Bug 211644 - ifconfig concurrency bug (kernel panic)
Summary: ifconfig concurrency bug (kernel panic)
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 10.3-RELEASE
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-net mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-07 19:01 UTC by Evgeny Vinogradov
Modified: 2016-08-08 09:35 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Evgeny Vinogradov 2016-08-07 19:01:33 UTC
- can not add or remove ip from interface.
- system crash.

How to reproduce:

in first ssh console:

#!/bin/sh
ifconfig tap50 create

while [ 1 ] ; do
ifconfig tap50 alias 1.2.3.4/31
ifconfig tap50 -alias 1.2.3.4
done

in second ssh console:

#!/bin/sh
while [ 1 ] ; do
ifconfig tap50 alias 1.2.3.4/31
done

After few seconds system output: "can not assign requested address".
After this i can not add/remove this ip to interface.
If i wait about 1 minute with active scripts, kernel panic occurs.



Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 02
fault virtual address<->= 0x6000a1276
fault code<----><------>= supervisor read data, page not present
instruction pointer<--->= 0x20:0xffffffff80a0be89
stack pointer<->        = 0x28:0xfffffe0233db7270
frame pointer<->        = 0x28:0xfffffe0233db72e0
code segment<--><------>= base rx0, limit 0xfffff, type 0x1b
<------><------><------>= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags<------>= interrupt enabled, resume, IOPL = 0
current process><------>= 9118 (ifconfig)
trap number<---><------>= 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
#0 0xffffffff808e7e90 at kdb_backtrace+0x60
#1 0xffffffff808af975 at panic+0x155
#2 0xffffffff80c8e832 at trap_fatal+0x3a2
#3 0xffffffff80c8eb09 at trap_pfault+0x2c9
#4 0xffffffff80c8e296 at trap+0x5e6
#5 0xffffffff80c75532 at calltrap+0x8
#6 0xffffffff809e1687 at sctp_addr_change+0x127
#7 0xffffffff8097aa34 at rt_newaddrmsg_fib+0x44
#8 0xffffffff80a56ca5 at in6_ifaddloop+0x1c5
#9 0xffffffff80a592b9 at in6_update_ifa+0xb99
#10 0xffffffff80a5d54d at in6_ifattach+0x2ed
#11 0xffffffff809682ef at ifioctl+0x7df
#12 0xffffffff808fdfae at kern_ioctl+0x22e
#13 0xffffffff808fdd2f at sys_ioctl+0x11f
#14 0xffffffff80c8f127 at amd64_syscall+0x357
#15 0xffffffff80c7581b at Xfast_syscall+0xfb
Uptime: 1h38m15s

(kgdb) #0  doadump (textdump=<value optimized out>) at pcpu.h:219
#1  0xffffffff808af5f0 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:447
#2  0xffffffff808af9b4 in panic (fmt=<value optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:754
#3  0xffffffff80c8e832 in trap_fatal (frame=<value optimized out>,.
    eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:882
#4  0xffffffff80c8eb09 in trap_pfault (frame=0xfffffe0233db71c0, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:699
#5  0xffffffff80c8e296 in trap (frame=0xfffffe0233db71c0)
    at /usr/src/sys/amd64/amd64/trap.c:463
#6  0xffffffff80c75532 in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:232
#7  0xffffffff80a0be89 in sctp_add_addr_to_vrf (vrf_id=0,.
    ifn=0xfffff8017d899800, ifn_index=10, ifn_type=6,.
    if_name=0xfffff8017d899828 "tap8", ifa=0xfffff8017db6dc00,.
    addr=<value optimized out>) at /usr/src/sys/netinet/sctp_pcb.c:204
#8  0xffffffff809e1687 in sctp_addr_change (ifa=<value optimized out>,.
    cmd=<value optimized out>) at /usr/src/sys/netinet/sctp_bsd_addr.c:339
#9  0xffffffff8097aa34 in rt_newaddrmsg_fib (cmd=1, ifa=0xfffff8017db6dc00,.
    error=0, rt=0xfffffe0233db7400, fibnum=-1)
    at /usr/src/sys/net/rtsock.c:1368
#10 0xffffffff80a56ca5 in in6_ifaddloop (ifa=0xfffff8017db6dc00)
    at /usr/src/sys/netinet6/in6.c:187
#11 0xffffffff80a592b9 in in6_update_ifa (ifp=0xfffff8017d899800,.
    ifra=0xfffffe0233db7800, ia=<value optimized out>, flags=1)
    at /usr/src/sys/netinet6/in6.c:1946
#12 0xffffffff80a5d54d in in6_ifattach (ifp=0xfffff8017d899800,.
    altifp=<value optimized out>) at /usr/src/sys/netinet6/in6_ifattach.c:500
#13 0xffffffff809682ef in ifioctl (so=0xfffff8017db38828,.
    cmd=<value optimized out>, data=0xfffff80008cb3640 "tap8",.
    td=0xfffff8017d9c8000) at /usr/src/sys/net/if.c:2172
#14 0xffffffff808fdfae in kern_ioctl (td=0xfffff8017d9c8000,.
    fd=<value optimized out>, com=18446735284017666048) at file.h:319
#15 0xffffffff808fdd2f in sys_ioctl (td=0xfffff8017d9c8000,.
    uap=0xfffffe0233db7b40) at /usr/src/sys/kern/sys_generic.c:702
#16 0xffffffff80c8f127 in amd64_syscall (td=0xfffff8017d9c8000, traced=0)
    at subr_syscall.c:134
#17 0xffffffff80c7581b in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:391
#18 0x00000008011a308a in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
Comment 1 Hans Petter Selasky freebsd_committer 2016-08-08 09:35:59 UTC
Looks similar to:

https://reviews.freebsd.org/D4605

--HPS