From citylink.dinoex.sub.de!admin%dyn@citylink.dinoex.sub.org  Mon Jan 15 17:01:32 2001
Return-Path: <citylink.dinoex.sub.de!admin%dyn@citylink.dinoex.sub.org>
Received: from net2.dinoex.sub.org (net2.dinoex.de [212.184.201.182])
	by hub.freebsd.org (Postfix) with ESMTP id 2739537B6C4
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 15 Jan 2001 17:01:31 -0800 (PST)
Received: from citylink.dinoex.sub.org (uucp@localhost)
	by net2.dinoex.sub.org (8.11.2/8.11.2) with UUCP id f0G11E106717
	for freebsd.org!FreeBSD-gnats-submit; Tue, 16 Jan 2001 02:01:14 +0100 (CET)
	(envelope-from citylink.dinoex.sub.de!admin%dyn@citylink.dinoex.sub.org)
Received: from dyn.oper.dinoex.org  by citylink.dinoex.sub.org (8.8.5/PMuch-B3b) with ESMTP
	id BAA22853 for <FreeBSD-gnats-submit@freebsd.org>; Tue, 16 Jan 2001 01:51:03 +0100 (CET)
Received: (from admin@localhost)
	by dyn.oper.dinoex.org (8.11.1/8.11.1) id f0G0ou735410;
	Tue, 16 Jan 2001 01:50:56 +0100 (CET)
	(envelope-from admin)
Message-Id: <200101160050.f0G0ou735410@dyn.oper.dinoex.org>
Date: Tue, 16 Jan 2001 01:50:56 +0100 (CET)
From: System Admin Account <admin%dyn@citylink.dinoex.sub.de>
Reply-To: peter.much@sercon.de
To: FreeBSD-gnats-submit@freebsd.org
Subject: ifconfig inet6 delete -> kernelpanic
X-Send-Pr-Version: 3.2

>Number:         24365
>Category:       kern
>Synopsis:       delete alias from ipv6 p-t-p iface will crash kernel
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jan 15 17:10:00 PST 2001
>Closed-Date:    Wed Dec 19 17:34:24 PST 2001
>Last-Modified:  Wed Dec 19 17:35:12 PST 2001
>Originator:     System Admin Account
>Release:        FreeBSD 4.2-RELEASE i386
>Organization:
>Environment:

	kernel built with INET6 

>Description:

	this works with loopback and p-t-p ifaces.
	
	$ ifconfig lo0
	lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5 
	        inet6 ::1 prefixlen 128 
        	inet 127.0.0.1 netmask 0xff000000 

	$ ifconfig lo0 inet6 delete ::1  
		-> this works as one would expect

	$ ifconfig lo0 inet6 delete fe80::1%lo0
		-> but this one panics!

	Functions called:
		rtalloc1	from
		rtinit		"
		in6_ifscrub	"
		in6_purgeaddr	"
		in6_control	"
		ifioctl

>How-To-Repeat:

	not applicable, see piece-of-code below for the failure-reason.

>Fix:

	Thats what I have done, and what made it work here. As I have
	configured IPv6 just out of curiousity and have no real usage
	yet for it, I cannot say about side-effects, possibly with a 
	routing daemon or such.
	The code obviousely considers _every_ immanent route on a loopback
	or p-t-p iface as a _host_route (and afaik this is true for
	classic IP), but the fe80::1%lo0 is some kind of cloneable route:

	$ netstat -r
	Destination        Gateway            Flags      Netif Expire
	fe80::%lo0         fe80::1%lo0        Uc          lo0

*** sys/netinet6/in6.c.orig	Sat Jul 15 09:14:33 2000
--- sys/netinet6/in6.c	Sun Jan 14 04:03:37 2001
***************
*** 1219,1227 ****
  {
  	if ((ia->ia_flags & IFA_ROUTE) == 0)
  		return;
! 	if (ifp->if_flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
  		rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST);
! 	else
  		rtinit(&(ia->ia_ifa), (int)RTM_DELETE, 0);
  	ia->ia_flags &= ~IFA_ROUTE;
  
--- 1219,1227 ----
  {
  	if ((ia->ia_flags & IFA_ROUTE) == 0)
  		return;
! /*	if (ifp->if_flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
  		rtinit(&(ia->ia_ifa), (int)RTM_DELETE, RTF_HOST);
! 	else */
  		rtinit(&(ia->ia_ifa), (int)RTM_DELETE, 0);
  	ia->ia_flags &= ~IFA_ROUTE;
  


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: iedowse 
State-Changed-When: Sun Nov 18 12:07:08 PST 2001 
State-Changed-Why:  

Does this problem still exist? 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=24365 
State-Changed-From-To: feedback->closed 
State-Changed-By: iedowse 
State-Changed-When: Wed Dec 19 17:34:24 PST 2001 
State-Changed-Why:  

Submitter says that this problem no longer occurs in 4.4-RELEASE. 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=24365 
>Unformatted:
