From owner-freebsd-net@freebsd.org Tue Apr 23 09:53:49 2019 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EF4AE15947EC for ; Tue, 23 Apr 2019 09:53:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 86C5369ACC for ; Tue, 23 Apr 2019 09:53:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.ysv.freebsd.org (Postfix) id 47E8215947EB; Tue, 23 Apr 2019 09:53:48 +0000 (UTC) Delivered-To: net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 359A515947EA for ; Tue, 23 Apr 2019 09:53:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.ysv.freebsd.org (mxrelay.ysv.freebsd.org [IPv6:2001:1900:2254:206a::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.ysv.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id C5D2C69AC8 for ; Tue, 23 Apr 2019 09:53:47 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.ysv.freebsd.org (Postfix) with ESMTPS id 287E2AECF for ; Tue, 23 Apr 2019 09:53:47 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id x3N9rlYt051361 for ; Tue, 23 Apr 2019 09:53:47 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id x3N9rlYI051360 for net@FreeBSD.org; Tue, 23 Apr 2019 09:53:47 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 233955] [panic] Page fault in in6_purgeaddr (triggered by net/wireguard) Date: Tue, 23 Apr 2019 09:53:40 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 11.2-RELEASE X-Bugzilla-Keywords: crash, needs-qa X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: jason@zx2c4.com X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: net@FreeBSD.org X-Bugzilla-Flags: mfc-stable11? mfc-stable12? X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Apr 2019 09:53:49 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D233955 --- Comment #22 from Jason A. Donenfeld --- Alright, I've now spent a bit of time tracking down these race conditions a= nd reproducing them in a VM. It looks like there are two separate kernel race conditions: - SIOCGIFSTATUS races with SIOCIFDESTROY, which was being triggered by the = call to ifconfig(8) in the route monitor script. This should be now fixed by: https://git.zx2c4.com/WireGuard/patch/?id=3D90c546598c0a9d9da82c138c6c9c139= 6c453368e - The asynchronous callback of IPv6 Link Local DAD conflict with both SIOCIFDESTROY and the /dev/tun cloning mechanism, resulting in a wide varie= ty of crashes with dangling pointers on IPv6 address lists. I'm able to trigger this by just running `while true; do ifconfig tun0 create; ifconfig tun0 destroy; done` and after a while, there's one sort of crash. This should no= w be fixed by: https://git.zx2c4.com/wireguard-go/patch/?id=3Dbb42ec7d185ab5f5cd3867ac1258= edff86b7f307 I'd appreciate it if Michael Muenz could test these and make sure it fixes = his own reproducer. After, Bernhard Froehlich can backport those two packages i= nto the ports tree. Finally, THIS BUG SHOULD REMAIN OPEN until the FreeBSD kern= el team actually gets the man power to fix these race conditions; the above on= ly represents a few workarounds but does not address the underlying issue of t= his bug at all. --=20 You are receiving this mail because: You are the assignee for the bug.=