kern/116172

[Peter Wemm]

The following reply was made to PR kern/116172; it has been noted by GNATS.

From: Peter Wemm <peter at wemm.org>
To: freebsd-gnats-submit at freebsd.org
Cc:  
Subject: Re: kern/116172
Date: Thu, 18 Oct 2007 19:32:25 -0700

 I've narrowed down the panic trigger.
 
 I have two userland processes doing a tun0 tunnel.  The purpose is to do 
 IPv6 encapsulated in UDP.
 
 The local end has an open ssh connection to the remote end.
 
 If I reboot at that instant, both the ssh and the tunnel driver receive 
 a sigterm at the same time.
 
 The death of the tun0 driver causes the tun0 interface to be torn down 
 and the routes cleaned up.
 
 At the same time, the death of the ssh process attempts to send a tcp6 
 FIN to be sent.  This causes the panic described above.
 
 A simple workaround is to do a 'ssh -4' to the remote end rather than 
 over the tunnel.  This avoids the simultanious tun0 route teardown and 
 the ssh teardown.  It only seems to be a problem with ssh to the 
 precise remote endpoint.  ssh over the tunnel to other machines does 
 not cause the panic when the machine is rebooted.
 
 Sample tun0 driver to trigger the panic:  
 http://people.freebsd.org/~peter/qd_tun.c   - quick & dirty tunnel :-) 
 
 Ifconfig some ipv6 addresses to each end.  ssh to the other end, 
 reboot(8) locally, wait for the kaboom!
 
 -Peter