kern/51877: carp related panic during shutdown

[Hauke Fath <hf%spg.tu-darmstadt.de@localhost>]

>Number:         51877
>Category:       kern
>Synopsis:       carp related panic during shutdown
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jan 14 15:45:00 +0000 2017
>Originator:     Hauke Fath
>Release:        NetBSD 7.99.58
>Organization:
Technische Universitaet Darmstadt
>Environment:
	
	
System: NetBSD Zinnenwand 7.99.58 NetBSD 7.99.58 (FIFI-$Revision$) #4: Fri Jan 13 13:20:31 CET 2017 hf@Hochstuhl:/var/obj/netbsd-builds/developer/amd64/sys/arch/amd64/compile/NFIFI amd64
Architecture: x86_64
Machine: amd64
>Description:

	A router set up with carp(4) for redundancy panics
	reproducibly during shutdown:

[...]
igphy3: detached
wm3: detached
igphy2: detached
wm2: detached
igphy1: detached
wm1: detached
igphy0: detached
carp0: state transition from: MASTER -> to: INIT
uvm_fault(0xfffffe821bbfde70, 0x10000, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff8040783d cs 8 rflags 10206 cr2 101e7 ilevel 6 rsp fffffe810f979650
curlwp 0xfffffe821d3d48c0 pid 178.1 lowest kstack 0xfffffe810f9762c0
Skipping crash dump on recursive panic
panic: trap
cpu3: Begin traceback...
vpanic() at netbsd:vpanic+0x140
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xb86
--- trap (number 6) ---
mutex_oncpu() at netbsd:mutex_oncpu+0x27
mutex_vector_enter() at netbsd:mutex_vector_enter+0xad
rt_update_wait() at netbsd:rt_update_wait+0x10
_rt_free() at netbsd:_rt_free+0x11
rtrequest1() at netbsd:rtrequest1+0x5ef
rtrequest() at netbsd:rtrequest+0x3e
carp_setroute() at netbsd:carp_setroute+0xd3
carp_setrun() at netbsd:carp_setrun+0x56
carp_carpdev_state() at netbsd:carp_carpdev_state+0x6c
if_down() at netbsd:if_down+0x17d
if_detach() at netbsd:if_detach+0x1d8
wm_detach() at netbsd:wm_detach+0xc1
config_detach() at netbsd:config_detach+0xf8
config_detach_all() at netbsd:config_detach_all+0x97
cpu_reboot() at netbsd:cpu_reboot+0x176
sys_reboot() at netbsd:sys_reboot+0x75
syscall() at netbsd:syscall+0x1df
--- syscall (number 208) ---
6fcc3443e43a:
cpu3: End traceback...
rebooting...


	
>How-To-Repeat:

	Set up a netbsd current machine pair with multiple carp(4)
	interfaces. Reboot, and watch it panic during shutdown.
 
	
>Fix:

	Yes, please.
	

>Unformatted: