assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (3)

Status: upstream: reported on 2024/04/19 03:54
First crash: 65d, last: 25d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c 1 1574d 1574d 3/3 fixed on 2020/04/22 21:18
openbsd assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (2) 1 1519d 1519d 0/3 auto-closed as invalid on 2020/07/25 17:46

Sample crash report:
panic: kernel diagnostic assertion "!ISSET(rt->rt_flags, RTF_LOCAL)" failed: file "/syzkaller/managers/main/kernel/sys/netinet6/nd6.c", line 685
Starting stack trace...
panic(ffffffff82934da0) at panic+0x159 sys/kern/subr_prf.c:229

__assert(ffffffff828e8ca5,ffffffff828b0567,2ad,ffffffff828ac70a) at __assert+0x29 sys/kern/subr_prf.c:157
nd6_free(fffffd806d0f0470) at nd6_free+0x1f4 sys/netinet6/nd6.c:685
nd6_purge(ffff800000ddb800) at nd6_purge+0xf6 sys/netinet6/nd6.c:486
in6_ifdetach(ffff800000ddb800) at in6_ifdetach+0xa8 sys/netinet6/in6_ifattach.c:437
if_detach(ffff800000ddb800) at if_detach+0x237 sys/net/if.c:1220
tun_clone_destroy(ffff800000ddb800) at tun_clone_destroy+0x1ce sys/net/if_tun.c:339
if_clone_destroy(ffff80002f512e70) at if_clone_destroy+0x132 sys/net/if.c:1384
tun_dev_close(5d03,7) at tun_dev_close+0x141 sys/net/if_tun.c:521
spec_close(ffff80002f512f40) at spec_close+0x2d4 sys/kern/spec_vnops.c:538
VOP_CLOSE(fffffd8078ed9bd0,7,fffffd807f7d7618,ffff80002a6d7c50) at VOP_CLOSE+0xe2 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806cede270,ffff80002a6d7c50) at vn_closefile+0xd5 vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806cede270,ffff80002a6d7c50) at vn_closefile+0xd5 sys/kern/vfs_vnops.c:609
fdrop(fffffd806cede270,ffff80002a6d7c50) at fdrop+0xd5 sys/kern/kern_descrip.c:1274
closef(fffffd806cede270,ffff80002a6d7c50) at closef+0x11b sys/kern/kern_descrip.c:1258
fdfree(ffff80002a6d7c50) at fdfree+0xe3 sys/kern/kern_descrip.c:1190
exit1(ffff80002a6d7c50,0,19,1) at exit1+0x3b7 sys/kern/kern_exit.c:209
sigexit(ffff80002a6d7c50,19) at sigexit+0xcd sys/kern/kern_sig.c:1617
postsig(ffff80002a6d7c50,19,ffff80002f513318) at postsig+0x554 sys/kern/kern_sig.c:1544
userret(ffff80002a6d7c50) at userret+0x14e sys/kern/kern_sig.c:2040
syscall(ffff80002f513450) at syscall+0x7e8 mi_syscall_return sys/sys/syscall_mi.h:207 [inline]
syscall(ffff80002f513450) at syscall+0x7e8 sys/arch/amd64/amd64/trap.c:598
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7531f7bd6840, count: 236
End of stack trace.
syncing disks...set $lines = 0
set $maxwidth = 0
show panic
show registers
show proc
show all locks
show malloc
show all pools
machine ddbcpu 0
machine ddbcpu 1

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/29 09:23 openbsd f475ad27b09c 34889ee3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c
2024/05/18 09:03 openbsd 1b2581db680c c0f1611a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c
2024/04/19 03:53 openbsd 3ed32226cff5 af24b050 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c
* Struck through repros no longer work on HEAD.