CARP panics on RELENG_6 when destroying a CARP interface

[Max Laier]

On Monday 14 August 2006 18:39, Scott Ullrich wrote:
> I am testing out CARP on RELENG_6 as of yesterday and I am seeing a
> panic when attempting to destory a CARP interface:
>
> # ifconfig carp0 delete
> # ifconfig carp0 destroy
> # panic: thread 100049(ifconfig):0 holds carp_if but isn't blocked on a
> lock
>
> KDB: enter: panic
> [thread pid 12 tid 100004 ]
> Stopped at      kdb_enter+0x2b: nop
> db> bt
> Tracing pid 12 tid 100004 td 0xc14d6900
> kdb_enter(c08690a0) at kdb_enter+0x2b
> panic(c086c2f3,186d6,c1630bc4,0,c0876fc4) at panic+0xbb
> propagate_priority(c14d6900,c0948fd0,c15a7e90,c14d6900,c1575000) at
> propagate_pr iority+0x137
> turnstile_wait(c15a7e90,c1632000,c15a7e90,2,c0868048,225) at
> turnstile_wait+0x2f 0
> _mtx_lock_sleep(c15a7e90,c14d6900,0,c0876cbe,283) at
> _mtx_lock_sleep+0x102 _mtx_lock_flags(c15a7e90,0,c0876cbe,283,0) at
> _mtx_lock_flags+0x72
> carp_input_c(c15e8500,c15e8544,2,c15e8544,c172100e) at
> carp_input_c+0x30 carp_input(c16eb700,14,c15fa940,0,0) at
> carp_input+0x216
> ip_input(c16eb700) at ip_input+0x7ad

Looks like a race between the check in ip_carp.c:502
   m->m_pkthdr.rcvif->if_carp == NULL
and the actual use of that interface pointer.  I'm afraid we need some 
form of synchronization for access to ifnet.if_carp  From a quick glance 
we could either use IFADDR_LOCK() or the global IFNET_{W,R}LOCK  I will 
look at producing a patch later tonight.

> netisr_processqueue(c094a958) at netisr_processqueue+0x6e
> swi_net(0) at swi_net+0xc6
> ithread_execute_handlers(c14d5830,c14d3580) at
> ithread_execute_handlers+0xe6
> ithread_loop(c14bd760,c796cd38,c14bd760,c05f76a8,0) at
> ithread_loop+0x66 fork_exit(c05f76a8,c14bd760,c796cd38) at
> fork_exit+0xa0
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0x1, eip = 0, esp = 0xc796cd6c, ebp = 0 ---
> db>
>
> Please let me know if I can supply more information.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20060814/6645b33c/attachment.pgp