From owner-freebsd-net@FreeBSD.ORG  Tue Feb  4 03:33:22 2014
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id B22049FC
 for <freebsd-net@freebsd.org>; Tue,  4 Feb 2014 03:33:22 +0000 (UTC)
Received: from mail-ob0-x236.google.com (mail-ob0-x236.google.com
 [IPv6:2607:f8b0:4003:c01::236])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 7C5011B2C
 for <freebsd-net@freebsd.org>; Tue,  4 Feb 2014 03:33:22 +0000 (UTC)
Received: by mail-ob0-f182.google.com with SMTP id wm4so9012586obc.27
 for <freebsd-net@freebsd.org>; Mon, 03 Feb 2014 19:33:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:date:message-id:subject:from:to:content-type;
 bh=gBjTlnodYWZ94Q5Z58ILEzjUMAjPVXn3zcX+C/QBjeg=;
 b=ZHgWSb/K0y1rrMktdS39S7nLM3MNMqGjfPewXUL3zp4f6DkosGL/IYkV+pqf1jU1Bk
 zaNyJdRJwatkexqmtwhJEMf+knZvsNWHOGbpVrvhTSfAGlS6Jc0YcnKWUsBdgt/YdK0F
 lgyM6365cf9S5pAqit0kcg4rAdKLtjYfm4M7KJoRD+C3sBX06mxudmoTqxieZY4cISjy
 XN9fBObAnJabUY1Uagm0gqdfsMSpqjhWPHdR5jNlYGyln7FcgI3ubzmZf+FeHK0Se0Bs
 7U2ecahWxA7NlfI/IwqBobeADhz4dxBtoPf4FjNYU58xP7xalNVrsSVdz4BUXOF7eSjp
 iAfg==
MIME-Version: 1.0
X-Received: by 10.60.16.168 with SMTP id h8mr33620733oed.32.1391484801787;
 Mon, 03 Feb 2014 19:33:21 -0800 (PST)
Received: by 10.182.74.4 with HTTP; Mon, 3 Feb 2014 19:33:21 -0800 (PST)
Date: Mon, 3 Feb 2014 19:33:21 -0800
Message-ID: <CALCNsJQSfqyXUuiGUPwmuXH3OCdmMRVSZtZSDQEBTb9csQAe4Q@mail.gmail.com>
Subject: vnet deletion panic
From: Vijay Singh <vijju.singh@gmail.com>
To: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1
X-Content-Filtered-By: Mailman/MimeDel 2.1.17
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Feb 2014 03:33:22 -0000

I'm running into a crash due on vnet deletion in the presence of routing
sockets. The root cause seems to originate from():

if_detach_internal() -> if_down(ifp) -> if_unroute() -> rt_ifmsg() ->
rt_dispatch()

In rt_dispatch() we have:

#ifdef VIMAGE
        if (V_loif)
                m->m_pkthdr.rcvif = V_loif;
#endif
netisr_queue(NETISR_ROUTE, m);

Now since this would be processed async, and the ifp alove is the loopback
of the vnet being deleted, we run into accessing a freed pointer (ifp) when
netisr picks up the mbuf. So I am wondering how to fix this. I am thinking
that we could do something like the following in rt_dispatch():

#ifdef VIMAGE
        if (V_loif) {
            if ((ifp == V_loif) && !IS_DEFAULT_VNET(curvnet)) {
               CURVNET_SET_QUIET(vnet0);
               m->m_pkthdr.rcvif = V_loif;
              CURVNET_RESTORE();
            } else
                m->m_pkthdr.rcvif = V_loif;
        }
#endif

So basically switch to the default vnet for the mbuf with the routing
socket message. Thoughts?

-vijay