kern/49426: /etc/rc.d/npf restart | npfctl show panic

[Hauke Fath <hauke%Espresso.Rhein-Neckar.DE@localhost>]

>Number:         49426
>Category:       kern
>Synopsis:       /etc/rc.d/npf restart | npfctl show panic
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 28 19:50:00 +0000 2014
>Originator:     Hauke Fath
>Release:        NetBSD 7.0_BETA
>Organization:
Falling Raindrops
>Environment:
	
	
System: NetBSD pizza.causeuse.org 7.0_BETA NetBSD 7.0_BETA (BLACKBOX-$Revision: 1.85 $) #0: Thu Nov 27 17:56:03 CET 2014 hauke%pizza.causeuse.org@localhost:/var/obj/netbsd-builds/7/amd64/sys/arch/amd64/compile/BLACKBOX amd64
Architecture: x86_64
Machine: amd64
>Description:

	The netbsd-7 npf code panics the kernel during basic
	operations like '/etc/rc.d/npf re{load,start}', 
	or 'npfctl show'.

	A sample stacktrace is

fatal protection fault in supervisor mode
trap type 4 code 0 rip ffffffff8049edfd cs 8 rflags 10202 cr2 7f7ff7b6e000 ilevel 0 rsp fffffe804064cb38
curlwp 0xfffffe811d50a200 pid 1268.1 lowest kstack 0xfffffe804064a2c0
panic: trap
cpu1: Begin traceback...
vpanic() at netbsd:vpanic+0x13c
snprintf() at netbsd:snprintf
startlwp() at netbsd:startlwp
alltraps() at netbsd:alltraps+0x96
mutex_vector_enter() at netbsd:mutex_vector_enter+0x93
npf_nat_freepolicy() at netbsd:npf_nat_freepolicy+0x1f
npf_rule_free() at netbsd:npf_rule_free+0x72
npf_ruleset_destroy() at netbsd:npf_ruleset_destroy+0x2f
npf_config_destroy() at netbsd:npf_config_destroy+0x19
npfctl_load() at netbsd:npfctl_load+0x312
VOP_IOCTL() at netbsd:VOP_IOCTL+0x3b
vn_ioctl() at netbsd:vn_ioctl+0xa6
sys_ioctl() at netbsd:sys_ioctl+0x17e
syscall() at netbsd:syscall+0x9a
--- syscall (number 54) ---
7f7ff5ed09fa:
cpu1: End traceback...

dumping to dev 168,2 (offset=2646991, size=1044126):

	-- dump files are available on request. Especially the 'npfctl
	show' panic appears to be reproducible.


>How-To-Repeat:

	Configure a machine to use npf, run basic maintenance
	operations. Notice that besides minor flaws like blocking
	traffic on lo0 independent of configuration, and no way of
	mapping log entries to rules, a plain /etc/rc.d/npf restart
	will panic the machine.

	Reluctantly switch back to pf.

>Fix:
	Yes, please.

>Unformatted: