From nobody@FreeBSD.org  Tue Aug  6 03:31:38 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by hub.freebsd.org (Postfix) with ESMTP id 1E247A33
	for <freebsd-gnats-submit@FreeBSD.org>; Tue,  6 Aug 2013 03:31:38 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from oldred.freebsd.org (oldred.freebsd.org [8.8.178.121])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.freebsd.org (Postfix) with ESMTPS id 0AEB0254C
	for <freebsd-gnats-submit@FreeBSD.org>; Tue,  6 Aug 2013 03:31:38 +0000 (UTC)
Received: from oldred.freebsd.org ([127.0.1.6])
	by oldred.freebsd.org (8.14.5/8.14.7) with ESMTP id r763VbUA036265
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 6 Aug 2013 03:31:37 GMT
	(envelope-from nobody@oldred.freebsd.org)
Received: (from nobody@localhost)
	by oldred.freebsd.org (8.14.5/8.14.5/Submit) id r763Vbtw036264;
	Tue, 6 Aug 2013 03:31:37 GMT
	(envelope-from nobody)
Message-Id: <201308060331.r763Vbtw036264@oldred.freebsd.org>
Date: Tue, 6 Aug 2013 03:31:37 GMT
From: Brandon Gooch <jamesbrandongooch@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Loading tun(4) from loader.conf(5) causes panic when kernel already contains device tun(4)
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         181078
>Category:       kern
>Synopsis:       Loading tun(4) from loader.conf(5) causes panic when kernel already contains device tun(4)
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    markj
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Aug 06 03:40:00 UTC 2013
>Closed-Date:    Thu Aug 15 04:13:19 UTC 2013
>Last-Modified:  Thu Aug 15 04:13:19 UTC 2013
>Originator:     Brandon Gooch
>Release:        10-CURRENT
>Organization:
>Environment:
FreeBSD m6500.m6500 10.0-CURRENT FreeBSD 10.0-CURRENT #3 r253950M: Mon Aug  5 21:16:19 CDT 2013     root@m6500.m6500:/usr/obj/usr/home/brandon/wc/freebsd-base-head/sys/DELL_M6500  amd64
>Description:
As per the subject, loading tun(4) via loader.conf(5) results in a panic if the tun(4) device already exists in the kernel.

Properly registering the tun(4) driver via MODULE_VERSION(9) fixes the issue, disallowing double-registering the module (patch attached).

Sure, this is on the edge of user error, but it's still a POLA violation and incorrect behavior...

Here's the stack trace from the panic:

#0  doadump (textdump=682654720) at pcpu.h:236
236     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump (textdump=682654720) at pcpu.h:236
#1  0xffffffff803050a5 in db_fncall (dummy1=<value optimized out>, 
    dummy2=<value optimized out>, dummy3=<value optimized out>, 
    dummy4=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_command.c:578
#2  0xffffffff80304d8d in db_command (cmd_table=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_command.c:449
#3  0xffffffff80304b04 in db_command_loop ()
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_command.c:502
#4  0xffffffff80307470 in db_trap (type=<value optimized out>, code=0)
    at /usr/home/brandon/wc/freebsd-base-head/sys/ddb/db_main.c:231
#5  0xffffffff804b92c3 in kdb_trap (type=9, code=0, tf=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/kern/subr_kdb.c:654
#6  0xffffffff8082954a in trap_fatal (frame=0xffffff84655c4860, 
    eva=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/trap.c:868
#7  0xffffffff808291ef in trap (frame=<value optimized out>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/trap.c:224
#8  0xffffffff80812ed2 in calltrap ()
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/exception.S:232
#9  0xffffffff8053e696 in if_clone_create (name=0xfffffe0032b7aec0 "wlan0", 
    len=16, params=0x627300 <Address 0x627300 out of bounds>)
    at /usr/home/brandon/wc/freebsd-base-head/sys/net/if_clone.c:193
#10 0xffffffff8053ba10 in ifioctl (so=0xfffffe0032e50550, 
    cmd=<value optimized out>, data=0xfffffe0032b7aec0 "wlan0", 
    td=0xfffffe0032eb1920)
    at /usr/home/brandon/wc/freebsd-base-head/sys/net/if.c:2505
#11 0xffffffff804d072e in kern_ioctl (td=0xfffffe0032eb1920, 
    fd=<value optimized out>, com=18446741875537194688) at file.h:306
#12 0xffffffff804d04af in sys_ioctl (td=0xfffffe0032eb1920, 
    uap=0xffffff84655c4b80)
    at /usr/home/brandon/wc/freebsd-base-head/sys/kern/sys_generic.c:693
#13 0xffffffff80829e77 in amd64_syscall (td=0xfffffe0032eb1920, traced=0)
    at subr_syscall.c:134
#14 0xffffffff808131bb in Xfast_syscall ()
    at /usr/home/brandon/wc/freebsd-base-head/sys/amd64/amd64/exception.S:391
#15 0x000000080119b45a in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
>How-To-Repeat:
Load tun(4) via loader.conf(5) while having the tun(4) device compiled in to the kernel.
>Fix:
Patch attached.

Patch attached with submission follows:

Index: sys/net/if_tun.c
===================================================================
--- sys/net/if_tun.c	(revision 253950)
+++ sys/net/if_tun.c	(working copy)
@@ -321,6 +321,7 @@
 };
 
 DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
+MODULE_VERSION(if_tun, 1);
 
 static void
 tunstart(struct ifnet *ifp)


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->patched 
State-Changed-By: markj 
State-Changed-When: Wed Aug 7 01:37:40 UTC 2013 
State-Changed-Why:  
Fixed in r254020. Thanks! 


Responsible-Changed-From-To: freebsd-bugs->markj 
Responsible-Changed-By: markj 
Responsible-Changed-When: Wed Aug 7 01:37:40 UTC 2013 
Responsible-Changed-Why:  
Fixed in r254020. Thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=181078 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/181078: commit references a PR
Date: Wed,  7 Aug 2013 01:32:21 +0000 (UTC)

 Author: markj
 Date: Wed Aug  7 01:32:08 2013
 New Revision: 254020
 URL: http://svnweb.freebsd.org/changeset/base/254020
 
 Log:
   Add a missing module version declaration to if_tun(4).
   
   PR:		181078
   Submitted by:	Brandon Gooch <jamesbrandongooch@gmail.com>
   MFC after:	1 week
 
 Modified:
   head/sys/net/if_tun.c
 
 Modified: head/sys/net/if_tun.c
 ==============================================================================
 --- head/sys/net/if_tun.c	Wed Aug  7 01:01:58 2013	(r254019)
 +++ head/sys/net/if_tun.c	Wed Aug  7 01:32:08 2013	(r254020)
 @@ -321,6 +321,7 @@ static moduledata_t tun_mod = {
  };
  
  DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 +MODULE_VERSION(if_tun, 1);
  
  static void
  tunstart(struct ifnet *ifp)
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: markj 
State-Changed-When: Thu Aug 15 04:13:18 UTC 2013 
State-Changed-Why:  
The fix has been MFCed to stable/9 and stable/8. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=181078 
>Unformatted:
