kern/181078: Loading tun(4) from loader.conf(5) causes panic when kernel already contains device tun(4)

[Brandon Gooch]

>Number:         181078
>Category:       kern
>Synopsis:       Loading tun(4) from loader.conf(5) causes panic when kernel already contains device tun(4)
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Aug 06 03:40:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Brandon Gooch
>Release:        10-CURRENT
>Organization:
>Environment:
FreeBSD m6500.m6500 10.0-CURRENT FreeBSD 10.0-CURRENT #3 r253950M: Mon Aug  5 21:16:19 CDT 2013     root at m6500.m6500:/usr/obj/usr/home/brandon/wc/freebsd-base-head/sys/DELL_M6500  amd64
>Description:
As per the subject, loading tun(4) via loader.conf(5) results in a panic if the tun(4) device already exists in the kernel.

Properly registering the tun(4) driver via MODULE_VERSION(9) fixes the issue, disallowing double-registering the module (patch attached).

Sure, this is on the edge of user error, but it's still a POLA violation and incorrect behavior...

Here's the stack trace from the panic:

#0  doadump (textdump=682654720) at pcpu.h:236
236     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump (textdump=682654720) at pcpu.h:236
#1  0xffffffff803050a5 in db_fncall (dummy1=<value optimized out>, 
    dummy2=<value optimized out>, dummy3=<value optimized out>, 
    dummy4=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_command.c:578
#2  0xffffffff80304d8d in db_command (cmd_table=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_command.c:449
#3  0xffffffff80304b04 in db_command_loop ()
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_command.c:502
#4  0xffffffff80307470 in db_trap (type=<value optimized out>, code=0)
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_main.c:231
#5  0xffffffff804b92c3 in kdb_trap (type=9, code=0, tf=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/kern/subr_kdb.c:654
#6  0xffffffff8082954a in trap_fatal (frame=0xffffff84655c4860, 
    eva=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/trap.c:868
#7  0xffffffff808291ef in trap (frame=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/trap.c:224
#8  0xffffffff80812ed2 in calltrap ()
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/exception.S:232
#9  0xffffffff8053e696 in if_clone_create (name=0xfffffe0032b7aec0 "wlan0", 
    len=16, params=0x627300 <Address 0x627300 out of bounds>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/net/if_clone.c:193
#10 0xffffffff8053ba10 in ifioctl (so=0xfffffe0032e50550, 
    cmd=<value optimized out>, data=0xfffffe0032b7aec0 "wlan0", 
    td=0xfffffe0032eb1920)
    at /usr/home/brandon/wc/freebsd-base-head/sys/net/if.c:2505
#11 0xffffffff804d072e in kern_ioctl (td=0xfffffe0032eb1920, 
    fd=<value optimized out>, com=18446741875537194688) at file.h:306
#12 0xffffffff804d04af in sys_ioctl (td=0xfffffe0032eb1920, 
    uap=0xffffff84655c4b80)
    at /usr/home/brandon/wc/freebsd-base-head/sys/kern/sys_generic.c:693
#13 0xffffffff80829e77 in amd64_syscall (td=0xfffffe0032eb1920, traced=0)
    at subr_syscall.c:134
#14 0xffffffff808131bb in Xfast_syscall ()
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/exception.S:391
#15 0x000000080119b45a in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
>How-To-Repeat:
Load tun(4) via loader.conf(5) while having the tun(4) device compiled in to the kernel.
>Fix:
Patch attached.

Patch attached with submission follows:

Index: sys/net/if_tun.c
===================================================================
--- sys/net/if_tun.c	(revision 253950)
+++ sys/net/if_tun.c	(working copy)
@@ -321,6 +321,7 @@
 };
 
 DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
+MODULE_VERSION(if_tun, 1);
 
 static void
 tunstart(struct ifnet *ifp)


>Release-Note:
>Audit-Trail:
>Unformatted: