From owner-freebsd-current@FreeBSD.ORG  Wed Jun  6 14:49:19 2007
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: current@FreeBSD.org
Delivered-To: freebsd-current@FreeBSD.ORG
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 35A9416A421
	for <current@FreeBSD.org>; Wed,  6 Jun 2007 14:49:19 +0000 (UTC)
	(envelope-from glebius@FreeBSD.org)
Received: from cell.glebius.int.ru (glebius.int.ru [81.19.64.130])
	by mx1.freebsd.org (Postfix) with ESMTP id AD0AA13C447
	for <current@FreeBSD.org>; Wed,  6 Jun 2007 14:49:18 +0000 (UTC)
	(envelope-from glebius@FreeBSD.org)
Received: from cell.glebius.int.ru (localhost [127.0.0.1])
	by cell.glebius.int.ru (8.14.1/8.14.1) with ESMTP id l56EnHv5073033;
	Wed, 6 Jun 2007 18:49:17 +0400 (MSD)
	(envelope-from glebius@FreeBSD.org)
Received: (from glebius@localhost)
	by cell.glebius.int.ru (8.14.1/8.14.1/Submit) id l56EnHuX073032;
	Wed, 6 Jun 2007 18:49:17 +0400 (MSD)
	(envelope-from glebius@FreeBSD.org)
X-Authentication-Warning: cell.glebius.int.ru: glebius set sender to
	glebius@FreeBSD.org using -f
Date: Wed, 6 Jun 2007 18:49:17 +0400
From: Gleb Smirnoff <glebius@FreeBSD.org>
To: Ed Schouten <ed@fxq.nl>
Message-ID: <20070606144917.GL89017@glebius.int.ru>
References: <465BE214.8040502@monkeybrains.net>
	<20070530105120.GT89017@FreeBSD.org>
	<20070603144732.GA45756@hoeg.nl> <20070606143528.GB89502@hoeg.nl>
MIME-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <20070606143528.GB89502@hoeg.nl>
User-Agent: Mutt/1.5.15 (2007-04-06)
Cc: current@FreeBSD.org
Subject: Re: ifconfig carp0 destroy = kernel panic
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 06 Jun 2007 14:49:19 -0000

On Wed, Jun 06, 2007 at 04:35:28PM +0200, Ed Schouten wrote:
E> * Ed Schouten <ed@fxq.nl> wrote:
E> > Please take a look at this patch as well. It has been lying around in
E> > GNATS for some time and it really makes me go insane a lot of times:
E> > 
E> > [...]
E> 
E> Looks like it just got committed. Thanks a lot! :)

Btw, the problems do not end at this. On HEAD (didn't check RELENG_6), the
following sequence panics:

ifconfig em0 10.0.0.2/24
ifconfig carp0 create
ifconfig carp0 10.0.0.3/24 vhid 1
ifconfig carp1 create
ifconfig carp1 10.0.0.4/24 vhid 1

(ifconfig returns EINVAL. This EINVAL comes via
in_control()->in_ifinit()->carp_ioctl()->carp_setrun(). Really it should
be EEXIST. I will change this later.)

After this the last ifconfig command we have somewhat garbaged IP stack -
the interface address lists and ia_hash reference a freed memory. The
panic comes after an ARP request or if you repeat the command again:

ifconfig carp1 10.0.0.4/24 vhid 1

I am now trying to understand the panic.

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE