kern/126945: CARP interface destruction with ifconfig destroy causes kernel panic

[Slawek]

>Number:         126945
>Category:       kern
>Synopsis:       CARP interface destruction with ifconfig destroy causes kernel panic
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 29 13:10:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Slawek
>Release:        7.0 STABLE
>Organization:
Zak
>Environment:
FreeBSD drummer 7.0-STABLE FreeBSD 7.0-STABLE #2: Mon Aug 18 14:54:24 CEST 2008     root at fw-1:/usr/obj/usr/src/sys/X4200  i386

>Description:
ifconfig destroy on carp interface caused kernel panic. Backtrace:

(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc0755107 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2  0xc07553c9 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:572
#3  0xc0a5fd5c in trap_fatal (frame=0xe7bd4a94, eva=65628) at /usr/src/sys/i386/i386/trap.c:899
#4  0xc0a5ffe0 in trap_pfault (frame=0xe7bd4a94, usermode=0, eva=65628) at /usr/src/sys/i386/i386/trap.c:812
#5  0xc0a6098c in trap (frame=0xe7bd4a94) at /usr/src/sys/i386/i386/trap.c:490
#6  0xc0a4671b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc0822f46 in arpintr (m=0xc7493900) at /usr/src/sys/netinet/if_ether.c:606
#8  0xc07f70e5 in netisr_dispatch (num=18, m=0xc7493900) at /usr/src/sys/net/netisr.c:185
#9  0xc07ee341 in ether_demux (ifp=0xc7073c00, m=0xc7493900) at /usr/src/sys/net/if_ethersubr.c:834
#10 0xc07ee753 in ether_input (ifp=0xc7073c00, m=0xc7493900) at /usr/src/sys/net/if_ethersubr.c:692
#11 0xc07ee287 in ether_demux (ifp=0xc70aa000, m=0xc7493900) at /usr/src/sys/net/if_ethersubr.c:743
#12 0xc07ee753 in ether_input (ifp=0xc70aa000, m=0xc7493900) at /usr/src/sys/net/if_ethersubr.c:692
#13 0xc056f25a in em_rxeof (adapter=0xc6db8800, count=99) at /usr/src/sys/dev/em/if_em.c:4511
#14 0xc056fe97 in em_handle_rxtx (context=0xc6db8800, pending=1) at /usr/src/sys/dev/em/if_em.c:1676
#15 0xc0787e55 in taskqueue_run (queue=0xc6e77900) at /usr/src/sys/kern/subr_taskqueue.c:255
#16 0xc078805b in taskqueue_thread_loop (arg=0xc6db8b68) at /usr/src/sys/kern/subr_taskqueue.c:374
#17 0xc0732af9 in fork_exit (callout=0xc0787fa0 <taskqueue_thread_loop>, arg=0xc6db8b68, frame=0xe7bd4d38) at /usr/src/sys/kern/kern_fork.c:783
#18 0xc0a46790 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205

>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: