Re: kern/52324: assertion "(target->prt_class == class)" failed: subr_psref.c", line 285

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

On Fri, Jun 23, 2017 at 4:40 AM,  <tnn%netbsd.org@localhost> wrote:
>>Number:         52324
>>Category:       kern
>>Synopsis:       assertion "(target->prt_class == class)" failed: subr_psref.c", line 285
>>Confidential:   no
>>Severity:       serious
>>Priority:       medium
>>Responsible:    kern-bug-people
>>State:          open
>>Class:          sw-bug
>>Submitter-Id:   net
>>Arrival-Date:   Thu Jun 22 19:40:00 +0000 2017
>>Originator:     Tobias Nygren
>>Release:        8.99.1 amd64
>>Organization:
>>Environment:
>>Description:
> I can reliably trigger this panic from userland by running a certain java application.
>
> panic: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/work/src/sys/kern/subr_psref.c", line 285 mismatched psref target class: 0x0 (ref) != 0xffffe400bfe0ed08 (expected)
> fatal breakpoint trap in supervisor mode
> trap type 1 code 0 rip 0xffffffff802249f5 cs 0x8 rflags 0x246 cr2 0x10020f000 ilevel 0x4 rsp 0xffffe40045b75b60
> curlwp 0xffffe400beb28200 pid 533.2 lowest kstack 0xffffe40045b722c0
> [0xffffffff802249f5->breakpoint][0xffffffff80226450->cpu_Debugger][0xffffffff80742474->db_panic][0xffffffff80990401->vpanic][0xffffffff80ce36b8->kern_assert][0xffffffff8099140b->psref_release][0xffffffff80a20d7e->if_put][0xffffffff806f4b38->ip6_ctloutput][0xffffffff80708380->udp6_ctloutput][0xffffffff806ea121->udp6_ctloutput_wrapper][0xffffffff809c286a->sosetopt][0xffffffff809c6ef2->sys_setsockopt][0xffffffff80250765->syscall]
> dumping to dev 20,1 (offset=14682167, size=786319):

Could you try the following diff?

  ozaki-r

diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index f9ddeaba9ac..688327e10e6 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -2561,6 +2561,7 @@ ip6_setmoptions(const struct sockopt *sopt,
struct in6pcb *in6p)
                 * Group must be a valid IP6 multicast address.
                 */
                bound = curlwp_bind();
+               ifp = NULL;
                error = ip6_get_membership(sopt, &ifp, &psref, &ia, sizeof(ia));
                if (error != 0) {
                        curlwp_bindx(bound);