Date: Mon, 14 Aug 2006 19:46:59 +0200 From: Max Laier <max@love2party.net> To: freebsd-pf@freebsd.org Subject: Re: CARP panics on RELENG_6 when destroying a CARP interface Message-ID: <200608141947.06724.max@love2party.net> In-Reply-To: <d5992baf0608140939u5cd4ca8docd7730132095f7fb@mail.gmail.com> References: <d5992baf0608140939u5cd4ca8docd7730132095f7fb@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1904646.CP09JMkUbh
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Monday 14 August 2006 18:39, Scott Ullrich wrote:
> I am testing out CARP on RELENG_6 as of yesterday and I am seeing a
> panic when attempting to destory a CARP interface:
>
> # ifconfig carp0 delete
> # ifconfig carp0 destroy
> # panic: thread 100049(ifconfig):0 holds carp_if but isn't blocked on a
> lock
>
> KDB: enter: panic
> [thread pid 12 tid 100004 ]
> Stopped at kdb_enter+0x2b: nop
> db> bt
> Tracing pid 12 tid 100004 td 0xc14d6900
> kdb_enter(c08690a0) at kdb_enter+0x2b
> panic(c086c2f3,186d6,c1630bc4,0,c0876fc4) at panic+0xbb
> propagate_priority(c14d6900,c0948fd0,c15a7e90,c14d6900,c1575000) at
> propagate_pr iority+0x137
> turnstile_wait(c15a7e90,c1632000,c15a7e90,2,c0868048,225) at
> turnstile_wait+0x2f 0
> _mtx_lock_sleep(c15a7e90,c14d6900,0,c0876cbe,283) at
> _mtx_lock_sleep+0x102 _mtx_lock_flags(c15a7e90,0,c0876cbe,283,0) at
> _mtx_lock_flags+0x72
> carp_input_c(c15e8500,c15e8544,2,c15e8544,c172100e) at
> carp_input_c+0x30 carp_input(c16eb700,14,c15fa940,0,0) at
> carp_input+0x216
> ip_input(c16eb700) at ip_input+0x7ad
Looks like a race between the check in ip_carp.c:502
m->m_pkthdr.rcvif->if_carp =3D=3D NULL
and the actual use of that interface pointer. I'm afraid we need some=20
form of synchronization for access to ifnet.if_carp From a quick glance=20
we could either use IFADDR_LOCK() or the global IFNET_{W,R}LOCK I will=20
look at producing a patch later tonight.
> netisr_processqueue(c094a958) at netisr_processqueue+0x6e
> swi_net(0) at swi_net+0xc6
> ithread_execute_handlers(c14d5830,c14d3580) at
> ithread_execute_handlers+0xe6
> ithread_loop(c14bd760,c796cd38,c14bd760,c05f76a8,0) at
> ithread_loop+0x66 fork_exit(c05f76a8,c14bd760,c796cd38) at
> fork_exit+0xa0
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0x1, eip =3D 0, esp =3D 0xc796cd6c, ebp =3D 0 ---
> db>
>
> Please let me know if I can supply more information.
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart1904646.CP09JMkUbh
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (FreeBSD)
iD8DBQBE4LcaXyyEoT62BG0RAhR5AJ9ba1t2RJnBCIleuz/zJJ7EhPqTRwCfZlIO
zNsLiKMzIpNSpjz7L7DrBOg=
=HE7c
-----END PGP SIGNATURE-----
--nextPart1904646.CP09JMkUbh--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200608141947.06724.max>