mpd5/Netgraph issues after upgrading to 7.4

[Gleb Smirnoff]

On Fri, Jun 15, 2012 at 01:33:05PM +0200, Przemyslaw Frasunek wrote:
P> unfortunately, one of my mpd5 PPPoE access servers started panicing every few
P> hours.
P> 
P> I'm running recent 8.3-STABLE (as of 23th May) with WITNESS, INVARIANTS and
P> DEBUG_MEMGUARD compiled. Unfortunately, I'm unable to catch crashdump. For some
P> reason, it is not saved on dumpdev.
P> 
P> The only thing I have is panic string:
P> 
P> Fatal trap 9: general protection fault while in kernel mode
P> cpuid = 2; apic id = 02
P> instruction pointer      = 0x20:0xffffffff804b4e2d
P> stack pointer            = 0x28:0xffffff8185386560
P> frame pointer            = 0x28:0xffffff81853865d0
P> code segment             = base 0x0, limit 0xfffff, type 0x1b
P> 			 = DPL 0, pres 1, long 1, def32 0, gran 1
P> processor eflags 	 = interrupt enabled, resume, IOPL = 0
P> current process          = 2832 (mpd5)
P> trap number              = 9
P> 
P> According to "objdump -d", the fault address points to prelist_remove().
P> 
P> I tried to replace all of hardware, but it still panics in the same way. I would
P> be really grateful for any hints.
P> 
P> dmesg output: http://www.frasunek.com/tmp/dmesg.txt
P> kernel config: http://www.frasunek.com/tmp/kernel.txt

I suspect this isn't related to netgraph, but to IPv6 since prelist_remove()
is found in netinet6/nd6_rtr.c.

Several times I looked into ND code and found lots of race prone code there.
May be some was recently fixed by bz@, but definitely not merged to stable/8.

-- 
Totus tuus, Glebius.