From nobody@FreeBSD.org  Wed Apr 22 03:50:44 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 5D4E0106564A
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 22 Apr 2009 03:50:44 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 4B0298FC0A
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 22 Apr 2009 03:50:44 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n3M3oiOu066816
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 22 Apr 2009 03:50:44 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n3M3oi59066815;
	Wed, 22 Apr 2009 03:50:44 GMT
	(envelope-from nobody)
Message-Id: <200904220350.n3M3oi59066815@www.freebsd.org>
Date: Wed, 22 Apr 2009 03:50:44 GMT
From: Leonardo Santagostini <lsantagostini@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Killing tun0 iface ssh tunnel causes Panic String: page fault
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         133902
>Category:       kern
>Synopsis:       [tun] Killing tun0 iface ssh tunnel causes Panic String: page fault
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    bz
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 22 04:00:03 UTC 2009
>Closed-Date:    Fri Oct 15 09:45:40 UTC 2010
>Last-Modified:  Fri Oct 15 09:45:40 UTC 2010
>Originator:     Leonardo Santagostini
>Release:        FreeBSD 7.0-RELEASE (GENERIC)
>Organization:
N/A
>Environment:
FreeBSD cobra4.local 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008     root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
When doing a ifconfig tun0 destroy on an interface which belongs to a ssh tunnel, causes system reboot.


>How-To-Repeat:
doing a ssh tunnel between 2 freebsd boxes.

machine A
  ssh -w 0:0 "machine B" true (after setting rsa authentication)
  ifconfig tun0 12.34.56.78 12.34.56.79

machine B
  ifconfig tun0 12.34.56.79 12.34.56.78

On machine A after the tunnel was created when a ifconfig tun0 it hangs the system

>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Wed Apr 22 06:51:05 UTC 2009 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=133902 

From: Mikolaj Golub <to.my.trociny@gmail.com>
To: bug-followup@FreeBSD.org
Cc: freebsd-bugs@FreeBSD.org,  freebsd-net@FreeBSD.org, lsantagostini@gmail.com
Subject: Re: kern/133902: [tun] Killing tun0 iface ssh tunnel causes Panic String: page fault
Date: Thu, 23 Apr 2009 17:14:02 +0300

 I have asked Leonardo to provide more info and backtrace.
 
 So here is backtrace:
 
 cobra4# kgdb /boot/kernel/kernel.symbols /var/crash/vmcore.0
 [GDB will not be able to debug user-mode threads:
 /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-marcel-freebsd".
 
 Unread portion of the kernel message buffer:
 
 
 Fatal trap 12: page fault while in kernel mode
 cpuid = 0; apic id = 00
 fault virtual address   = 0x65656c7b
 fault code              = supervisor write, page not present
 instruction pointer     = 0x20:0xc0786e00
 stack pointer           = 0x28:0xe958fac4
 frame pointer           = 0x28:0xe958fac4
 code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
 processor eflags        = interrupt enabled, resume, IOPL = 0
 current process         = 66873 (ssh)
 trap number             = 12
 panic: page fault
 cpuid = 1
 Uptime: 54d11h21m54s
 Physical memory: 2023 MB
 Dumping 277 MB: 262 246 230 214 198 182 166 150 134 118 102 86 70 54 38 22 6
 
 #0  doadump () at pcpu.h:195
 195     pcpu.h: No such file or directory.
         in pcpu.h
 (kgdb) backtrace
 #0  doadump () at pcpu.h:195
 #1  0xc0754457 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
 #2  0xc0754719 in panic (fmt=Variable "fmt" is not available.
 ) at /usr/src/sys/kern/kern_shutdown.c:563
 #3  0xc0a4905c in trap_fatal (frame=0xe958fa84, eva=1701145723) at
 /usr/src/sys/i386/i386/trap.c:899
 #4  0xc0a492e0 in trap_pfault (frame=0xe958fa84, usermode=0,
 eva=1701145723) at /usr/src/sys/i386/i386/trap.c:812
 #5  0xc0a49c8c in trap (frame=0xe958fa84) at /usr/src/sys/i386/i386/trap.c:490
 #6  0xc0a2fc0b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
 #7  0xc0786e00 in clear_selinfo_list (td=0xca3fc840) at
 /usr/src/sys/kern/sys_generic.c:1065
 #8  0xc0788efc in kern_select (td=0xca3fc840, nd=8, fd_in=0x284010b8,
 fd_ou=0x284010bc, fd_ex=0x0, tvp=0x0) at
 /usr/src/sys/kern/sys_generic.c:794
 #9  0xc07890de in select (td=0xca3fc840, uap=0xe958fcfc) at
 /usr/src/sys/kern/sys_generic.c:663
 #10 0xc0a49635 in syscall (frame=0xe958fd38) at
 /usr/src/sys/i386/i386/trap.c:1035
 #11 0xc0a2fc70 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196
 #12 0x00000033 in ?? ()
 Previous frame inner to this frame (corrupt stack?)
 (kgdb)
 
 The system panics on
 
 ifconfig tun0 destroy
 
 This issue is related to kern/116837.
 
 Leonardo, you can try the patch attached to that pr.
 
 -- 
 Mikolaj Golub

From: Mikolaj Golub <to.my.trociny@gmail.com>
To: bug-followup@FreeBSD.org
Cc: Leonardo Santagostini <lsantagostini@gmail.com>, "Bjoern A. Zeeb" <bz@FreeBSD.org>, freebsd-net@FreeBSD.org
Subject: Re: kern/133902: [tun] Killing tun0 iface ssh tunnel causes Panic String: page fault
Date: Mon, 03 May 2010 10:41:34 +0300

 This pr is duplicate of kern/116837 so I think we can close it. The problem is
 fixed in CURRENT and 8-STABLE and there is a patch for 7-STABLE (see
 kern/116837 for details).
 
 -- 
 Mikolaj Golub
State-Changed-From-To: open->closed 
State-Changed-By: bz 
State-Changed-When: Fri Oct 15 09:45:00 UTC 2010 
State-Changed-Why:  
Duplicate of PR kern/116837. 


Responsible-Changed-From-To: freebsd-net->bz 
Responsible-Changed-By: bz 
Responsible-Changed-When: Fri Oct 15 09:45:00 UTC 2010 
Responsible-Changed-Why:  
Take in case of follow-ups. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=133902 
>Unformatted:
