Date: Tue, 23 Apr 2019 09:53:40 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 233955] [panic] Page fault in in6_purgeaddr (triggered by net/wireguard) Message-ID: <bug-233955-7501-4LM28LBwZd@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-233955-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-233955-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D233955 --- Comment #22 from Jason A. Donenfeld <jason@zx2c4.com> --- Alright, I've now spent a bit of time tracking down these race conditions a= nd reproducing them in a VM. It looks like there are two separate kernel race conditions: - SIOCGIFSTATUS races with SIOCIFDESTROY, which was being triggered by the = call to ifconfig(8) in the route monitor script. This should be now fixed by: https://git.zx2c4.com/WireGuard/patch/?id=3D90c546598c0a9d9da82c138c6c9c139= 6c453368e - The asynchronous callback of IPv6 Link Local DAD conflict with both SIOCIFDESTROY and the /dev/tun cloning mechanism, resulting in a wide varie= ty of crashes with dangling pointers on IPv6 address lists. I'm able to trigger this by just running `while true; do ifconfig tun0 create; ifconfig tun0 destroy; done` and after a while, there's one sort of crash. This should no= w be fixed by: https://git.zx2c4.com/wireguard-go/patch/?id=3Dbb42ec7d185ab5f5cd3867ac1258= edff86b7f307 I'd appreciate it if Michael Muenz could test these and make sure it fixes = his own reproducer. After, Bernhard Froehlich can backport those two packages i= nto the ports tree. Finally, THIS BUG SHOULD REMAIN OPEN until the FreeBSD kern= el team actually gets the man power to fix these race conditions; the above on= ly represents a few workarounds but does not address the underlying issue of t= his bug at all. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-233955-7501-4LM28LBwZd>