kern/51828: Panic after configuring vlan on nonexistent phys interface

[Hauke Fath <hf%spg.tu-darmstadt.de@localhost>]

>Number:         51828
>Category:       kern
>Synopsis:       Panic after configuring vlan on nonexistent phys interface
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 11 15:45:00 +0000 2017
>Originator:     Hauke Fath
>Release:        NetBSD 7.99.57
>Organization:
Technische Universitaet Darmstadt
>Environment:
	
	
System: NetBSD 7.99.57 (FIFI-$Revision$) #0: Tue Jan 10 15:12:17 CET 
2017
        
hf@Hochstuhl:/var/obj/netbsd-builds/developer/amd64/sys/arch/amd64/compile/FIFI
Architecture: x86_64
Machine: amd64
>Description:

	For testing purposes, I brought a NetBSD 7 pf / pfsync / carp
	setup to a different machine. Some of its physical interfaces
	are disconnected.

	The netbsd-7 kernel complained, and moved on.

	A netbsd-current DIAGNOSTIC / DEBUG kernel panics:

[...]
IPv6 mode: host
Configuring network interfaces: wm0 wm1wm1: link state DOWN (was 
UNKNOWN)
 wm3wm3: link state DOWN (was UNKNOWN)
 vlan2 vlan3 vlan7 vlan8 vlan9 vlan10 vlan11 vlan12 carp0ifconfig: 
SIOCAIFADDR_IN6: Can'tfatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff804655c6 cs 8 rflags 10207 cr2 d56 
ilevel 5 rsp fffffe8040093db0
curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
panic: trap
cpu4: Begin traceback...
vpanic() at netbsd:vpanic+0x140
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xb86
--- trap (number 6) ---
psref_acquire() at netbsd:psref_acquire+0x65
in6ifa_ifpforlinklocal_psref() at 
netbsd:in6ifa_ifpforlinklocal_psref+0x3a
mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
mld_start_listening() at netbsd:mld_start_listening+0x89
mld_timeo() at netbsd:mld_timeo+0x6f
callout_softclock() at netbsd:callout_softclock+0x201
softint_dispatch() at netbsd:softint_dispatch+0xd9
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
cpu4: End traceback...

dumping to dev 18,1 (offset=3903183, size=1048102):
dump  assign requested address
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff80118d2a cs 8 rflags 10246 cr2 38 ilevel 
8 rsp fffffe8040093ac0
curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
Skipping crash dump on recursive panic
panic: trap
cpu4: Begin traceback...
vpanic() at netbsd:vpanic+0x140
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xb86
--- trap (number 6) ---
sparse_dump_mark() at netbsd:sparse_dump_mark+0x10c
dump_seg_prep() at netbsd:dump_seg_prep+0x22
dodumpsys() at netbsd:dodumpsys+0xbe
dumpsys() at netbsd:dumpsys+0x1d
vpanic() at netbsd:vpanic+0x149
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xb86
--- trap (number 6) ---
psref_acquire() at netbsd:psref_acquire+0x65
in6ifa_ifpforlinklocal_psref() at 
netbsd:in6ifa_ifpforlinklocal_psref+0x3a
mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
mld_start_listening() at netbsd:mld_start_listening+0x89
mld_timeo() at netbsd:mld_timeo+0x6f
callout_softclock() at netbsd:callout_softclock+0x201
softint_dispatch() at netbsd:softint_dispatch+0xd9
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
cpu4: End traceback...
rebooting...


	
>How-To-Repeat:
	
	Run a DEBUG/DIAGNOSTIC -current kernel with multiple network 
interfaces, some with conflicting setup.
 
	
>Fix:
	No idea.

	

>Unformatted: