Bug 243324 - Module with 'mii' can panic during kldunload
Summary: Module with 'mii' can panic during kldunload
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2020-01-13 16:08 UTC by ghuckriede
Modified: 2023-11-03 15:24 UTC (History)
1 user (show)

See Also:


Attachments
panic debug (35.85 KB, text/plain)
2020-01-13 16:10 UTC, ghuckriede
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description ghuckriede 2020-01-13 16:08:50 UTC
Overview:
While trying to see if setting ivars to NULL during detach was required (See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242727), discovered 're' module can panic on kldunload.  Upon further analysis, it was determined that there is no protection for ioctls during the kldunload.  The 'mii' devices appear to be detached and destroyed while ioctl (ifconfig) is holding the RL_LOCK.  There does not appear to be a 'mii' device lock (perhaps assuming the RL_LOCK would protect it, which it doesn't).

Steps to Reproduce:
Compile a kernel without re module (needed to do a kldunload).


After rebooting open 2 terminals (ssh for example)
for 're'
#### 1st terminal
$ su root
# /bin/sh
# while true ; do kldload /usr/obj/usr/src/amd64.amd64/sys/modules/re/if_re.ko;ifconfig re0 up;sleep 1; kldunload if_re.ko ; done

#### 2nd terminal
$ su root
# /bin/sh
# while true ; do ifconfig re0 ; done

OR for 'axe'
$ su root
# /bin/sh
# while true ; do ifconfig ue0 up;sleep 1; kldunload if_axe.ko ; done

#### 2nd terminal
$ su root
# /bin/sh
# while true ; do ifconfig ue0 ; done


Actual Results:
Panic occurred within a few seconds.

Expected Results:
no panic

Build Date & Hardware:

# uname -a
FreeBSD FreeBSD_head_ghuckriede 13.0-CURRENT FreeBSD 13.0-CURRENT #2 r356559: Thu Jan  9 15:45:41 EST 2020     ghuckriede@FreeBSD_head_ghuckriede:/usr/obj/usr/src/amd64.amd64/sys/GENERIC_NO_RE  amd64
Comment 1 ghuckriede 2020-01-13 16:10:14 UTC
Created attachment 210711 [details]
panic debug

're' on 12.1;
're' on head;
'axe' on head;
Comment 2 ghuckriede 2020-01-13 19:57:00 UTC
This does not panic during an attach/detach loop.

#### 1st terminal
$ su root
$ /bin/sh
# while true; do devctl attach pci0:3:0:0;ifconfig re0 up; sleep 1;devctl detach pci0:3:0:0; done


#### 2nd terminal
$ su root
$ /bin/sh
# while true ; do ifconfig re0 ; done