kern/176471: [xen] xn driver crash on detach

[Roger Pau Monné]

The following reply was made to PR kern/176471; it has been noted by GNATS.

From: =?ISO-8859-1?Q?Roger_Pau_Monn=E9?= <roger.pau at citrix.com>
To: <bug-followup at FreeBSD.org>, <pete at helenius.fi>
Cc:  
Subject: Re: kern/176471: [xen] xn driver crash on detach
Date: Thu, 28 Feb 2013 18:00:12 +0100

 Hello,
 
 I've been able to reproduce this bug with Xen unstable, here is a fix 
 for it.
 
 ---
 From 6206137f80cbe5812294b1733a86f28e5cdc01bd Mon Sep 17 00:00:00 2001
 From: Roger Pau Monne <roger.pau at citrix.com>
 Date: Thu, 28 Feb 2013 17:43:34 +0100
 Subject: [PATCH] xen-netfront: fix detach of network interfaces
 
 Remove all the media and the interface when detaching it. Prevents the
 following panic when detaching an interface (xl network-detach freebsd
 1)
 
 xn1: detached
 
 Fatal trap 12: page fault while in kernel mode
 cpuid = 3; apic id = 06
 fault virtual address	= 0xffffff80028ff2a0
 fault code		= supervisor read data, page not present
 instruction pointer	= 0x20:0xffffffff809653af
 stack pointer	        = 0x28:0xffffff8117cb4940
 frame pointer	        = 0x28:0xffffff8117cb4980
 code segment		= base 0x0, limit 0xfffff, type 0x1b
 			= DPL 0, pres 1, long 1, def32 0, gran 1
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process		= 699 (devd)
 [ thread pid 699 tid 100107 ]
 Stopped at      ifmedia_ioctl+0x3f:     movq    0x8(%r12),%rcx
 db> trace
 Tracing pid 706 tid 100059 td 0xfffffe0006b69480
 ifmedia_ioctl() at ifmedia_ioctl+0x3f/frame 0xffffff80f774c980
 ifioctl() at ifioctl+0xeb7/frame 0xffffff80f774ca40
 kern_ioctl() at kern_ioctl+0x1ce/frame 0xffffff80f774ca90
 sys_ioctl() at sys_ioctl+0x11f/frame 0xffffff80f774cae0
 amd64_syscall() at amd64_syscall+0x265/frame 0xffffff80f774cbf0
 Xfast_syscall() at Xfast_syscall+0xfb/frame 0xffffff80f774cbf0
 --- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x44c60a, rsp = 0x7fffffffd678, rbp = 0x7fffffffd750 ---
 
 PR: 176471
 ---
  sys/dev/xen/netfront/netfront.c |    3 +++
  1 files changed, 3 insertions(+), 0 deletions(-)
 
 diff --git a/sys/dev/xen/netfront/netfront.c b/sys/dev/xen/netfront/netfront.c
 index 88641e3..167fd12 100644
 --- a/sys/dev/xen/netfront/netfront.c
 +++ b/sys/dev/xen/netfront/netfront.c
 @@ -2172,6 +2172,9 @@ static void
  netif_free(struct netfront_info *info)
  {
  	netif_disconnect_backend(info);
 +	ifmedia_removeall(&info->sc_media);
 +	ether_ifdetach(info->xn_ifp);
 +	if_free(info->xn_ifp);
  #if 0
  	close_netdev(info);
  #endif
 -- 
 1.7.7.5 (Apple Git-26)