From: Theo de Raadt <deraadt@cvs.openbsd.org>
Subject: Re: Bug Reported by me today Create, Bridge, change bridge timeout and then destroy bridge kernel panic
To: tech@openbsd.org, tom.smyth@wirelessconnect.eu
Date: Tue, 3 Nov 2026 15:48:17 -0600

Sorry this is a poor effort.

1. does not explain the problem.
2. does not try to interpret the problem
3. AI tells me this is the solution
4. Patch indents are broken.
 
>Folks I tested the following patch ( with assistance  from ai)
>and it stopped the panic on AMD64 on 8.0  on 5 separate runs
>
>Index: sys/net/if_bridge.c
>--- sys/net/if_bridge.c.orig
>+++ sys/net/if_bridge.c
>@@ -231,6 +231,7 @@
>  NET_ASSERT_UNLOCKED();
>
>  bridge_stop(sc);
>+ timeout_del_barrier(&sc->sc_brtimeout);
>  bridge_rtflush(sc, IFBF_FLUSHALL);
>  while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_iflist)) != NULL)
>  bridge_ifremove(bif);
>Index: sys/net/bridgectl.c
>--- sys/net/bridgectl.c.orig
>+++ sys/net/bridgectl.c
>@@ -113,9 +113,11 @@
>  break;
>  }
>  sc->sc_brttimeout = bparam->ifbrp_ctime;
>- if (bparam->ifbrp_ctime != 0)
>- timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
>- else
>+ if (bparam->ifbrp_ctime != 0) {
>+ if (ISSET(ifp->if_flags, IFF_RUNNING))
>+ timeout_add_sec(&sc->sc_brtimeout,
>+    sc->sc_brttimeout);
>+ } else
>  timeout_del(&sc->sc_brtimeout);
>  break;
>  case SIOCBRDGGTO:
>
>