svn commit: r345180 - head/sys/net

[Kyle Evans]

On Fri, Mar 15, 2019 at 8:20 AM Kyle Evans <kevans at freebsd.org> wrote:
>
> Author: kevans
> Date: Fri Mar 15 13:19:52 2019
> New Revision: 345180
> URL: https://svnweb.freebsd.org/changeset/base/345180
>
> Log:
>   if_bridge(4): Fix module teardown
>
>   bridge_rtnode_zone still has outstanding allocations at the time of
>   destruction in the current model because all of the interface teardown
>   happens in a VNET_SYSUNINIT, -after- the MOD_UNLOAD has already been
>   processed.  The SYSUNINIT triggers destruction of the interfaces, which then
>   attempts to free the memory from the zone that's already been destroyed, and
>   we hit a panic.
>
>   Solve this by virtualizing the uma_zone we allocate the rtnodes from to fix
>   the ordering. bridge_rtable_fini should also take care to flush any
>   remaining routes that weren't taken care of when dynamic routes were flushed
>   in bridge_stop.
>
>   Reviewed by:  kp
>   Differential Revision:        https://reviews.freebsd.org/D19578
>
> Modified:
>   head/sys/net/if_bridge.c
>
> [... snip ...]
> @@ -2886,6 +2890,7 @@ bridge_rtable_fini(struct bridge_softc *sc)
>
>         KASSERT(sc->sc_brtcnt == 0,
>             ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
> +       bridge_rtflush(sc, 1);
>         free(sc->sc_rthash, M_DEVBUF);
>  }
>

Now that I read through all of this again, this is wrong. Routes are
destroyed as the member interfaces are removed up in
bridge_clone_destroy, and that this needs to have been done already is
KASSERT'd on the line right above. I will remove this, because that
flush will accomplish nothing.