kern/176471: [xen] xn driver crash on detach

[Petri Helenius]

The following reply was made to PR kern/176471; it has been noted by GNATS.

From: Petri Helenius <petri at helenius.fi>
To: =?iso-8859-1?Q?Roger_Pau_Monn=E9?= <roger.pau at citrix.com>
Cc: <bug-followup at FreeBSD.org>,
 <pete at helenius.fi>
Subject: Re: kern/176471: [xen] xn driver crash on detach
Date: Fri, 1 Mar 2013 12:19:34 +0200

 On Feb 28, 2013, at 19:58 , Roger Pau Monn=E9 <roger.pau at citrix.com> =
 wrote:
 
 > Hi (again),
 >=20
 > I've just realized the previous patch also crashed when trying to=20
 > detach an interface that's up and running, the following patch allows=20=
 
 > to detach the interface while running without crashing the FreeBSD=20
 > kernel.
 >=20
 > Also, what do you mean by "changing configuration of xn network"?
 
 Using the management console, I think it just does detach / attach.=20
 
 The second patch works in 10-CURRENT, will try 9-STABLE.=20
 
 Pete
 
 >=20
 > ---
 > =46rom 9c0097ed4775c68769049c61e474ddb62cc11d1f Mon Sep 17 00:00:00 =
 2001
 > From: Roger Pau Monne <roger.pau at citrix.com>
 > Date: Thu, 28 Feb 2013 17:43:34 +0100
 > Subject: [PATCH] xen-netfront: fix detach of network interfaces
 >=20
 > Remove all the media and the interface when detaching it. Prevents the
 > following panic when detaching an interface (xl network-detach freebsd
 > 1)
 >=20
 > xn1: detached
 >=20
 > Fatal trap 12: page fault while in kernel mode
 > cpuid =3D 3; apic id =3D 06
 > fault virtual address	=3D 0xffffff80028ff2a0
 > fault code		=3D supervisor read data, page not present
 > instruction pointer	=3D 0x20:0xffffffff809653af
 > stack pointer	        =3D 0x28:0xffffff8117cb4940
 > frame pointer	        =3D 0x28:0xffffff8117cb4980
 > code segment		=3D base 0x0, limit 0xfffff, type 0x1b
 > 			=3D DPL 0, pres 1, long 1, def32 0, gran 1
 > processor eflags	=3D interrupt enabled, resume, IOPL =3D 0
 > current process		=3D 699 (devd)
 > [ thread pid 699 tid 100107 ]
 > Stopped at      ifmedia_ioctl+0x3f:     movq    0x8(%r12),%rcx
 > db> trace
 > Tracing pid 706 tid 100059 td 0xfffffe0006b69480
 > ifmedia_ioctl() at ifmedia_ioctl+0x3f/frame 0xffffff80f774c980
 > ifioctl() at ifioctl+0xeb7/frame 0xffffff80f774ca40
 > kern_ioctl() at kern_ioctl+0x1ce/frame 0xffffff80f774ca90
 > sys_ioctl() at sys_ioctl+0x11f/frame 0xffffff80f774cae0
 > amd64_syscall() at amd64_syscall+0x265/frame 0xffffff80f774cbf0
 > Xfast_syscall() at Xfast_syscall+0xfb/frame 0xffffff80f774cbf0
 > --- syscall (54, FreeBSD ELF64, sys_ioctl), rip =3D 0x44c60a, rsp =3D =
 0x7fffffffd678, rbp =3D 0x7fffffffd750 ---
 >=20
 > PR: 176471
 > ---
 > sys/dev/xen/netfront/netfront.c |    7 +++++++
 > 1 files changed, 7 insertions(+), 0 deletions(-)
 >=20
 > diff --git a/sys/dev/xen/netfront/netfront.c =
 b/sys/dev/xen/netfront/netfront.c
 > index 88641e3..3a8b8ea 100644
 > --- a/sys/dev/xen/netfront/netfront.c
 > +++ b/sys/dev/xen/netfront/netfront.c
 > @@ -2171,7 +2171,14 @@ netfront_detach(device_t dev)
 > static void
 > netif_free(struct netfront_info *info)
 > {
 > +	XN_LOCK(info);
 > +	xn_stop(info);
 > +	XN_UNLOCK(info);
 > +	callout_drain(&info->xn_stat_ch);
 > 	netif_disconnect_backend(info);
 > +	ifmedia_removeall(&info->sc_media);
 > +	ether_ifdetach(info->xn_ifp);
 > +	if_free(info->xn_ifp);
 > #if 0
 > 	close_netdev(info);
 > #endif
 > --=20
 > 1.7.7.5 (Apple Git-26)