Re: kern/60491: arp creates state for invalid messages

["Manuel Bouyer via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60491; it has been noted by GNATS.

From: Manuel Bouyer <bouyer%antioche.eu.org@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost,
        campbell+netbsd%mumble.net@localhost
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Wed, 21 Oct 2026 16:00:52 +0200

 On Sun, Oct 18, 2026 at 12:27:57PM +0200, Manuel Bouyer wrote:
 > On Fri, Oct 16, 2026 at 04:20:02PM +0000, Manuel Bouyer via gnats wrote:
 > >  I built a kernel with this patch and rebooted. Let see if we get a
 > >  panic ...
 > 
 > We got a panic:
 > login: [ 120230.6352646] panic: kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/dsk/l1/misc/bouyer/HEAD/clean/src/sys/netinet/if_arp.c", line 805 
 > [ 120230.6878828] cpu0: Begin traceback...
 > [ 120230.6995794] vpanic() at netbsd:vpanic+0x18d
 > [ 120230.7062625] kern_assert() at netbsd:kern_assert+0x61
 > [ 120230.7278936] in_arpinput() at netbsd:in_arpinput+0x516
 > [ 120230.7459382] arpintr() at netbsd:arpintr+0x11c
 > [ 120230.7552529] softint_dispatch() at netbsd:softint_dispatch+0x124
 > [ 120230.7779701] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa380695cd0f0
 > [ 120230.7953966] Xsoftintr() at netbsd:Xsoftintr+0x4c
 > [ 120230.8159324] --- interrupt ---
 > [ 120230.8278898] 0:
 > [ 120230.8278898] cpu0: End traceback...
 
 I changed the KASSERT to KASSERTMSG to print op, and got:
 login: [ 19315.2724722] panic: kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/dsk/l1/misc/bouyer/HEAD/clean/src/sys/netinet/if_arp.c", line 805 op not REQUEST or REPLY: 65535
 [ 19315.3281494] cpu0: Begin traceback...
 [ 19315.3400271] vpanic() at netbsd:vpanic+0x18d
 [ 19315.3529519] kern_assert() at netbsd:kern_assert+0x61
 [ 19315.3624476] in_arpinput() at netbsd:in_arpinput+0x51d
 [ 19315.3855787] arpintr() at netbsd:arpintr+0x11c
 [ 19315.4025654] softint_dispatch() at netbsd:softint_dispatch+0x124
 [ 19315.4134757] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffff8c80695cd0f0
 [ 19315.4457469] Xsoftintr() at netbsd:Xsoftintr+0x4c
 [ 19315.4531276] --- interrupt ---
 
 The change is:
 -       KASSERT(op == ARPOP_REPLY || op == ARPOP_REQUEST);
 +       KASSERTMSG(op == ARPOP_REPLY || op == ARPOP_REQUEST,
 +           "op not REQUEST or REPLY: %d", op);
 
 Looks like m_makewritable() may be at fault here.
 
 -- 
 Manuel Bouyer <bouyer%antioche.eu.org@localhost>
      NetBSD: 26 ans d'experience feront toujours la difference
 --