From owner-freebsd-net@FreeBSD.ORG  Thu Jan  8 03:27:53 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 0F4DF16A4CE; Thu,  8 Jan 2004 03:27:53 -0800 (PST)
Received: from gw.catspoiler.org (217-ip-163.nccn.net [209.79.217.163])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 0A02D43D3F; Thu,  8 Jan 2004 03:27:52 -0800 (PST)
	(envelope-from truckman@FreeBSD.org)
Received: from FreeBSD.org (mousie.catspoiler.org [192.168.101.2])
	by gw.catspoiler.org (8.12.9p2/8.12.9) with ESMTP id i08BRh7E019581;
	Thu, 8 Jan 2004 03:27:47 -0800 (PST)
	(envelope-from truckman@FreeBSD.org)
Message-Id: <200401081127.i08BRh7E019581@gw.catspoiler.org>
Date: Thu, 8 Jan 2004 03:27:43 -0800 (PST)
From: Don Lewis <truckman@FreeBSD.org>
To: freebsd-net@FreeBSD.org
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
cc: sam@FreeBSD.org
cc: itojun@FreeBSD.org
Subject: panic in in6_ifdetach()
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Jan 2004 11:27:53 -0000

I was testing one of Warner's patches on my laptop and found that it
paniced during boot.  The trigger was that fxp0 couldn't gets its irq
configured in fxp_attach(), so it called ether_ifdetach(), which
eventually ended up calling in6_ifdetach(), which blew up at the line of
code marked below:

        /* remove route to link-local allnodes multicast (ff02::1) */
        bzero(&sin6, sizeof(sin6));
        sin6.sin6_len = sizeof(struct sockaddr_in6);
        sin6.sin6_family = AF_INET6;
        sin6.sin6_addr = in6addr_linklocal_allnodes;
        sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
        /* XXX grab lock first to avoid LOR */
--->    RADIX_NODE_HEAD_LOCK(rt_tables[AF_INET6]);
        rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
        if (rt) {
                if (rt->rt_ifp == ifp)
                        rtexpunge(rt);
                RTFREE_LOCKED(rt);
        }
        RADIX_NODE_HEAD_UNLOCK(rt_tables[AF_INET6]);

The problem is that during boot time the hardware is getting attached
well before route_init() is called, which is what initializes
rt_tables[].

It looks like the allnodes multicast address is not configured for the
interface until it is given an IPv6 address, so there should be no need
to remove the route until that has happened.

Any suggestions for a non-kludgey way to fix this?