Bug 235699

Summary:	Kernel panics when setting IP address if net.link.ether.inet.garp_rexmit_count=2
Product:	Base System	Reporter:	Pete French <pete>
Component:	kern	Assignee:	Kristof Provost <kp>
Status:	Closed FIXED
Severity:	Affects Some People	CC:	kp, net, vangyzen
Priority:	---	Keywords:	crash, patch
Version:	12.0-STABLE	Flags:	koobs: mfc-stable12+ koobs: mfc-stable11+
Hardware:	Any
OS:	Any

Description Pete French 2019-02-12 16:12:15 UTC

If this is set then the kernel will panic a second or so after setting a network address on an interface. This applies to 12.0-RELEASE onwards. It woks fine on 11. Example and trace is below

root@serpentine-passive:~ #  ifconfig igb0 inet 10.32.10.4/16 up


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x28
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80c987f1
stack pointer           = 0x28:0xfffffe00004d5730
frame pointer           = 0x28:0xfffffe00004d5750
code segment            = base rx0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (swi4: clock (0))
trap number             = 12
panic: page fault
cpuid = 0
time = 1549981620
KDB: stack backtrace:
#0 0xffffffff80bdfdc7 at kdb_backtrace+0x67
#1 0xffffffff80b93fa3 at vpanic+0x1a3
#2 0xffffffff80b93df3 at panic+0x43
#3 0xffffffff8106a7bf at trap_fatal+0x35f
#4 0xffffffff8106a819 at trap_pfault+0x49
#5 0xffffffff81069e3e at trap+0x29e
#6 0xffffffff810450c5 at calltrap+0x8
#7 0xffffffff80c986f6 at ether_output+0x6b6
#8 0xffffffff80d03354 at arprequest+0x4c4
#9 0xffffffff80d0515c at garp_rexmit+0xbc
#10 0xffffffff80bade19 at softclock_call_cc+0x129
#11 0xffffffff80bae2f9 at softclock+0x79
#12 0xffffffff80b57c57 at ithread_loop+0x1a7
#13 0xffffffff80b54da2 at fork_exit+0x82
#14 0xffffffff810460be at fork_trampoline+0xe
Uptime: 2m6s

Comment 1 Kristof Provost freebsd_committer

2019-02-12 18:23:35 UTC

That looks like another case of CURVNET not being set.

This should fix it:

diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index f278fa1b3ca..c84fcee3328 100644
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -1335,6 +1335,8 @@ garp_rexmit(void *arg)
                return;
        }

+       CURVNET_SET(ia->ia_ifa.ifa_ifp->if_vnet);
+
        /*
         * Drop lock while the ARP request is generated.
         */
@@ -1362,6 +1364,8 @@ garp_rexmit(void *arg)
                        ifa_free(&ia->ia_ifa);
                }
        }
+
+       CURVNET_RESTORE();
 }

 /*

Comment 2 Eric van Gyzen freebsd_committer

2019-02-12 20:26:27 UTC

The patch looks good to me.

Comment 3 commit-hook freebsd_committer

2019-02-12 21:23:34 UTC

A commit references this bug:

Author: kp
Date: Tue Feb 12 21:22:58 UTC 2019
New revision: 344061
URL: https://svnweb.freebsd.org/changeset/base/344061

Log:
  garp: Fix vnet related panic for gratuitous arp

  Gratuitous ARP packets are sent from a timer, which means we don't have a vnet
  context set. As a result we panic trying to send the packet.

  Set the vnet context based on the interface associated with the interface
  address.

  To reproduce:
    sysctl net.link.ether.inet.garp_rexmit_count=2
    ifconfig vtnet1 10.0.0.1/24 up

  PR:		235699
  Reviewed by:	vangyzen@
  MFC after:	1 week

Changes:
  head/sys/netinet/if_ether.c

Comment 4 commit-hook freebsd_committer

2019-02-19 18:23:05 UTC

A commit references this bug:

Author: kp
Date: Tue Feb 19 18:22:56 UTC 2019
New revision: 344281
URL: https://svnweb.freebsd.org/changeset/base/344281

Log:
  MFC r344061:

  garp: Fix vnet related panic for gratuitous arp

  Gratuitous ARP packets are sent from a timer, which means we don't have a vnet
  context set. As a result we panic trying to send the packet.

  Set the vnet context based on the interface associated with the interface
  address.

  To reproduce:
  sysctl net.link.ether.inet.garp_rexmit_count=2
  ifconfig vtnet1 10.0.0.1/24 up

  PR:		235699
  Reviewed by:	vangyzen@

Changes:
_U  stable/12/
  stable/12/sys/netinet/if_ether.c

Comment 5 commit-hook freebsd_committer

2019-02-19 18:23:09 UTC

A commit references this bug:

Author: kp
Date: Tue Feb 19 18:22:57 UTC 2019
New revision: 344282
URL: https://svnweb.freebsd.org/changeset/base/344282

Log:
  MFC r344061:

  garp: Fix vnet related panic for gratuitous arp

  Gratuitous ARP packets are sent from a timer, which means we don't have a vnet
  context set. As a result we panic trying to send the packet.

  Set the vnet context based on the interface associated with the interface
  address.

  To reproduce:
  sysctl net.link.ether.inet.garp_rexmit_count=2
  ifconfig vtnet1 10.0.0.1/24 up

  PR:		235699
  Reviewed by:	vangyzen@

Changes:
_U  stable/11/
  stable/11/sys/netinet/if_ether.c