kern/53175: Panic related to PF with NET_MPSAFE enabled kernel

[venture37%geeklan.co.uk@localhost]

>Number:         53175
>Category:       kern
>Synopsis:       Panic related to PF with NET_MPSAFE enabled kernel
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Apr 11 16:25:00 +0000 2018
>Originator:     Sevan Janiyan
>Release:        NetBSD 8.99.14 built with src checkout from ~2 hours ago
>Organization:
>Environment:
NetBSD 8.99.14 amd64 x86_64
>Description:
I have a kernel based on amd64 GENERIC config with the addition of all altq options, pf & pflog as well as NET_MPSAFE enabled.

This is running on an PCengines APU2, system was running without issues for a couple of hours, reaching around 379Mbps down on a 350Mbps cable modem service, then the system started crashing.

The backtrace is as follows

login: uvm_fault(0xffffffff815b2840, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip 0xffffffff8077f83e cs 0x8 rflags 0x10206 cr2 0x30 ilevel 0x4 rsp 0xffff800067fe1f08
curlwp 0xffffe40107fe85a0 pid 0.67 lowest kstack 0xffff800067fde2c0
panic: trap
cpu2: Begin traceback...
vpanic() at netbsd:vpanic+0x152
snprintf() at netbsd:snprintf
startlwp() at netbsd:startlwp
alltraps() at netbsd:alltraps+0xc8
pf_state_tree_id_RB_REMOVE() at netbsd:pf_state_tree_id_RB_REMOVE+0xca
pf_unlink_state() at netbsd:pf_unlink_state+0x21
pf_purge_expired_states() at netbsd:pf_purge_expired_states+0x77
pf_purge_thread() at netbsd:pf_purge_thread+0x72
cpu2: End traceback...

pf.conf:
ext_if="wm0"
int_if="wm2"
foo_if="vlan0"

set skip on lo

scrub in
altq on $ext_if priq bandwidth 20Mb queue { q_pri, q_def }
queue q_pri priority 7
queue q_def priority 1 priq(default)

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $ext_if proto tcp from any to self port https \
        -> 192.168.0.1 port https

anchor "ftp-proxy/*"
block in
pass out queue (q_def, q_pri)

pass quick on { $int_if $foo_if } no state queue (q_def, q_pri)
antispoof quick for { lo $int_if $foo_if }

pass in on $ext_if proto tcp to self port https

I have a core dump if anyone needs it.

>How-To-Repeat:

>Fix: