ALPHA3 panic with ipfw+dummynet and gif/gre tunnels

[Alan Somers]

On Thu, Jun 16, 2016 at 7:03 PM, Mark Felder <feld at freebsd.org> wrote:
> Hello,
>
> I can pretty reliably panic CURRENT by creating/destroying gif and gre
> interfaces used for IPv6 tunnels. I'm uploading the dump, kernel.debug,
> and kernel in a tarball here:
>
> https://feld.me/freebsd/crash/r301929.tgz
>
> It's still uploading so you might end up with an incomplete download if
> you fetch it now. Here's the sha256 of it:
>
> 1e9fddad1da3bac2b11c51a18c7dad48eb9259acf844f35f5eb40630ca84de64
> r301929.tgz
>
>
> Here's the backtrace:
>
> (kgdb) bt
> #0  doadump (textdump=0) at pcpu.h:221
> #1  0xffffffff80391fab in db_dump (dummy=<value optimized out>,
> dummy2=false, dummy3=0, dummy4=0x0) at /usr/src/sys/ddb/db_command.c:533
> #2  0xffffffff80391da9 in db_command (cmd_table=<value optimized out>)
> at /usr/src/sys/ddb/db_command.c:440
> #3  0xffffffff80391b04 in db_command_loop () at
> /usr/src/sys/ddb/db_command.c:493
> #4  0xffffffff80394a3b in db_trap (type=<value optimized out>,
> code=<value optimized out>) at /usr/src/sys/ddb/db_main.c:251
> #5  0xffffffff80a88913 in kdb_trap (type=<value optimized out>,
> code=<value optimized out>, tf=<value optimized out>) at
> /usr/src/sys/kern/subr_kdb.c:654
> #6  0xffffffff80eb8331 in trap_fatal (frame=0xfffffe0122831770, eva=26)
> at /usr/src/sys/amd64/amd64/trap.c:836
> #7  0xffffffff80eb857d in trap_pfault (frame=0xfffffe0122831770,
> usermode=0) at /usr/src/sys/amd64/amd64/trap.c:691
> #8  0xffffffff80eb7a64 in trap (frame=0xfffffe0122831770) at
> /usr/src/sys/amd64/amd64/trap.c:442
> #9  0xffffffff80e97f91 in calltrap () at
> /usr/src/sys/amd64/amd64/exception.S:236
> #10 0xffffffff80c57ebc in ip6_output (m0=<value optimized out>,
> opt=<value optimized out>, ro=<value optimized out>, flags=<value
> optimized out>, im6o=0x0, ifpp=0x0, inp=<value optimized out>)
>     at /usr/src/sys/netinet6/ip6_output.c:1060
> #11 0xffffffff82661fd2 in dummynet_send (m=<value optimized out>) at
> /usr/src/sys/modules/dummynet/../../netpfil/ipfw/ip_dn_io.c:800
> #12 0xffffffff82661890 in dummynet_task (context=<value optimized out>,
> pending=<value optimized out>) at
> /usr/src/sys/modules/dummynet/../../netpfil/ipfw/ip_dn_io.c:746
> #13 0xffffffff80a9a1ac in taskqueue_run_locked (queue=<value optimized
> out>) at /usr/src/sys/kern/subr_taskqueue.c:465
> #14 0xffffffff80a9acf8 in taskqueue_thread_loop (arg=<value optimized
> out>) at /usr/src/sys/kern/subr_taskqueue.c:719
> #15 0xffffffff80a0b3e4 in fork_exit (callout=0xffffffff80a9ac70
> <taskqueue_thread_loop>, arg=0xffffffff8266c8a8,
> frame=0xfffffe0122831c00) at /usr/src/sys/kern/kern_fork.c:1038
> #16 0xffffffff80e984ce in fork_trampoline () at
> /usr/src/sys/amd64/amd64/exception.S:611
> #17 0x0000000000000000 in ?? ()
> Current language:  auto; currently minimal
>
>
> --
>   Mark Felder
>   ports-secteam member
>   feld at FreeBSD.org
> _______________________________________________

Yeah, FreeBSD has a problem with destroying any kind of cloned
interface.  How many times, on average, do you need to destroy one
before you get the panic?