mpd5/Netgraph issues after upgrading to 7.4

[Przemyslaw Frasunek]

I aplogise for reviving this old thread, but after upgrading from 8.3 to
9.2-RELEASE, I started getting the same panics as in 2011, before Glebius'
patches related to Netgraph topology locks.

I've seen that Mike reported similar issues in October
(http://lists.freebsd.org/pipermail/freebsd-stable/2013-October/075552.html).
Did you managed to resolve it?

This is backtrace from PPPoE AC running mpd5 on FreeBSD 9.2 with IPv6 enabled,
with over 300 sessions active. On 8.3 with IPv6 disabled I was able to get
uptimes over 1 year.

(kgdb) bt
#0  doadump (textdump=<value optimized out>) at pcpu.h:234
#1  0xffffffff80593466 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:449
#2  0xffffffff80593967 in panic (fmt=0x1 <Address 0x1 out of bounds>) at
/usr/src/sys/kern/kern_shutdown.c:637
#3  0xffffffff8082ba10 in trap_fatal (frame=0xc, eva=<value optimized out>) at
/usr/src/sys/amd64/amd64/trap.c:879
#4  0xffffffff8082bd71 in trap_pfault (frame=0xffffff8098da9660, usermode=0) at
/usr/src/sys/amd64/amd64/trap.c:795
#5  0xffffffff8082c324 in trap (frame=0xffffff8098da9660) at
/usr/src/sys/amd64/amd64/trap.c:463
#6  0xffffffff80815653 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:232
#7  0xffffffff80670f32 in ng_address_hook (here=0x0, item=0xfffffe0061ccac00,
hook=0xfffffe002fd0cc00, retaddr=0)
    at /usr/src/sys/netgraph/ng_base.c:3583
#8  0xffffffff8067a2ea in ng_ppp_link_xmit (node=<value optimized out>,
item=0xfffffe0061ccac00, proto=49185,
    linkNum=<value optimized out>, plen=0) at /usr/src/sys/netgraph/ng_ppp.c:1348
#9  0xffffffff80672498 in ng_apply_item (node=0xfffffe000c784700,
item=0xfffffe0061ccac00, rw=0)
    at /usr/src/sys/netgraph/ng_base.c:2397
#10 0xffffffff806715f4 in ng_snd_item (item=<value optimized out>, flags=2) at
/usr/src/sys/netgraph/ng_base.c:2314
#11 0xffffffff8067f990 in ngd_send (so=<value optimized out>, flags=<value
optimized out>, m=0xfffffe005cc4d500,
    addr=<value optimized out>, control=<value optimized out>, td=<value
optimized out>)
    at /usr/src/sys/netgraph/ng_socket.c:441
#12 0xffffffff80603ea6 in sosend_generic (so=0xfffffe0001d8a000,
addr=0xfffffe0055266460, uio=0xffffff8098da9a00,
    top=0xfffffe005cc4d500, control=0x0, flags=<value optimized out>,
td=0xfffffe0001baa000)
    at /usr/src/sys/kern/uipc_socket.c:1367
#13 0xffffffff80607783 in kern_sendit (td=0xfffffe0001baa000, s=6,
mp=0xffffff8098da9ad0, flags=0, control=0x0,
    segflg=<value optimized out>) at /usr/src/sys/kern/uipc_syscalls.c:811
#14 0xffffffff80607a3c in sendit (td=0xfffffe0001baa000, s=6,
mp=0xffffff8098da9ad0, flags=0)
    at /usr/src/sys/kern/uipc_syscalls.c:739
#15 0xffffffff80607b2d in sys_sendto (td=<value optimized out>, uap=<value
optimized out>)
    at /usr/src/sys/kern/uipc_syscalls.c:863
#16 0xffffffff8082b1ba in amd64_syscall (td=0xfffffe0001baa000, traced=0) at
subr_syscall.c:135
#17 0xffffffff80815937 in Xfast_syscall () at
/usr/src/sys/amd64/amd64/exception.S:391
#18 0x000000080225adcc in ?? ()

(kgdb) frame 7
#7  0xffffffff80670f32 in ng_address_hook (here=0x0, item=0xfffffe0061ccac00,
hook=0xfffffe002fd0cc00, retaddr=0)
    at /usr/src/sys/netgraph/ng_base.c:3583
3583            if ((hook == NULL) || NG_HOOK_NOT_VALID(hook) ||
Current language:  auto; currently c

(kgdb) print *hook
$1 = {hk_name = "\b\000\000\000
\000\000\000\004\000\000\000\001\000\000\000\237\a~\000\003�\0248cmd4\000\000\000",
  hk_private = 0x0, hk_flags = 0, hk_type = 0, hk_peer = 0x0, hk_node =
0x353e38bf000feeae, hk_hooks = {
    le_next = 0x74bb3a9000dc7f3, le_prev = 0x0}, hk_rcvmsg = 0, hk_rcvdata = 0,
hk_refs = 0}

(kgdb) print *hook->hk_hooks->le_next
Cannot access memory at address 0x74bb3a9000dc7f3