assert "ifa == rt->rt_ifa" failed in nd6.c (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 921301ed7d60 drm/amd/display: Correct MPC split policy for..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15ef3e86700000
kernel config: https://syzkaller.appspot.com/x/.config?x=bf87b6915a88cd0d
dashboard link: https://syzkaller.appspot.com/bug?extid=3671a44f06843ba55d54

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3671a4...@syzkaller.appspotmail.com

panic: kernel diagnostic assertion "ifa == rt->rt_ifa" failed: file "/syzkaller/managers/multicore/kernel/sys/netinet6/nd6.c", line 955
Starting stack trace...
panic(ffffffff82577de7) at panic+0x16b sys/kern/subr_prf.c:233
__assert(ffffffff825eb0b9,ffffffff825dcb87,3bb,ffffffff825891a6) at __assert+0x25 sys/kern/subr_prf.c:161
nd6_rtrequest(ffff800000c2a000,b,fffffd8067ff30f0) at nd6_rtrequest+0x8c3 sys/netinet6/nd6.c:955
rtrequest(b,ffff80002e3934b8,3,ffff80002e393558,0) at rtrequest+0xa1c sys/net/route.c:982
rt_clone(ffff80002e3935c8,ffff80002e3936a0,0) at r
t_clone+0x78
rtalloc_mpath(ffff80002e3936a0,fffffd8072bacac8,0) at rtalloc_mpath+0xbc rt_match sys/net/route.c:244 [inline]
rtalloc_mpath(ffff80002e3936a0,fffffd8072bacac8,0) at rtalloc_mpath+0xbc sys/net/route.c:359
ip6_input_if(ffff80002e393798,ffff80002e3937a4,29,0,ffff800000c2a000) at ip6_input_if+0x7b5 sys/netinet6/ip6_input.c:433
ipv6_input(ffff800000c2a000,fffffd8072baca00) at ipv6_input+0x48 sys/netinet6/ip6_input.c:171
ether_input(ffff800000c2a000,fffffd8072baca00) at ether_input+0x573
tun_dev_write(5d07,ffff80002e393b08,ffff80002c94c000,2) at tun_dev_write+0x203 sys/net/if_tun.c:889
spec_write(ffff80002e393960) at spec_write+0xd4 sys/kern/spec_vnops.c:309
VOP_WRITE(fffffd8064ea81d8,ffff80002e393b08,11,fffffd807f7d8720) at VOP_WRITE+0xbf sys/kern/vfs_vops.c:245
vn_write(fffffd80686aa438,ffff80002e393b08,0) at vn_write+0x157 sys/kern/vfs_vnops.c:414
dofilewritev(ffff800021223268,c8,ffff80002e393b08,0,ffff80002e393c00) at dofilewritev+0x19c sys/kern/sys_generic.c:381
sys_write(ffff800021223268,ffff80002e393ba0,ffff80002e393c00) at sys_write+0x83 sys/kern/sys_generic.c:301
syscall(ffff80002e393c70) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002e393c70) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xff6b25da50, count: 240
End of stack trace.
syncing disks...set $lines = 0
set $maxwidth = 0
show panic
trace
show registers
show proc
ps
show all locks
show malloc
show all pools
machine ddbcpu 0
trace
machine ddbcpu 1
trace


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.