kern/138332: ifconfig tun0 destroy causes LOR on 8.0-BETA3

[Richard Tector]

>Number:         138332
>Category:       kern
>Synopsis:       ifconfig tun0 destroy causes LOR on 8.0-BETA3
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Aug 30 09:00:08 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Richard Tector
>Release:        FreeBSD 8.0-BETA3 amd64
>Organization:
>Environment:
FreeBSD daffy.tector.org.uk 8.0-BETA3 FreeBSD 8.0-BETA3 #17: Sat Aug 29 13:46:30 BST 2009     richard at daffy.tector.org.uk:/usr/obj/usr/src/sys/DAFFY  amd64
>Description:
Issuing ifconfig tun0 destroy after stopping PPP causes a lock order reversal as follows:

tun0: link state changed to DOWN
lock order reversal:
 1st 0xffffff00037b4bc8 if_afdata (if_afdata) @ /usr/src/sys/net/if.c:912
 2nd 0xffffffff80a42200 mld_mtx (mld_mtx) @ /usr/src/sys/netinet6/mld6.c:569
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
_witness_debugger() at _witness_debugger+0x2e
witness_checkorder() at witness_checkorder+0x80b
_mtx_lock_flags() at _mtx_lock_flags+0x71
mld_domifdetach() at mld_domifdetach+0x24
in6_domifdetach() at in6_domifdetach+0x11
if_detach() at if_detach+0x792
tun_destroy() at tun_destroy+0x70
ifc_simple_destroy() at ifc_simple_destroy+0x2a
if_clone_destroyif() at if_clone_destroyif+0xc0
ifioctl() at ifioctl+0x6f4
kern_ioctl() at kern_ioctl+0xc3
ioctl() at ioctl+0xfc
syscall() at syscall+0x1b2
Xfast_syscall() at Xfast_syscall+0xe1
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x800a7bbbc, rsp = 0x7fffffffe238, rbp = 0x51cf28 ---
>How-To-Repeat:
/etc/rc.d/ppp stop
ifconfig tun0 destroy
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: