kern/60988: kernel crash in ipf_check after removing interface

["phlash%ashbysoft.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60988
>Category:       kern
>Synopsis:       kernel crash in ipf_check after removing interface
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 10 21:55:00 +0000 2026
>Originator:     Phil Ashby
>Release:        NetBSD 11.0_STABLE
>Environment:
System: NetBSD timmy-iv 11.0_STABLE NetBSD 11.0_STABLE (GENERIC) #0: Tue Aug 25 20:15:20 UTC 2026 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
	After tearing down a pppd link interface, with an active set of ipf rules,
	the kernel panics shortly afterwards (it seems on the next packet processed).

	dmesg log from /var/run/dmesg.boot after restart:

	wsdisplay0: screen 1 added (default, vt100 emulation)
	fatal page fault in supervisor mode
	trap type 6 code 0x10 rip 0x270 cs 0x8 rflags 0x10246 cr2 0x270 ilevel 0x4 rsp 0xffffbd84a05b3758
	curlwp 0xffff94992b57d400 pid 0.3 lowest kstack 0xffffbd84a05af2c0
	panic: trap
	cpu0: Begin traceback...
	vpanic() at netbsd:vpanic+0x171
	panic() at netbsd:panic+0x3c
	trap() at netbsd:trap+0xb32
	--- trap (number 6) ---
	?() at 270
	ipf_check() at ipl:ipf_check+0x441
	pfil_run_hooks() at netbsd:pfil_run_hooks+0x114
	ip_output() at netbsd:ip_output+0x46e
	tcp_output() at netbsd:tcp_output+0x1661
	tcp_input() at netbsd:tcp_input+0xf70
	ipintr() at netbsd:ipintr+0x8b0
	softint_dispatch() at netbsd:softint_dispatch+0x95
	DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffbd84a05b40f0
	Xsoftintr() at netbsd:Xsoftintr+0x4c
	--- interrupt ---
	eb01974d10334fac:
	cpu0: End traceback...
	dumping to dev 168,2 (offset=8, size=4133857):

	A crash dump can be made available.
>How-To-Repeat:
	Activate ipf (ipf -E)
	Apply a ruleset for ppp0 (ipf -f /etc/ipf.conf) - see below
	Bring up ppp0
	Ensure there is network traffic over ppp0
	Tear down ppp0
	Wait for a few seconds (until the next packet is processed in ipf)

	The ruleset contains a policy re-routing rule for outbound traffic
	and a number of pass in rules for allowed inbound traffic, then a
	default block and log rule, as follows:

	# public interface info
	pub_if="ppp0";
	pub_ip="81.187.239.221";
	pub_rt="81.187.81.187";

	# policy route packets *from* wan IP to the WAN router (not default)
	# NB: do NOT specify interface on which these may occur - we catch all
	# keep state so that reply traffic is also permitted
	pass out quick to $pub_if:$pub_rt from $pub_ip keep state

	# apply fail2ban block list first (see ippool(8) hashes)
	block in log quick on $pub_if from pool/fail2ban comment "fail2ban"

	# default block all traffic from public, may be overridden..
	block in log on $pub_if all comment "block"

	# permit specific ports
	# - ssh
	pass in quick on $pub_if proto tcp to port = 22 comment "ssh"
	# - smtp(s)
	pass in quick on $pub_if proto tcp to port = 25 comment "smtp"
	pass in quick on $pub_if proto tcp to port = 465 comment "smtps"
	pass in quick on $pub_if proto tcp to port = 587 comment "submission"
	# - imap(s)
	pass in quick on $pub_if proto tcp to port = 143 comment "imap"
	pass in quick on $pub_if proto tcp to port = 993 comment "imaps"
	# - caldav/carddav
	pass in quick on $pub_if proto tcp to port = 5232 comment "dav"
	# - http(s)
	pass in quick on $pub_if proto tcp to port = 80 comment "http"
	pass in quick on $pub_if proto tcp to port = 443 comment "https"
	# - dhcpv6
	pass in quick on $pub_if proto udp to port = 546 comment "dhcpv6"
	# - icmp (ping etc.)
	pass in quick on $pub_if proto icmp comment "icmp"
	pass in quick on $pub_if proto ipv6-icmp comment "icmp6"

>Fix:
	Issue is only apparant if ipf is enabled/active when link has been removed,
	hence my workaround is to disable ipf (ipf -D) in /etc/ppp/ip-down hook script
	(and similarly enable and apply rules in /etc/ppp/ip-up hook script).