[DragonFlyBSD - Bug #3439] (New) Static IPv6 neighbor can panic during interface teardown

[sigttou]

Issue #3439 has been reported by sigttou.

----------------------------------------
Bug #3439: Static IPv6 neighbor can panic during interface teardown
http://bugs.dragonflybsd.org/issues/3439

* Author: sigttou
* Status: New
* Priority: Normal
* Category: Kernel
* Target version: 6.6
* Start date: 2026-10-04
----------------------------------------
On a multi-CPU guest:

<pre><code class="shell">
kldload if_tap
ifconfig tap2 create
ifconfig tap2 up
ifconfig tap2 inet6 2001:db8:12::2/64 alias
ndp -s 2001:db8:12::1234 02:00:00:00:00:63
ifconfig tap2 destroy
</code></pre>

The kernel panics in `nd6_free()` called by `nd6_purge()`.

Routing-socket requests create a route and neighbor entry on each network CPU.
All entries were linked into one list, but neighbor timers and purge run on
CPU 0. Purging a CPU 1 entry deletes the matching CPU 0 route, then follows
its freed list entry. A diagnostic guest trace confirms this sequence.

The patch links only CPU 0 entries into the timer/purge list. Other CPUs keep
their route-local neighbor data. Deletion unlinks an entry only if it is linked.
No manual orphan cleanup or access to a route after deletion is added.


---Files--------------------------------
0004-nd6-keep-foreign-CPU-neighbors-off-the-timer-and-pur.patch (1.66 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account