On 20/04/20(Mon) 15:44, Anton Lindqvist wrote:
> > Index: netinet6/nd6.c
> > ===================================================================
> > RCS file: /cvs/src/sys/netinet6/nd6.c,v
> > retrieving revision 1.229
> > diff -u -p -r1.229 nd6.c
> > --- netinet6/nd6.c 29 Nov 2019 16:41:01 -0000 1.229
> > +++ netinet6/nd6.c 20 Apr 2020 10:07:15 -0000
> > @@ -306,6 +306,7 @@ nd6_llinfo_settimer(struct llinfo_nd6 *l
> > time_t expire = time_uptime + secs;
> >
> > NET_ASSERT_LOCKED();
> > + KASSERT(!ISSET(ln->ln_rt->rt_flags, RTF_LOCAL));
> >
> > ln->ln_rt->rt_expire = expire;
> > if (!timeout_pending(&nd6_timer_to) || expire < nd6_timer_next) {
> >
>
> Also found by syzkaller.
>
> https://syzkaller.appspot.com/bug?extid=0eb994ff432ae75e3369
Maybe, maybe not. Since the KASSERT() is in a timer we cannot be sure
the entry has been inserted in the global list by the same code path.
So it's hard to say if this is the same bug.
