port-amd64/46587: Kernel panic on shutdown of bridge

[roger.pau%citrix.com@localhost]

>Number:         46587
>Category:       port-amd64
>Synopsis:       Kernel panic on shutdown of bridge
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    port-amd64-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 11 16:15:00 +0000 2012
>Originator:     Roger Pau Monne
>Release:        6.0BETA2
>Organization:
Citrix
>Environment:
NetBSD test 6.0_BETA2 NetBSD 6.0_BETA2 (XEN3_DOM0) #0: Mon Jun 11 17:03:22 BST 
2012  root@test:/root/obj/sys/arch/amd64/compile/XEN3_DOM0 amd64
>Description:
Kernel panics when doing a 'shutdown -r now' under a Xen Dom0, if a bridge 
interface is present:

bnx1: detached
Skipping crash dump on recursive panic
panic: kernel diagnostic assertion "c->c_magic == CALLOUT_MAGIC" failed: file 
"/usr/src/sys/kern/kern_timeout.c", line 385 
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80224405 cs e030 rflags 246 cr2  7f7ff7091640 
cpl 6 rsp ffffa000357236f0
Stopped in pid 20534.1 (reboot) at      netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x1f2
kern_assert() at netbsd:kern_assert+0xae
callout_reset() at netbsd:callout_reset+0x98
bnx_init() at netbsd:bnx_init+0x103
bnx_ioctl() at netbsd:bnx_ioctl+0xf0
if_flags_set() at netbsd:if_flags_set+0x96
ifpromisc() at netbsd:ifpromisc+0x33
bridge_delete_member() at netbsd:bridge_delete_member+0x39
bridge_ioctl_del() at netbsd:bridge_ioctl_del+0x28
bridge_ifdetach() at netbsd:bridge_ifdetach+0x57
ether_ifdetach() at netbsd:ether_ifdetach+0x19
bnx_detach() at netbsd:bnx_detach+0xaa
config_detach() at netbsd:config_detach+0xda
config_detach_all() at netbsd:config_detach_all+0x7d
cpu_reboot() at netbsd:cpu_reboot+0x139
sys_reboot() at netbsd:sys_reboot+0x73
syscall() at netbsd:syscall+0xc4
ds          64
es          3730
fs          100
gs          1200
rdi         0
rsi         deadbeef
rbp         ffffa000357236f0
rbx         4
rdx         0
rcx         8
rax         1
r8          ffffffff80c0e3c0    cpu_info_primary
r9          1
r10         0
r11         1
r12         ffffffff80a9dbd8    __link_set_malloc_types_sym_M_XDATA+0x600
r13         ffffa00035723730
r14         64
r15         80906910
rip         ffffffff80224405    breakpoint+0x5
cs          e030
rflags      246
rsp         ffffa000357236f0
ss          e02b
netbsd:breakpoint+0x5:  leave
db> 
>How-To-Repeat:
From a NetBSD Dom0 (amd64) with a bnx2 card create a bridge, and then reboot 
the system.
>Fix: