Bug 215372 - "ndp -P"/SIOCSPFXFLUSH_IN6 ioctl hits KASSERT in nd6_prefix_unlink()
Summary: "ndp -P"/SIOCSPFXFLUSH_IN6 ioctl hits KASSERT in nd6_prefix_unlink()
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Mark Johnston
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-18 09:51 UTC by Jan Kokemüller
Modified: 2016-12-19 19:22 UTC (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jan Kokemüller 2016-12-18 09:51:44 UTC 
When I run "ndp -P" on CURRENT r309302 with assertions on, the KASSERT in nd6_prefix_unlink() is hit:

     KASSERT(pr->ndpr_addrcnt == 0, ("prefix %p has referencing addresses", pr));

I guess the changes in base r306829 are responsible.
Comment 1 commit-hook freebsd_committer freebsd_triage 2016-12-19 19:21:36 UTC 
A commit references this bug:

Author: markj
Date: Mon Dec 19 19:21:28 UTC 2016
New revision: 310286
URL: https://svnweb.freebsd.org/changeset/base/310286

Log:
  Remove a bogus KASSERT from nd6_prefix_unlink().

  The caller may unlink a prefix before purging referencing addresses. An
  identical assertion in nd6_prefix_del() verifies that the addresses are
  purged before the prefix is freed.

  PR:		215372
  X-MFC With:	r306829

Changes:
  head/sys/netinet6/nd6_rtr.c
Comment 2 Mark Johnston freebsd_committer freebsd_triage 2016-12-19 19:22:29 UTC 
Thanks for the report.