Bug 254114 - if_wg(4): panic on second ifconfig wg0 up
Summary: if_wg(4): panic on second ifconfig wg0 up
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-net (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-03-07 20:32 UTC by Bernhard Froehlich
Modified: 2021-03-13 12:21 UTC (History)
3 users (show)

See Also:


Attachments
core.txt (60.36 KB, text/plain)
2021-03-07 20:32 UTC, Bernhard Froehlich
no flags Details
info (511 bytes, text/plain)
2021-03-07 20:33 UTC, Bernhard Froehlich
no flags Details
panic from ifconfig wg0 destroy (65.91 KB, image/png)
2021-03-07 20:58 UTC, Bernhard Froehlich
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Bernhard Froehlich freebsd_committer freebsd_triage 2021-03-07 20:32:46 UTC
Created attachment 223074 [details]
core.txt

If a wireguard interface is created the second time a reproducible panic occurs with 13.0-RC1/amd64. It works fine the first time but it looks like there is something left behind even after ifconfig wg0 down + destroy.

The commands I used are:

ifconfig wg0 create
/usr/local/bin/wg setconf wg0 /usr/local/etc/wireguard-tools/wg0.conf
ifconfig wg0 inet 10.7.0.10/24 alias
ifconfig wg0 up

ifconfig wg0 down
ifconfig wg0 destroy

ifconfig wg0 create
/usr/local/bin/wg setconf wg0 /usr/local/etc/wireguard-tools/wg0.conf
ifconfig wg0 inet 10.7.0.10/24 alias
ifconfig wg0 up => panic


kgdb /usr/lib/debug/boot/kernel/kernel.debug vmcore.6 
GNU gdb (GDB) 10.1 [GDB v10.1 for FreeBSD]
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd13.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib/debug/boot/kernel/kernel.debug...

Unread portion of the kernel message buffer:
<6>wg0: sc=0xfffff80004a13800
<6>wg0: link state changed to UP
<6>wg0: link state changed to DOWN
<6>wg0: sc=0xfffff80004a13800
<6>wg0: link state changed to UP


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xffffffff02fafe60
fault code              = supervisor write data, page not present
instruction pointer     = 0x20:0xffffffff80d1ba7e
stack pointer           = 0x0:0xfffffe00011f9780
frame pointer           = 0x0:0xfffffe00011f9780
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (irq51: virtio_pci1)
trap number             = 12
panic: page fault
cpuid = 0
time = 1615148700
KDB: stack backtrace:
#0 0xffffffff80c57095 at kdb_backtrace+0x65
#1 0xffffffff80c09c61 at vpanic+0x181
#2 0xffffffff80c09ad3 at panic+0x43
#3 0xffffffff8108a187 at trap_fatal+0x387
#4 0xffffffff8108a1df at trap_pfault+0x4f
#5 0xffffffff8108983d at trap+0x27d
#6 0xffffffff81060b68 at calltrap+0x8
#7 0xffffffff8231048a at wg_input+0xfa
#8 0xffffffff80ddebfa at udp_append+0x5a
#9 0xffffffff80dde8fa at udp_input+0x73a
#10 0xffffffff80daeff5 at ip_input+0x125
#11 0xffffffff80d3ec9a at netisr_dispatch_src+0xca
#12 0xffffffff80d23428 at ether_demux+0x148
#13 0xffffffff80d247ac at ether_nh_input+0x34c
#14 0xffffffff80d3ec9a at netisr_dispatch_src+0xca
#15 0xffffffff80d23879 at ether_input+0x69
#16 0xffffffff80a466a4 at vtnet_rxq_eof+0x7d4
#17 0xffffffff80a45dc7 at vtnet_rx_vq_process+0xb7
Uptime: 1m2s
Dumping 119 out of 478 MB:..14%..27%..41%..54%..67%..81%..94%

__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
55      /usr/src/sys/amd64/include/pcpu_aux.h: No such file or directory.
Comment 1 Bernhard Froehlich freebsd_committer freebsd_triage 2021-03-07 20:33:33 UTC
Created attachment 223075 [details]
info
Comment 2 Bernhard Froehlich freebsd_committer freebsd_triage 2021-03-07 20:58:07 UTC
Created attachment 223076 [details]
panic from ifconfig wg0 destroy

On another machine (also 13.0-RC1/amd64) which has slightly different wireguard config I see a reproducible panic that looks very similar to the original bug report but happens on "ifconfig wg0 destroy".
Comment 3 Kyle Evans freebsd_committer freebsd_triage 2021-03-09 04:19:09 UTC
grehan@ indicated that this should be fixed by https://cgit.freebsd.org/src/commit/?id=9705c012c1f0c7a9ac0f6c8618bebe3e66280a8a which made it only just in time for -rc2.
Comment 4 Bernhard Froehlich freebsd_committer freebsd_triage 2021-03-13 12:21:47 UTC
I can confirm that it works fine in 13.0-RC2. Thanks!