From owner-freebsd-bugs@FreeBSD.ORG Wed Jul 6 13:10:02 2011 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 29BB2106564A for ; Wed, 6 Jul 2011 13:10:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 059D68FC0C for ; Wed, 6 Jul 2011 13:10:02 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p66DA13g076375 for ; Wed, 6 Jul 2011 13:10:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p66DA1me076374; Wed, 6 Jul 2011 13:10:01 GMT (envelope-from gnats) Resent-Date: Wed, 6 Jul 2011 13:10:01 GMT Resent-Message-Id: <201107061310.p66DA1me076374@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, "Daan Vreeken [PA4DAN]" Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DC5F91065670 for ; Wed, 6 Jul 2011 13:02:20 +0000 (UTC) (envelope-from pa4dan@Bliksem.VEHosting.nl) Received: from Bliksem.VEHosting.nl (Bliksem6.VEHosting.nl [IPv6:2001:1af8:2100:b020::141]) by mx1.freebsd.org (Postfix) with ESMTP id 786B78FC1A for ; Wed, 6 Jul 2011 13:02:20 +0000 (UTC) Received: from vitsch.nl (localhost [127.0.0.1]) by Bliksem.VEHosting.nl (8.13.8/8.13.8) with SMTP id p66D2H5B039150; Wed, 6 Jul 2011 15:02:18 +0200 (CEST) (envelope-from pa4dan@Bliksem.VEHosting.nl) Received: (from pa4dan@localhost) by Bliksem.VEHosting.nl (8.13.8/8.13.8/Submit) id p66D15Y5039119; Wed, 6 Jul 2011 15:01:05 +0200 (CEST) (envelope-from pa4dan) Message-Id: <201107061301.p66D15Y5039119@Bliksem.VEHosting.nl> Date: Wed, 6 Jul 2011 15:01:05 +0200 (CEST) From: "Daan Vreeken [PA4DAN]" To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/158686: [PATCH] [if_tap] Add VIMAGE support to if_tap X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: "Daan Vreeken \[PA4DAN\]" List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jul 2011 13:10:02 -0000 >Number: 158686 >Category: kern >Synopsis: [PATCH] [if_tap] Add VIMAGE support to if_tap >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jul 06 13:10:01 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Daan Vreeken [PA4DAN] >Release: FreeBSD 9.0-CURRENT amd64 >Organization: Vitsch Electronics - http://Vitsch.nl/ >Environment: System: FreeBSD RacebeestV3.VEHosting.LAN 9.0-CURRENT FreeBSD 9.0-CURRENT #9 r219581M: Mon Jul 4 22:10:19 CEST 2011 root@RacebeestV3.VEHosting.LAN:/usr/obj/mnt/2/sys/Multimedia amd64 >Description: When using a kernel with 'options VIMAGE', using (and closing) a /dev/tap* device will crash the kernel. >How-To-Repeat: o Create a kernel with 'options VIMAGE' and 'device tap' o Start an application that uses /dev/tap* device(s) o Stop the application and see the crash >Fix: The following patch is based on similar changes that were made to if_tun.c and prevents the panic : Index: sys/net/if_tap.c =================================================================== --- sys/net/if_tap.c (revision 222928) +++ sys/net/if_tap.c (working copy) @@ -42,6 +42,7 @@ #include #include #include +#include #include #include #include @@ -64,8 +65,9 @@ #include #include #include +#include #include -#include +#include #include @@ -214,6 +216,7 @@ KASSERT(!(tp->tap_flags & TAP_OPEN), ("%s flags is out of sync", ifp->if_xname)); + CURVNET_SET(ifp->if_vnet); knlist_destroy(&tp->tap_rsel.si_note); destroy_dev(tp->tap_dev); ether_ifdetach(ifp); @@ -221,6 +224,7 @@ mtx_destroy(&tp->tap_mtx); free(tp, M_TAP); + CURVNET_RESTORE(); } static void @@ -362,6 +366,7 @@ if (unit == -1) append_unit = 1; + CURVNET_SET(CRED_TO_VNET(cred)); /* find any existing device, or allocate new unit number */ i = clone_create(&tapclones, &tap_cdevsw, &unit, dev, extra); if (i) { @@ -380,6 +385,7 @@ } if_clone_create(name, namelen, NULL); + CURVNET_RESTORE(); } /* tapclone */ @@ -520,6 +526,7 @@ /* junk all pending output */ mtx_lock(&tp->tap_mtx); + CURVNET_SET(ifp->if_vnet); IF_DRAIN(&ifp->if_snd); /* @@ -543,6 +550,8 @@ } if_link_state_change(ifp, LINK_STATE_DOWN); + CURVNET_RESTORE(); + funsetown(&tp->tap_sigio); selwakeuppri(&tp->tap_rsel, PZERO+1); KNOTE_LOCKED(&tp->tap_rsel.si_note, 0); @@ -944,7 +953,12 @@ } /* Pass packet up to parent. */ + CURVNET_SET(ifp->if_vnet); +#if __FreeBSD_version > 900038 + M_SETFIB(m, ifp->if_fib); +#endif (*ifp->if_input)(ifp, m); + CURVNET_RESTORE(); ifp->if_ipackets ++; /* ibytes are counted in parent */ return (0); This diff file can also be found here: http://www.vitsch.nl/patches/ >Release-Note: >Audit-Trail: >Unformatted: