ne(4) mismatched psref target class

[Frank Wille]

Hi!

I am trying to fix a kernel panic with the NE2000-based ne(4) network device
on port-amiga for 8.0. It occurs as soon as ifconfig(8) is used.

panic: kernel diagnostic assertion "(target->prt_class == class)" failed:
file /home/frank/netbsd/8/src/sys/kern/subr_psref.c", line 239 mismatched
psref target class: 0x0 (ref) != 0x6d502b0 (expected)

The backtrace:
- kern_assert
- psref_acquire
- ifa_acquire
- sysctl_iflist
- sysctl_rtable
- sysctl_dispatch
- sys___sysctl
- syscall_plain
- syscall(ca)

The problem disappears when I remove the ne(4) device from the kernel. Users
told me that there is no such problem with other network devices (e.g. the
PCMCIA-based ne(4)).

It looks like the prt_class was not correctly set up for ne(4)? But I don't
know why and where this should happen. Neither the MD
sys/arch/amiga/dev/if_ne_xsurf.c nor any of the MI sys/dev/ic/ne2000* files
changed over the last four years, and a 7.99.29 kernel didn't crash. So I'm
quite confused what has changed to break it.

Any hints?

[Taylor R Campbell]

Date: Thu, 31 Aug 2017 12:40:53 +0200
file /home/frank/netbsd/8/src/sys/kern/subr_psref.c", line 239 mismatched
psref target class: 0x0 (ref) != 0x6d502b0 (expected)
[...]
Any hints?

This looks like something tried to use a psref target -- i.e., an
object that you can acquire psref to, in this case a struct ifaddr
object -- after it was destroyed with psref_target_destroy, or
possibly before it was initialized with psref_target_init.

I don't know what to make of the peculiar circumstances in which it is
triggered, though. I have no idea how ne(4) or anything else on the
network stack's ifaddr maintenance on amiga might be different from
ne(4) at pcmcia on another architecture.

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Frank Wille]

Post by Taylor R Campbell
This looks like something tried to use a psref target -- i.e., an
object that you can acquire psref to, in this case a struct ifaddr
object -- after it was destroyed with psref_target_destroy, or
possibly before it was initialized with psref_target_init.

After some more debugging it looks like there is no problem with psref at
all. psref_acquire() panics, because ne0's ifaddr was trashed. Not only the
ifa_psref part, but the whole structure. :|

Will find out where that happens...