Bug 235699 - Kernel panics when setting IP address if net.link.ether.inet.garp_rexmit_count=2
Summary: Kernel panics when setting IP address if net.link.ether.inet.garp_rexmit_count=2
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.0-STABLE
Hardware: Any Any
: --- Affects Some People
Assignee: Kristof Provost
URL:
Keywords: crash, patch
Depends on:
Blocks:
 
Reported: 2019-02-12 16:12 UTC by Pete French
Modified: 2022-10-12 00:50 UTC (History)
3 users (show)

See Also:
koobs: mfc-stable12+
koobs: mfc-stable11+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Pete French 2019-02-12 16:12:15 UTC
If this is set then the kernel will panic a second or so after setting a network address on an interface. This applies to 12.0-RELEASE onwards. It woks fine on 11. Example and trace is below

root@serpentine-passive:~ #  ifconfig igb0 inet 10.32.10.4/16 up


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x28
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80c987f1
stack pointer           = 0x28:0xfffffe00004d5730
frame pointer           = 0x28:0xfffffe00004d5750
code segment            = base rx0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (swi4: clock (0))
trap number             = 12
panic: page fault
cpuid = 0
time = 1549981620
KDB: stack backtrace:
#0 0xffffffff80bdfdc7 at kdb_backtrace+0x67
#1 0xffffffff80b93fa3 at vpanic+0x1a3
#2 0xffffffff80b93df3 at panic+0x43
#3 0xffffffff8106a7bf at trap_fatal+0x35f
#4 0xffffffff8106a819 at trap_pfault+0x49
#5 0xffffffff81069e3e at trap+0x29e
#6 0xffffffff810450c5 at calltrap+0x8
#7 0xffffffff80c986f6 at ether_output+0x6b6
#8 0xffffffff80d03354 at arprequest+0x4c4
#9 0xffffffff80d0515c at garp_rexmit+0xbc
#10 0xffffffff80bade19 at softclock_call_cc+0x129
#11 0xffffffff80bae2f9 at softclock+0x79
#12 0xffffffff80b57c57 at ithread_loop+0x1a7
#13 0xffffffff80b54da2 at fork_exit+0x82
#14 0xffffffff810460be at fork_trampoline+0xe
Uptime: 2m6s
Comment 1 Kristof Provost freebsd_committer freebsd_triage 2019-02-12 18:23:35 UTC
That looks like another case of CURVNET not being set.

This should fix it:

diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index f278fa1b3ca..c84fcee3328 100644
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -1335,6 +1335,8 @@ garp_rexmit(void *arg)
                return;
        }

+       CURVNET_SET(ia->ia_ifa.ifa_ifp->if_vnet);
+
        /*
         * Drop lock while the ARP request is generated.
         */
@@ -1362,6 +1364,8 @@ garp_rexmit(void *arg)
                        ifa_free(&ia->ia_ifa);
                }
        }
+
+       CURVNET_RESTORE();
 }

 /*
Comment 2 Eric van Gyzen freebsd_committer freebsd_triage 2019-02-12 20:26:27 UTC
The patch looks good to me.
Comment 3 commit-hook freebsd_committer freebsd_triage 2019-02-12 21:23:34 UTC
A commit references this bug:

Author: kp
Date: Tue Feb 12 21:22:58 UTC 2019
New revision: 344061
URL: https://svnweb.freebsd.org/changeset/base/344061

Log:
  garp: Fix vnet related panic for gratuitous arp

  Gratuitous ARP packets are sent from a timer, which means we don't have a vnet
  context set. As a result we panic trying to send the packet.

  Set the vnet context based on the interface associated with the interface
  address.

  To reproduce:
    sysctl net.link.ether.inet.garp_rexmit_count=2
    ifconfig vtnet1 10.0.0.1/24 up

  PR:		235699
  Reviewed by:	vangyzen@
  MFC after:	1 week

Changes:
  head/sys/netinet/if_ether.c
Comment 4 commit-hook freebsd_committer freebsd_triage 2019-02-19 18:23:05 UTC
A commit references this bug:

Author: kp
Date: Tue Feb 19 18:22:56 UTC 2019
New revision: 344281
URL: https://svnweb.freebsd.org/changeset/base/344281

Log:
  MFC r344061:

  garp: Fix vnet related panic for gratuitous arp

  Gratuitous ARP packets are sent from a timer, which means we don't have a vnet
  context set. As a result we panic trying to send the packet.

  Set the vnet context based on the interface associated with the interface
  address.

  To reproduce:
  sysctl net.link.ether.inet.garp_rexmit_count=2
  ifconfig vtnet1 10.0.0.1/24 up

  PR:		235699
  Reviewed by:	vangyzen@

Changes:
_U  stable/12/
  stable/12/sys/netinet/if_ether.c
Comment 5 commit-hook freebsd_committer freebsd_triage 2019-02-19 18:23:09 UTC
A commit references this bug:

Author: kp
Date: Tue Feb 19 18:22:57 UTC 2019
New revision: 344282
URL: https://svnweb.freebsd.org/changeset/base/344282

Log:
  MFC r344061:

  garp: Fix vnet related panic for gratuitous arp

  Gratuitous ARP packets are sent from a timer, which means we don't have a vnet
  context set. As a result we panic trying to send the packet.

  Set the vnet context based on the interface associated with the interface
  address.

  To reproduce:
  sysctl net.link.ether.inet.garp_rexmit_count=2
  ifconfig vtnet1 10.0.0.1/24 up

  PR:		235699
  Reviewed by:	vangyzen@

Changes:
_U  stable/11/
  stable/11/sys/netinet/if_ether.c