LOR + panic in scope6.c

[Bjoern A. Zeeb]

On Tue, 9 Aug 2005, John Baldwin wrote:

> > ...
> > skc0: no PHY found!
> > panic: ifp->if_afdata[AF_INET6] NULL
> > KDB: enter: panic
> > [thread pid 0 tid 0 ]
> > Stopped at      kdb_enter+0x2f: nop
> > db> where
> > Tracing pid 0 tid 0 td 0xffffffff8081e6c0
> > kdb_enter() at kdb_enter+0x2f
> > panic() at panic+0x1d2
> > in6_setscope() at in6_setscope+0x20f
> > in6_ifdetach() at in6_ifdetach+0x24a
> > if_detach() at if_detach+0x39
> > ether_ifdetach() at ether_ifdetach+0x35
> > sk_attach() at sk_attach+0x522
> > device_attach() at device_attach+0x292
> > bus_generic_attach() at bus_generic_attach+0x18
> > skc_attach() at skc_attach+0x6df
> > device_attach() at device_attach+0x292
> > ...
> >
> > bz at amd64:/local/building/freebsd/HEAD/sys> cvs -qR diff -up
> > netinet6/scope6.c Index: netinet6/scope6.c
> > ===================================================================
> > RCS file: /local/mirror/FreeBSD/r/ncvs/src/sys/netinet6/scope6.c,v
> > retrieving revision 1.15
> > diff -u -p -r1.15 scope6.c
> > --- netinet6/scope6.c   25 Jul 2005 17:28:39 -0000      1.15
> > +++ netinet6/scope6.c   9 Aug 2005 17:35:07 -0000
> > @@ -412,8 +412,13 @@ in6_setscope(in6, ifp, ret_id)
> >         u_int32_t zoneid = 0;
> >         struct scope6_id *sid;
> >
> > +       KASSERT(ifp != NULL, ("ifp NULL"));
> > +
> >         IF_AFDATA_LOCK(ifp);
> >
> > +       KASSERT(ifp->if_afdata[AF_INET6] != NULL,
> > +               ("ifp->if_afdata[AF_INET6] NULL"));
> > +
> >         sid = SID(ifp);
> >
> >  #ifdef DIAGNOSTIC
> >
> > Could it be a problem of ether_ifattach and ether_ifdetach being
> > run without the driver locks?  UP machine btw.
>
> I don't think it is a locking problem.  I think that the inet6 code is simply
> not taking into account some edge case.  In theory I don't think that
> if_afdata[AF_INET6] should be NULL since ether_ifattach() has called inet6's
> domain attach routine.  Are you sure that you have called ether_ifattach()
> btw?

so netinet6/ really is the place to check.

The code goes about like this:

...
        SK_UNLOCK(sc);
        ether_ifattach(ifp, eaddr);
        SK_LOCK(sc);
...
        SK_UNLOCK(sc);
        if (mii_phy_probe(dev, &sc_if->sk_miibus,
            sk_ifmedia_upd, sk_ifmedia_sts)) {
                printf("skc%d: no PHY found!\n", sc_if->sk_unit);
 boom ==>>      ether_ifdetach(ifp);
                if_free(ifp);
                error = ENXIO;
                goto fail;
        }


I guess I should check tomorrow that if_attachdomain1 really calls
the routines for AF_INET6 and what they do...

-- 
Bjoern A. Zeeb				bzeeb at Zabbadoz dot NeT