kern/42187: rtadvd + vlan(4) + /etc/rc.d/network restart triggers assertion

[johani%johani.org@localhost]

>Number:         42187
>Category:       kern
>Synopsis:       rtadvd + vlan(4) + /etc/rc.d/network restart triggers assertion
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 15 16:15:00 +0000 2009
>Originator:     Johan Ihren
>Release:        NetBSD 5.0_STABLE
>Organization:
                Me, myself and I
>Environment:
System: NetBSD ns.johani.org 5.0_STABLE NetBSD 5.0_STABLE (XEN3PAE_DOMU) #0: 
Tue Jul 7 05:10:03 PDT 2009 
builds@wb37:/home/builds/ab/netbsd-5/i386/200907060002Z-obj/home/builds/ab/netbsd-5/src/sys/arch/i386/compile/XEN3PAE_DOMU
 i386
Architecture: i386
Machine: i386
>Description:
                If a vlan(4) interface which rtadvd is using is removed then
                subsequent access to the (no longer existing) interface by
                rtadvd will trigger an assertion.

                This typically happens when doing presumably safe things like
                /etc/rc.d/network restart, which is more of a problem than
                doing stupid things like destroying interfaces that are in use.

                My problem is that I depend on my students being able to do
                "/etc/rc.d/network restart" to clean up when they've messed up.
>How-To-Repeat:

ns.alpha.dnslab:/root#grep rtadv /etc/rc.conf
rtadvd=YES
rtadvd_flags="vlan1"
ns.alpha.dnslab:/root#/etc/rc.d/rtadvd start
Starting rtadvd.
ns.alpha.dnslab:/root#ifconfig vlan1 destroy
ns.alpha.dnslab:/root#/etc/rc.d/rtadvd stop
Stopping rtadvd.
Waiting for PIDS: 1968, 1968, 1968, 1968, 1968panic: kernel diagnostic 
assertion "c->c_magic == CALLOUT_MAGIC" failed: file 
"/home/builds/ab/netbsd-5/src/sys/kern/kern_timeout.c", line 424
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c039682c cs 9 eflags 246 cr2 bb7bf7bc ilevel 4
Stopped in pid 1968.1 (rtadvd) at       netbsd:breakpoint+0x4:  popl    %ebp
db> bt
breakpoint(c0449733,cb352888,c045ee80,c03399cb,c04bd2a0,0,2,c0274e85,c0493524,c0
ccd000) at netbsd:breakpoint+0x4
panic(c0453980,c04189e1,c043ba76,c043bb3c,1a8,0,cb3528cc,c02eec49,c04189e1,c043b
b3c) at netbsd:panic+0x1a6
__kernassert(c04189e1,c043bb3c,1a8,c043ba76,0,0,2,c0d1b900,c0d463c4,0) at netbsd
:__kernassert+0x39
callout_stop(c0d1b934,c0d1b900,cb352a4c,c016cc08,4,ec0088,c0ccbbcc,c040c680,caec
85c4,48) at netbsd:callout_stop+0xa9
mld_stoptimer(4,ec0088,c0ccbbcc,c040c680,caec85c4,48,0,cb00a034,0,0) at netbsd:m
ld_stoptimer+0x1a
in6_delmulti(c0d1b900,c0c9cf60,cb352a6c,c0324c4a,0,c0c65420,cb352a8c,c01686da,c0
c652c0,c0d1cae0) at netbsd:in6_delmulti+0x28
in6_leavegroup(c0c652c0,c0d1cae0,cb352aac,c03ac8ba,0,c0c9cf30,cb352aac,c0160029,
c0c65420,c04ba6e0) at netbsd:in6_leavegroup+0x18
ip6_freemoptions(c0c65420,c04ba6e0,20,0,0,0,cb352b1c,c017634b,c0c9cf30,c045b5e0)
 at netbsd:ip6_freemoptions+0x2a
in6_pcbdetach(c0c9cf30,c045b5e0,cb352aec,c03ac8ba,1,0,ffffffff,ffffffff,c0d46a84
,0) at netbsd:in6_pcbdetach+0x89
rip6_usrreq(c0d463c4,1,0,0,0,0,cb352b5c,c02bf3eb,caec6e80,caec6e80) at netbsd:ri
p6_usrreq+0x13b
soclose(c0d463c4,0,cb352bac,c02c082d,caec6e80,21,cb352b8c,c03546b5,cb352b80,caec
85c4) at netbsd:soclose+0x149
soo_close(caec6e80,21,cb352b8c,c03546b5,cb352b80,caec85c4,cb352b9c,1,c9f5a7fc,c9
f5a7e8) at netbsd:soo_close+0x1b
closef(caec6e80,4,2bdc,caec5de0,c9f4b018,caec5de0,cb352c0c,c02ff97f,caec5d08,cae
c6e80) at netbsd:closef+0x5d
fd_close(4,caec5de0,ffffffff,ffffffff,0,caec9a44,14,cb352ca8,cb310cf0,0) at netb
sd:fd_close+0x119
fd_free(cb310cf0,0,cb352ca8,c9f58350,bb7bf000,1000,cb310d04,13,cb30aec4,1000) at
 netbsd:fd_free+0x98
exit1(cb2110a0,0,a,7fc3adc0,cb2110a0,0,cb352d3c,c03a61c7,cb2110a0,cb352d00) at n
etbsd:exit1+0x128
sys_exit(cb2110a0,cb352d00,cb352d28,bb7bf000,c9f58350,c9f58350,1,0,bb7c39b8,bf7f
e3f8) at netbsd:sys_exit+0x4d
syscall(cb352d48,1f,805001f,bf7f001f,1f,bf7fe4b8,3,bf7fe3f8,bb7c39b8,8052308) at
 netbsd:syscall+0xc7
db> 

>Fix:

Unknown.

>Unformatted:
                All versions of 5.0_STABLE up till early October 2009. Also 
                -current up till 5.99.15 (haven't tried anything more recent).