Date: Tue, 14 May 2019 11:09:47 -0500 From: Kyle Evans <kevans@freebsd.org> To: Mark Johnston <markj@freebsd.org> Cc: FreeBSD Current <freebsd-current@freebsd.org> Subject: Re: panic in tunstart_l2() Message-ID: <CACNAnaFntAXzXJE3wbMaLUBs31U5KSs-Lfp0%2B7MhZ4Dh5s9gcA@mail.gmail.com> In-Reply-To: <CACNAnaENuLZXG34UPq9nWx%2BbmA3ZGTtLmOj=SmwuVNXZ1iWjrQ@mail.gmail.com> References: <20190514151002.GE51157@raichu> <CACNAnaENuLZXG34UPq9nWx%2BbmA3ZGTtLmOj=SmwuVNXZ1iWjrQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, May 14, 2019 at 10:34 AM Kyle Evans <kevans@freebsd.org> wrote: > > On Tue, May 14, 2019 at 10:10 AM Mark Johnston <markj@freebsd.org> wrote: > > > > Hi, > > > > I hit the following panic last night on a non-INVARIANTS kernel at > > r347549. The workload involves running a number of bhyve VMs with > > frequent restarts, during which a tap interface is destroyed and > > recreated. I'm a bit short on time to debug this today, so while I > > retry with INVARIANTS on I thought I'd also report the issue in case > > anyone else is seeing it. > > > > The panic occurred because the ifnet's softc field is NULL. > > Ah, foo. I'll have to re-examine the ioctl/destroy race... tun_destroy > grabs the ioctl sx and kills off the if_softc, but it can not and > should not do this before if_detach or else things go wrong because > it's still a part of the bridge. I'm considering this patch [0] to move destroying the if_softc until after we've detached. We've already closed the tunnel, dropped all of our routes/addresses, and detach has freed us of our bridge responsibilities. It seems that we could still have a reference to the ifp in the ioctl path if something's entered just prior to detach, so we kill off the if_softc prior to freeing and the rest is safe. [0] https://people.freebsd.org/~kevans/tuntap-bridge.diff
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CACNAnaFntAXzXJE3wbMaLUBs31U5KSs-Lfp0%2B7MhZ4Dh5s9gcA>