jail -r leads to a panic

[suraj sandhu]

I am running 8.2 , I am hitting a panic after I create a vnet jail an try
to remove it.
jail -c name=j1 children.max=20 host.hostname=j1 jid=100 vnet persist
allow.raw_sockets
jail -r j1

calltrap() at calltrap+0x8
--- trap 0x9, rip = 0xffffffff80518f4d, rsp = 0xffffff805fa1d9e0, rbp
= 0xffffff805fa1da30 ---
raw_input() at raw_input+0x4d
rts_input() at rts_input+0x70
netisr_process_workstream_proto() at netisr_process_workstream_proto+0x1ea
swi_net() at swi_net+0xad
intr_event_execute_handlers() at intr_event_execute_handlers+0x21c
ithread_execute_handlers() at ithread_execute_handlers+0x73
ithread_loop() at ithread_loop+0x10f
fork_exit() at fork_exit+0x180
fork_trampoline() at fork_trampoline+0xe

The issue seems to be that in
if_detach_internal(), if_down() is called
which leads to netisr_queue() call in rt_dispatch() with an mbuf which
has the interface being detached
as rcvif, subsequently if_detach_internal() calls if_dead() on the interface.

And, then at time of processing the work, this panic is seen since
mbuf has a dead interface.

The same issue has been reported on the virtualization mailing list earlier
and I reported it to freebsd-net as well.

Here are the threads:
http://lists.freebsd.org/pipermail/freebsd-virtualization/2012-April/000885.html
http://www.mail-archive.com/freebsd-net@freebsd.org/msg43045.html


Thanks for any help!
-Suraj Sandhu