       mov    0x10(%rbx),%rdi
   0xffffffff80566beb <find_pfxlist_reachable_router+21>:       mov    0x30(%rdi),%rsi
   0xffffffff80566bef <find_pfxlist_reachable_router+25>:       testb  $0x1,0x4c(%rsi)

rbx            0x2587e94bac0e70d2       2704386612477718738

which is garbage.


>How-To-Repeat:
Detach a USB network interface that has IPv6 configured.

>Fix:
	

>Unformatted: