svn commit: r346300 - in stable: 11/sys/net 12/sys/net

[Kyle Evans]

Author: kevans
Date: Tue Apr 16 20:56:51 2019
New Revision: 346300
URL: https://svnweb.freebsd.org/changeset/base/346300

Log:
  MFC r345180, r345187: if_bridge(4): Fix module teardown
  
  r345180: if_bridge(4): Fix module teardown
  
  bridge_rtnode_zone still has outstanding allocations at the time of
  destruction in the current model because all of the interface teardown
  happens in a VNET_SYSUNINIT, -after- the MOD_UNLOAD has already been
  processed.  The SYSUNINIT triggers destruction of the interfaces, which then
  attempts to free the memory from the zone that's already been destroyed, and
  we hit a panic.
  
  Solve this by virtualizing the uma_zone we allocate the rtnodes from to fix
  the ordering. bridge_rtable_fini should also take care to flush any
  remaining routes that weren't taken care of when dynamic routes were flushed
  in bridge_stop.
  
  r345187: bridge: Fix STP-related panic
  
  After r345180 we need to have the appropriate vnet context set to delete an
  rtnode in bridge_rtnode_destroy().
  That's usually the case, but not when it's called by the STP code (through
  bstp_notify_rtage()).
  
  We have to set the vnet context in bridge_rtable_expire() just as we do in the
  other STP callback bridge_state_change().

Modified:
  stable/11/sys/net/if_bridge.c
Directory Properties:
  stable/11/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/12/sys/net/if_bridge.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/11/sys/net/if_bridge.c
==============================================================================
--- stable/11/sys/net/if_bridge.c	Tue Apr 16 20:41:04 2019	(r346299)
+++ stable/11/sys/net/if_bridge.c	Tue Apr 16 20:56:51 2019	(r346300)
@@ -233,7 +233,8 @@ static eventhandler_tag bridge_detach_cookie;
 
 int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 
-uma_zone_t bridge_rtnode_zone;
+static VNET_DEFINE(uma_zone_t, bridge_rtnode_zone);
+#define	V_bridge_rtnode_zone	VNET(bridge_rtnode_zone)
 
 static int	bridge_clone_create(struct if_clone *, int, caddr_t);
 static void	bridge_clone_destroy(struct ifnet *);
@@ -526,6 +527,9 @@ static void
 vnet_bridge_init(const void *unused __unused)
 {
 
+	V_bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
+	    sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
+	    UMA_ALIGN_PTR, 0);
 	BRIDGE_LIST_LOCK_INIT();
 	LIST_INIT(&V_bridge_list);
 	V_bridge_cloner = if_clone_simple(bridge_name,
@@ -541,6 +545,7 @@ vnet_bridge_uninit(const void *unused __unused)
 	if_clone_detach(V_bridge_cloner);
 	V_bridge_cloner = NULL;
 	BRIDGE_LIST_LOCK_DESTROY();
+	uma_zdestroy(V_bridge_rtnode_zone);
 }
 VNET_SYSUNINIT(vnet_bridge_uninit, SI_SUB_PSEUDO, SI_ORDER_ANY,
     vnet_bridge_uninit, NULL);
@@ -551,9 +556,6 @@ bridge_modevent(module_t mod, int type, void *data)
 
 	switch (type) {
 	case MOD_LOAD:
-		bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
-		    sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
-		    UMA_ALIGN_PTR, 0);
 		bridge_input_p = bridge_input;
 		bridge_output_p = bridge_output;
 		bridge_dn_p = bridge_dummynet;
@@ -565,7 +567,6 @@ bridge_modevent(module_t mod, int type, void *data)
 	case MOD_UNLOAD:
 		EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 		    bridge_detach_cookie);
-		uma_zdestroy(bridge_rtnode_zone);
 		bridge_input_p = NULL;
 		bridge_output_p = NULL;
 		bridge_dn_p = NULL;
@@ -737,6 +738,9 @@ bridge_clone_destroy(struct ifnet *ifp)
 		bridge_delete_span(sc, bif);
 	}
 
+	/* Tear down the routing table. */
+	bridge_rtable_fini(sc);
+
 	BRIDGE_UNLOCK(sc);
 
 	callout_drain(&sc->sc_brcallout);
@@ -749,9 +753,6 @@ bridge_clone_destroy(struct ifnet *ifp)
 	ether_ifdetach(ifp);
 	if_free(ifp);
 
-	/* Tear down the routing table. */
-	bridge_rtable_fini(sc);
-
 	BRIDGE_LOCK_DESTROY(sc);
 	free(sc, M_DEVBUF);
 }
@@ -2664,7 +2665,7 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t
 		 * initialize the expiration time and Ethernet
 		 * address.
 		 */
-		brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
+		brt = uma_zalloc(V_bridge_rtnode_zone, M_NOWAIT | M_ZERO);
 		if (brt == NULL)
 			return (ENOMEM);
 
@@ -2677,7 +2678,7 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t
 		brt->brt_vlan = vlan;
 
 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
-			uma_zfree(bridge_rtnode_zone, brt);
+			uma_zfree(V_bridge_rtnode_zone, brt);
 			return (error);
 		}
 		brt->brt_dst = bif;
@@ -2761,11 +2762,14 @@ bridge_timer(void *arg)
 
 	BRIDGE_LOCK_ASSERT(sc);
 
+	/* Destruction of rtnodes requires a proper vnet context */
+	CURVNET_SET(sc->sc_ifp->if_vnet);
 	bridge_rtage(sc);
 
 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
 		callout_reset(&sc->sc_brcallout,
 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
+	CURVNET_RESTORE();
 }
 
 /*
@@ -2881,6 +2885,7 @@ bridge_rtable_fini(struct bridge_softc *sc)
 
 	KASSERT(sc->sc_brtcnt == 0,
 	    ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
+	bridge_rtflush(sc, 1);
 	free(sc->sc_rthash, M_DEVBUF);
 }
 
@@ -3023,7 +3028,7 @@ bridge_rtnode_destroy(struct bridge_softc *sc, struct 
 	LIST_REMOVE(brt, brt_list);
 	sc->sc_brtcnt--;
 	brt->brt_dst->bif_addrcnt--;
-	uma_zfree(bridge_rtnode_zone, brt);
+	uma_zfree(V_bridge_rtnode_zone, brt);
 }
 
 /*
@@ -3037,6 +3042,7 @@ bridge_rtable_expire(struct ifnet *ifp, int age)
 	struct bridge_softc *sc = ifp->if_bridge;
 	struct bridge_rtnode *brt;
 
+	CURVNET_SET(ifp->if_vnet);
 	BRIDGE_LOCK(sc);
 
 	/*
@@ -3055,6 +3061,7 @@ bridge_rtable_expire(struct ifnet *ifp, int age)
 		}
 	}
 	BRIDGE_UNLOCK(sc);
+	CURVNET_RESTORE();
 }
 
 /*