From owner-freebsd-bugs@FreeBSD.ORG  Tue Jul  5 11:20:08 2011
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 65201106564A
	for <freebsd-bugs@hub.freebsd.org>;
	Tue,  5 Jul 2011 11:20:08 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 4EF688FC0A
	for <freebsd-bugs@hub.freebsd.org>;
	Tue,  5 Jul 2011 11:20:08 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p65BK88L014415
	for <freebsd-bugs@freefall.freebsd.org>; Tue, 5 Jul 2011 11:20:08 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p65BK8hC014413;
	Tue, 5 Jul 2011 11:20:08 GMT (envelope-from gnats)
Date: Tue, 5 Jul 2011 11:20:08 GMT
Message-Id: <201107051120.p65BK8hC014413@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Mike Cui <cuicui@gmail.com>
Cc: 
Subject: Re: kern/158665: kernel pagefault in in6_setscope()
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Mike Cui <cuicui@gmail.com>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Jul 2011 11:20:08 -0000

The following reply was made to PR kern/158665; it has been noted by GNATS.

From: Mike Cui <cuicui@gmail.com>
To: bug-followup@FreeBSD.org, cuicui@gmail.com
Cc:  
Subject: Re: kern/158665: kernel pagefault in in6_setscope()
Date: Tue, 5 Jul 2011 03:47:53 -0700

 Got a kernel dump, here's the stack trace. Unfortunately I didn't
 build the kernel with debugging info.
 
 
 #7  0xc069cee8 in in6_setscope ()
 #8  0xc0685bb9 in in6_selectsrc ()
 #9  0xc069aa80 in rip6_output ()
 #10 0xc069b193 in rip6_send ()
 #11 0xc05a7885 in sosend_generic ()
 #12 0xc05a38cf in sosend ()
 #13 0xc05ab139 in kern_sendit ()
 #14 0xc05ab341 in sendit ()
 #15 0xc05ab3f1 in sendmsg ()
 #16 0xc0581d2c in syscallenter ()
 #17 0xc07278a4 in syscall ()
 
 From the stack trace, it looks like the call happened on in6_src.c:309:
 
         IN6_IFADDR_RLOCK();
         TAILQ_FOREACH(ia, &V_in6_ifaddrhead, ia_link) {
                 int new_scope = -1, new_matchlen = -1;
                 struct in6_addrpolicy *new_policy = NULL;
                 u_int32_t srczone, osrczone, dstzone;
                 struct in6_addr src;
                 struct ifnet *ifp1 = ia->ia_ifp;
 
                 /*
                  * We'll never take an address that breaks the scope
 zone
                  * of the destination.  We also skip an address if its
 zone
                  * does not contain the outgoing interface.
                  * XXX: we should probably use sin6_scope_id here.
                  */
                 if (in6_setscope(&dst, ifp1, &dstzone) ||  <---- HERE
                     odstzone != dstzone) {
                         continue;
                 }