3.3-rc snmp6 panic

[Dave Jones <davej@redhat.com>]

I've been seeing an occasional panic when I shut down my router
since I put 3.3 on there. It happens about once a week, always during
shutdown.  It wedges before I can get a good capture of the trace.
This is the best I've captured so far.. https://twitpic.com/8wh5l5
(apologies in advance for blurriness)

>From comparing the Code: line, and the objdump output, the code it's
choking on in mld_sendpack seems to be a skb_dst macro in the NF_HOOK..


        err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
    2dd9:       4c 8b 43 20             mov    0x20(%rbx),%r8
    2ddd:       e9 00 00 00 00          jmpq   2de2 <mld_sendpack+0x1b2>
static inline struct dst_entry *skb_dst(const struct sk_buff *skb)
{
        /* If refdst was not refcounted, check we still are in a 
         * rcu_read_lock section
         */
        WARN_ON((skb->_skb_refdst & SKB_DST_NOREF) &&
    2de2:       48 8b 43 58             mov    0x58(%rbx),%rax
    2de6:       a8 01                   test   $0x1,%al
    2de8:       0f 85 d2 01 00 00       jne    2fc0 <mld_sendpack+0x390>
                !rcu_read_lock_held() &&
                !rcu_read_lock_bh_held());
        return (struct dst_entry *)(skb->_skb_refdst & SKB_DST_PTRMASK);
    2dee:       48 83 e0 fe             and    $0xfffffffffffffffe,%rax
    2df2:       48 89 df                mov    %rbx,%rdi
    2df5:       ff 50 58                callq  *0x58(%rax)           <-----  BOOM


This machine is running an snmpd, for my mrtg setup, so the teardown of that
service is probably what's triggering it. But I can start/stop it in a loop
as much as I want without it happening, so maybe the kernel needs to accumulate
some state from it for a while first ?

Anyone have any ideas what's happening here ?

	Dave