kern/82881: ng_fec(4) causes kernel panic after interface datach

[Wojciech A. Koszek]

>Number:         82881
>Category:       kern
>Synopsis:       ng_fec(4) causes kernel panic after interface datach
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Jul 02 00:40:23 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Wojciech A. Koszek
>Release:        FreeBSD 5.4-STABLE i386
>Organization:
>Environment:
System: FreeBSD dunstan.freebsd.czest.pl 5.4-STABLE FreeBSD 5.4-STABLE #0: Mon May 23 00:05:05 CEST 2005 root at dunstan.freebsd.czest.pl:/usr/obj/usr/src/sys/HOME8 i386


>Description:
ng_fec(4) brings Cisco Fast-Ethernet Trunking to Netgraph subsystem. It
creates virtual network interface, which is based on logical interfaces
providing access to physical media. Structures responsible for 'fec'
interface contain information about underlying interfaces. Thus,
modification on logical interfaces (e.g: detaching) modifies 'fec'
interface behaviour. Currently there is no handling of described situation -
after detaching underlying interface and touching existing fec interface,
kernel panics. This is due to delivery of requests (ioctl) to non-existent
interface.

>How-To-Repeat:
ngctl
(..)
+ mkpeer . fec a b
+ list
There are 2 total nodes:
  Name: fec0            Type: fec           ID: 00000002 Num hooks: 1
  Name: ngctl728        Type: socket        ID: 00000001  Num hooks: 1
+ msg [2]: add_iface "sk0"
+ quit

$ ifconfig fec0
fec0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
	ether 00:11:d8:a8:10:ab
	media: Ethernet none
	status: active
# kldunload if_sk
# ifconfig fec0 10.0.0.1

>Fix:
Probably EVENTHANDLER(9) in current design.
>Release-Note:
>Audit-Trail:
>Unformatted: