Re: kern/49682: reproducable panic when detaching bge (IPv6 related)

[christos%zoulas.com@localhost (Christos Zoulas)]

The following reply was made to PR kern/49682; it has been noted by GNATS.

From: christos%zoulas.com@localhost (Christos Zoulas)
To: Martin Husemann <martin%duskware.de@localhost>
Cc: gnats-bugs%NetBSD.org@localhost
Subject: Re: kern/49682: reproducable panic when detaching bge (IPv6 related)
Date: Sun, 22 Feb 2015 16:14:50 -0500

 On Feb 22, 10:06pm, martin%duskware.de@localhost (Martin Husemann) wrote:
 -- Subject: Re: kern/49682: reproducable panic when detaching bge (IPv6 relat
 
 | The last time we have a chance to successfully clean this up is before
 | dom_ifdetach frees the adress family specific data - so we need to make
 | sure nd6_purge is called from there as well, and gets the info explicitly
 | passed.
 | 
 | The patch below works for me.
 | 
 | Martin
 
 See below:
 
 | --- in6_ifattach.c	14 Nov 2014 17:34:23 -0000	1.94
 | +++ in6_ifattach.c	22 Feb 2015 21:04:15 -0000
 | @@ -847,8 +847,9 @@ in6_ifdetach(struct ifnet *ifp)
 |  	/* remove ip6_mrouter stuff */
 |  	ip6_mrouter_detach(ifp);
 |  
 | -	/* remove neighbor management table */
 | -	nd6_purge(ifp);
 | +	/* remove neighbor management table, if ND data is still available */
 | +	if (ifp->if_afdata[AF_INET6] != NULL)
 | +		nd6_purge(ifp, ifp->if_afdata[AF_INET6]);
 
 Why don't you do nd6_purge(ifp, NULL); here.
 
 |  
 |  	/* XXX this code is duplicated in in6_purgeif() --dyoung */
 |  	/* nuke any of IPv6 addresses we have */
 | @@ -919,7 +920,8 @@ in6_ifdetach(struct ifnet *ifp)
 |  	 * prefixes after removing all addresses above.
 |  	 * (Or can we just delay calling nd6_purge until at this point?)
 |  	 */
 | -	nd6_purge(ifp);
 | +	if (ifp->if_afdata[AF_INET6] != NULL)
 | +		nd6_purge(ifp, ifp->if_afdata[AF_INET6]);
 
 And here.
 
 |  }
 |  
 |  int
 | Index: nd6.c
 | ===================================================================
 | RCS file: /cvsroot/src/sys/netinet6/nd6.c,v
 | retrieving revision 1.157
 | diff -u -p -r1.157 nd6.c
 | --- nd6.c	17 Feb 2015 15:14:28 -0000	1.157
 | +++ nd6.c	22 Feb 2015 21:04:15 -0000
 | @@ -205,10 +205,11 @@ nd6_ifattach(struct ifnet *ifp)
 |  }
 |  
 |  void
 | -nd6_ifdetach(struct nd_ifinfo *nd)
 | +nd6_ifdetach(struct ifnet *ifp, struct in6_ifextra *ext)
 |  {
 |  
 | -	free(nd, M_IP6NDP);
 | +	nd6_purge(ifp, ext);
 | +	free(ext->nd_ifinfo, M_IP6NDP);
 |  }
 |  
 |  void
 | @@ -556,7 +557,7 @@ nd6_timer(void *ignored_arg)
 |  	
 |  	TAILQ_FOREACH_SAFE(dr, &nd_defrouter, dr_entry, next_dr) {
 |  		if (dr->expire && dr->expire < time_second) {
 | -			defrtrlist_del(dr);
 | +			defrtrlist_del(dr, NULL);
 |  		}
 |  	}
 |  
 | @@ -746,13 +747,21 @@ nd6_accepts_rtadv(const struct nd_ifinfo
 |   * ifp goes away.
 |   */
 |  void
 | -nd6_purge(struct ifnet *ifp)
 | +nd6_purge(struct ifnet *ifp, struct in6_ifextra *ext)
 |  {
 |  	struct llinfo_nd6 *ln, *nln;
 |  	struct nd_defrouter *dr, *ndr;
 |  	struct nd_prefix *pr, *npr;
 |  
 |  	/*
 | +	 * During detach, the ND info might be already removed, but
 | +	 * then is explitly passed as argument.
 | +	 * Otherwise get it from ifp->if_afdata.
 | +	 */
 | +	if (ext == NULL)
 | +		ext = ifp->if_afdata[AF_INET6];
 | +
 
 And here add:
 
 	if (ext == NULL)
 		return;
 
 like you did below in defrtrlist_del?
 
 
 christos