From owner-freebsd-bugs@FreeBSD.ORG Fri Feb 18 06:30:25 2005 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 29A5516A4D0 for ; Fri, 18 Feb 2005 06:30:25 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id DEE4D43D2F for ; Fri, 18 Feb 2005 06:30:24 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.1/8.13.1) with ESMTP id j1I6UOpK016508 for ; Fri, 18 Feb 2005 06:30:24 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.1/8.13.1/Submit) id j1I6UOxE016504; Fri, 18 Feb 2005 06:30:24 GMT (envelope-from gnats) Resent-Date: Fri, 18 Feb 2005 06:30:24 GMT Resent-Message-Id: <200502180630.j1I6UOxE016504@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Brooks Davis Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5A54316A4CE; Fri, 18 Feb 2005 06:27:19 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4328243D53; Fri, 18 Feb 2005 06:27:19 +0000 (GMT) (envelope-from brooks@FreeBSD.org) Received: from freefall.freebsd.org (brooks@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.1/8.13.1) with ESMTP id j1I6RJ3G016430; Fri, 18 Feb 2005 06:27:19 GMT (envelope-from brooks@freefall.freebsd.org) Received: (from brooks@localhost) by freefall.freebsd.org (8.13.1/8.13.1/Submit) id j1I6RJT1016429; Fri, 18 Feb 2005 06:27:19 GMT (envelope-from brooks) Message-Id: <200502180627.j1I6RJT1016429@freefall.freebsd.org> Date: Fri, 18 Feb 2005 06:27:19 GMT From: Brooks Davis To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 cc: rwatson@FreeBSD.org Subject: kern/77665: multicast sockets + interface removal = panic X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Brooks Davis List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Feb 2005 06:30:25 -0000 >Number: 77665 >Category: kern >Synopsis: multicast sockets + interface removal = panic >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Feb 18 06:30:24 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Brooks Davis >Release: FreeBSD 6.0-CURRENT i386 >Organization: >Environment: System: FreeBSD minya 6.0-CURRENT FreeBSD 6.0-CURRENT #13: Wed Feb 9 14:33:45 EST 2005 brooks@minya:/home/brooks/working/freebsd/p4/cleanup/sys/i386/compile/MINYA i386 >Description: Creating a multicast socket, such as those created by the net/mDNSResponder port, and then removing an interface that is up will cause a panic in if_delmulti(). The stack is roughly: if_delmulti()+0xc in_delmulti()+0x6a ip_freemoptions()+0x21 in_pcpdetach()+0x168 udp_detach()+0x65 soclose()+0x1e0 soo_close()+0x4b fdrop_locked()+0x88 fdrop()+0x24 closef()+0x367 close()+0x1a3 syscall()+0x213 >How-To-Repeat: Configure a removable interface (ath0 in my case), install and run net/mDNSResponder, and eject the card. >Fix: If the interface is down when ejected, the panic does no occure. >Release-Note: >Audit-Trail: >Unformatted: