[Bug 206053] There is a bug in kqueue support code of netmap

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=206053

            Bug ID: 206053
           Summary: There is a bug in kqueue support code of netmap
           Product: Base System
           Version: 11.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: btw at mail.ustc.edu.cn

It seems that there is a bug in kqueue support code of netmap which can cause
kernel panic. And I can reproduce the kernel panic with this simple program on
-HEAD:

#include <stdio.h>
#include <assert.h>

#include <sys/types.h>
#include <sys/event.h>
#include <sys/time.h>

#ifndef NETMAP_WITH_LIBS
#define NETMAP_WITH_LIBS
#endif
#include <net/netmap_user.h>

static int
kq_add(int kq, int fd)
{
        struct kevent changes[1];
        int ret;

        EV_SET(&changes[0], fd, EVFILT_READ, EV_ADD, 0, 0, NULL);
        ret = kevent(kq, changes, 1, NULL, 0, NULL);
        assert(ret != -1);

        printf("[%s] success\n", __func__);

        return (ret);
}

static void
kq_wait(int kq)
{
        struct kevent events[1];
        int ret;

        ret = kevent(kq, NULL, 0, events, 1, NULL);
        assert(ret != -1);

        printf("[%s] success\n", __func__);
}

int main(void)
{
        const char *ifname = "vale0:vm1";
        struct nm_desc *d;
        int kq;

        d = nm_open(ifname, NULL, 0, 0);
        assert(d != NULL);

        kq = kqueue();
        assert(kq != -1);

        kq_add(kq, d->fd);
        kq_wait(kq);

        return (0);
}

And below is part of the crash summary:

freebsd dumped core - see /var/crash/vmcore.0

Fri Jan  8 22:19:39 CST 2016

FreeBSD freebsd 11.0-CURRENT FreeBSD 11.0-CURRENT #2 d1f6105(master)-dirty: Fri
Jan  8 21:55:33 CST 2016     btw at freebsd:/usr/obj/root/freebsd/sys/GENERIC 
amd64

......

panic: mutex nm_kn_lock not owned at /root/freebsd/sys/kern/kern_event.c:2073
cpuid = 1
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe011744c420
vpanic() at vpanic+0x182/frame 0xfffffe011744c4a0
panic() at panic+0x43/frame 0xfffffe011744c500
__mtx_assert() at __mtx_assert+0xbf/frame 0xfffffe011744c510
knlist_add() at knlist_add+0x20/frame 0xfffffe011744c540
netmap_kqfilter() at netmap_kqfilter+0x101/frame 0xfffffe011744c580
devfs_kqfilter_f() at devfs_kqfilter_f+0x81/frame 0xfffffe011744c5d0
kqueue_register() at kqueue_register+0x5bf/frame 0xfffffe011744c670
kqueue_kevent() at kqueue_kevent+0xc8/frame 0xfffffe011744c840
kern_kevent_fp() at kern_kevent_fp+0x99/frame 0xfffffe011744c890
kern_kevent() at kern_kevent+0x9f/frame 0xfffffe011744c8f0
sys_kevent() at sys_kevent+0x11c/frame 0xfffffe011744c9a0
amd64_syscall() at amd64_syscall+0x2db/frame 0xfffffe011744cab0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe011744cab0
--- syscall (363, FreeBSD ELF64, sys_kevent), rip = 0x80095bc7a, rsp =
0x7fffffffe988, rbp = 0x7fffffffe9e0 ---
KDB: enter: panic

......

-- 
You are receiving this mail because:
You are the assignee for the bug.