kern/122794: [lagg] Kernel panic after brings lagg(8) up if NICs are not bringed up before

[Лотц Антон]

The following reply was made to PR kern/122794; it has been noted by GNATS.

From: =?koi8-r?Q?=EC=CF=D4=C3_=E1=CE=D4=CF=CE_?= =?koi8-r?Q?=F7=CC=C1=C4=C9=CD=C9=D2=CF=D7=C9=DE?= <A.V.Lotts at chelindbank.ru>
To: bug-followup at FreeBSD.org, robhass at gmail.com
Cc:  
Subject: Re: kern/122794: [lagg] Kernel panic after brings lagg(8) up if
	NICs are not bringed up before
Date: Thu, 18 Sep 2008 09:08:56 +0600

 --=-pYK/Vjp63XwXQm/bEEhQ
 Content-Type: text/plain
 Content-Transfer-Encoding: 7bit
 
 Hello
 
 I have found similar problem: kernel panic occurs if you try to use lagg
 interface without any laggport configured.
 
 Is this the same problem?
 
 There are at least two way to reproduce problem:
 1. Boot to single-user mode and issue commands
 	ifconfig lagg0 create
 	ifconfig lagg0 laggproto loadbalance  # does it really need to crash?
 	ifconfig lagg0 inet 10.10.10.10 netmask 255.255.255.0
 
    Kernel panic follows (possible need to send a packet)
 
 Fatal trap 18: integer divide fault while in kernel mode
 cpuid = 0; apic id = 00
 instruction pointer     = 0x20:0x80441f38
 stack pointer           = 0x28:0xec046988
 frame pointer           = 0x28:0xec04699c
 code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
 processor eflags        = interrupt enabled, resume, IOPL = 0
 current process         = 57 (ifconfig)
 trap number             = 18
 panic: integer divide fault
 cpuid = 0
 Uptime: 3m5s
 Cannot dump. No dump device defined.
 Automatic reboot in 15 seconds - press a key on the console to abort
 
 
 2. Boot to any network-enabled mode and remove all laggport from the
 lagg interface. Kernel panic follows (possible need to send a packet).
 
 	ifconfig lagg0 -laggport bce0
 	ping 10.10.10.11
 Fatal trap 18: integer divide fault while in kernel mode
 cpuid = 0; apic id = 00
 instruction pointer     = 0x20:0x80441f38
 stack pointer           = 0x28:0xec0a19ec
 frame pointer           = 0x28:0xec0a1a00
 code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
 processor eflags        = interrupt enabled, resume, IOPL = 0
 current process         = 52383 (ping)
 trap number             = 18
 panic: integer divide fault
 cpuid = 0
 Uptime: 13m53s
 Physical memory: 4086 MB
 Dumping 128 MB: 113 97 81 65 49 33 17 1
 Dump complete
 Automatic reboot in 15 seconds - press a key on the console to abort
 
 
 Possible solution could be following:
 
 *** if_lagg.c-orig	Thu Sep 18 08:29:25 2008
 --- if_lagg.c	Thu Sep 18 08:32:39 2008
 ***************
 *** 1403,1408 ****
 --- 1403,1412 ----
   	uint32_t p;
   
   	p = atomic_fetchadd_32(&sc->sc_seq, 1);
 + 	if (sc->sc_count == 0) {
 + 		m_freem(m);
 + 		return (ENOENT);
 + 	}
   	p %= sc->sc_count;
   	lp = SLIST_FIRST(&sc->sc_ports);
   	while (p--)
 ***************
 *** 1580,1585 ****
 --- 1584,1593 ----
   	int idx;
   
   	p = lagg_hashmbuf(m, lb->lb_key);
 + 	if (sc->sc_count == 0) {
 + 		m_freem(m);
 + 		return (ENOENT);
 + 	}
   	if ((idx = p % sc->sc_count) >= LAGG_MAX_PORTS) {
   		m_freem(m);
   		return (EINVAL);
 
 
 I'm not a qualified kernel-hacker so please provide a better solution.
 
 Regards
 --
 Anton Lotts
 
 --=-pYK/Vjp63XwXQm/bEEhQ
 Content-Disposition: attachment; filename=lagg.patch
 Content-Type: text/x-patch; name=lagg.patch; charset=utf-8
 Content-Transfer-Encoding: 7bit
 
 *** if_lagg.c-orig	Thu Sep 18 08:29:25 2008
 --- if_lagg.c	Thu Sep 18 08:32:39 2008
 ***************
 *** 1403,1408 ****
 --- 1403,1412 ----
   	uint32_t p;
   
   	p = atomic_fetchadd_32(&sc->sc_seq, 1);
 + 	if (sc->sc_count == 0) {
 + 		m_freem(m);
 + 		return (ENOENT);
 + 	}
   	p %= sc->sc_count;
   	lp = SLIST_FIRST(&sc->sc_ports);
   	while (p--)
 ***************
 *** 1580,1585 ****
 --- 1584,1593 ----
   	int idx;
   
   	p = lagg_hashmbuf(m, lb->lb_key);
 + 	if (sc->sc_count == 0) {
 + 		m_freem(m);
 + 		return (ENOENT);
 + 	}
   	if ((idx = p % sc->sc_count) >= LAGG_MAX_PORTS) {
   		m_freem(m);
   		return (EINVAL);
 
 --=-pYK/Vjp63XwXQm/bEEhQ--