kern/176471: [xen] xn driver crash on detach

[Roger Pau Monné]

The following reply was made to PR kern/176471; it has been noted by GNATS.

From: =?ISO-8859-1?Q?Roger_Pau_Monn=E9?= <roger.pau at citrix.com>
To: <bug-followup at FreeBSD.org>, <pete at helenius.fi>
Cc:  
Subject: Re: kern/176471: [xen] xn driver crash on detach
Date: Thu, 28 Feb 2013 18:58:44 +0100

 Hi (again),
 
 I've just realized the previous patch also crashed when trying to 
 detach an interface that's up and running, the following patch allows 
 to detach the interface while running without crashing the FreeBSD 
 kernel.
 
 Also, what do you mean by "changing configuration of xn network"?
 
 ---
 From 9c0097ed4775c68769049c61e474ddb62cc11d1f Mon Sep 17 00:00:00 2001
 From: Roger Pau Monne <roger.pau at citrix.com>
 Date: Thu, 28 Feb 2013 17:43:34 +0100
 Subject: [PATCH] xen-netfront: fix detach of network interfaces
 
 Remove all the media and the interface when detaching it. Prevents the
 following panic when detaching an interface (xl network-detach freebsd
 1)
 
 xn1: detached
 
 Fatal trap 12: page fault while in kernel mode
 cpuid = 3; apic id = 06
 fault virtual address	= 0xffffff80028ff2a0
 fault code		= supervisor read data, page not present
 instruction pointer	= 0x20:0xffffffff809653af
 stack pointer	        = 0x28:0xffffff8117cb4940
 frame pointer	        = 0x28:0xffffff8117cb4980
 code segment		= base 0x0, limit 0xfffff, type 0x1b
 			= DPL 0, pres 1, long 1, def32 0, gran 1
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process		= 699 (devd)
 [ thread pid 699 tid 100107 ]
 Stopped at      ifmedia_ioctl+0x3f:     movq    0x8(%r12),%rcx
 db> trace
 Tracing pid 706 tid 100059 td 0xfffffe0006b69480
 ifmedia_ioctl() at ifmedia_ioctl+0x3f/frame 0xffffff80f774c980
 ifioctl() at ifioctl+0xeb7/frame 0xffffff80f774ca40
 kern_ioctl() at kern_ioctl+0x1ce/frame 0xffffff80f774ca90
 sys_ioctl() at sys_ioctl+0x11f/frame 0xffffff80f774cae0
 amd64_syscall() at amd64_syscall+0x265/frame 0xffffff80f774cbf0
 Xfast_syscall() at Xfast_syscall+0xfb/frame 0xffffff80f774cbf0
 --- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x44c60a, rsp = 0x7fffffffd678, rbp = 0x7fffffffd750 ---
 
 PR: 176471
 ---
  sys/dev/xen/netfront/netfront.c |    7 +++++++
  1 files changed, 7 insertions(+), 0 deletions(-)
 
 diff --git a/sys/dev/xen/netfront/netfront.c b/sys/dev/xen/netfront/netfront.c
 index 88641e3..3a8b8ea 100644
 --- a/sys/dev/xen/netfront/netfront.c
 +++ b/sys/dev/xen/netfront/netfront.c
 @@ -2171,7 +2171,14 @@ netfront_detach(device_t dev)
  static void
  netif_free(struct netfront_info *info)
  {
 +	XN_LOCK(info);
 +	xn_stop(info);
 +	XN_UNLOCK(info);
 +	callout_drain(&info->xn_stat_ch);
  	netif_disconnect_backend(info);
 +	ifmedia_removeall(&info->sc_media);
 +	ether_ifdetach(info->xn_ifp);
 +	if_free(info->xn_ifp);
  #if 0
  	close_netdev(info);
  #endif
 -- 
 1.7.7.5 (Apple Git-26)