From root@Neo-Vortex.Ath.Cx  Mon Sep 13 07:42:47 2004
Return-Path: <root@Neo-Vortex.Ath.Cx>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A8DDB16A4CE
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 13 Sep 2004 07:42:47 +0000 (GMT)
Received: from Neo-Vortex.Ath.Cx (203-217-85-229.dyn.iinet.net.au [203.217.85.229])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 83C9E43D1D
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 13 Sep 2004 07:42:46 +0000 (GMT)
	(envelope-from root@Neo-Vortex.Ath.Cx)
Received: from Neo-Vortex.Ath.Cx (smmsp@localhost.Neo-Vortex.got-root.cc [127.0.0.1])
	by Neo-Vortex.Ath.Cx (8.12.10/8.12.10) with ESMTP id i8D7gh5w061830
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 13 Sep 2004 17:42:43 +1000 (EST)
	(envelope-from root@Neo-Vortex.Ath.Cx)
Received: (from root@localhost)
	by Neo-Vortex.Ath.Cx (8.12.10/8.12.10/Submit) id i8D7ggsj061829;
	Mon, 13 Sep 2004 17:42:42 +1000 (EST)
	(envelope-from root)
Message-Id: <200409130742.i8D7ggsj061829@Neo-Vortex.Ath.Cx>
Date: Mon, 13 Sep 2004 17:42:42 +1000 (EST)
From: Neo-Vortex <root@Neo-Vortex.Ath.Cx>
Reply-To: Neo-Vortex <root@Neo-Vortex.Ath.Cx>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: ifconfig hanging box
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         71695
>Category:       kern
>Synopsis:       [gif] [hang] [lor] ifconfig(8) hanging box
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    brooks
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Sep 13 07:50:19 GMT 2004
>Closed-Date:    Wed Jan 11 06:33:20 GMT 2006
>Last-Modified:  Sun Feb 15 19:07:57 UTC 2009
>Originator:     Neo-Vortex
>Release:        FreeBSD 5.2.1-RELEASE-p9 i386
>Organization:
N/A
>Environment:
System: FreeBSD Neo-Vortex.Ath.Cx 5.2.1-RELEASE-p9 FreeBSD 5.2.1-RELEASE-p9 #8: Sun Aug 8 10:27:16 EST 2004 root@Neo-Vortex.Ath.Cx:/usr/obj/usr/src/sys/magick i386
Tested on a fresh install of 5.2.1-RELEASE (straight off the CD) and it works also.

>Description:
	Complete hanging of box after preforming the ifconfig rain-dance.
	ifconfig -C producing wierd results just before the last command.
>How-To-Repeat:
	As root:
	
	ifconfig -C
			Output: lo ppp faith gif
	ifconfig ppp0 create
	ifconfig ppp0 destroy
	ifconfig -C
			Output: ppp lo ppp lo ppp
	ifconfig gif0 create
	
	I suspect the ifconfig -C lines can be left out, but it shows interesting results, and thats how i caused it each time, so they were left in.
	After you run 'ifconfig gif0 create' the box will hang.

>Fix:

	Unknown

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->brooks 
Responsible-Changed-By: brooks 
Responsible-Changed-When: Mon Sep 13 15:55:35 GMT 2004 
Responsible-Changed-Why:  
This is almost certaintly my fault. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=71695 

From: Brooks Davis <brooks@one-eyed-alien.net>
To: Neo-Vortex <root@Neo-Vortex.Ath.Cx>
Cc: FreeBSD-gnats-submit@freebsd.org
Subject: Re: kern/71695: ifconfig hanging box
Date: Mon, 13 Sep 2004 11:02:51 -0700

 Can you replicate this problem 5.3 (currently in BETA)?  I can't do it
 here.  Cloning has been massivly overhauled since 5.2.
 
 -- Brooks
State-Changed-From-To: open->feedback 
State-Changed-By: brooks 
State-Changed-When: Mon Sep 13 18:28:14 GMT 2004 
State-Changed-Why:  
Requested feedback on newer version. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=71695 

From: Neo-Vortex <root@Neo-Vortex.Ath.Cx>
To: Brooks Davis <brooks@one-eyed-alien.net>
Cc: FreeBSD-gnats-submit@freebsd.org
Subject: Re: kern/71695: ifconfig hanging box
Date: Tue, 14 Sep 2004 08:32:34 +1000 (EST)

 I dont have a 5.3 box to test on sorry... but shouldnt this be fixed in
 5.2.1 untill 5.3 is ready? also, i havnt tested on 4.x either so im not
 sure if its going to crash 4.x or not. (I dont have a 4.x box though to
 test on)
 
 On Mon, 13 Sep 2004, Brooks Davis wrote:
 
 > Can you replicate this problem 5.3 (currently in BETA)?  I can't do it
 > here.  Cloning has been massivly overhauled since 5.2.
 >
 > -- Brooks
 >

From: Brooks Davis <brooks@one-eyed-alien.net>
To: Neo-Vortex <root@Neo-Vortex.Ath.Cx>
Cc: Brooks Davis <brooks@one-eyed-alien.net>,
	FreeBSD-gnats-submit@freebsd.org
Subject: Re: kern/71695: ifconfig hanging box
Date: Mon, 13 Sep 2004 17:37:13 -0700

 On Tue, Sep 14, 2004 at 08:32:34AM +1000, Neo-Vortex wrote:
 > I dont have a 5.3 box to test on sorry... but shouldnt this be fixed in
 > 5.2.1 untill 5.3 is ready? also, i havnt tested on 4.x either so im not
 > sure if its going to crash 4.x or not. (I dont have a 4.x box though to
 > test on)
 
 5.2.1 is not an erratta branch, so we won't be committing a fix there,
 we definatly don't have the resources to provide more then trivial
 support for -CURRENT snapshot releases like 5.2.1.  If this is a problem
 in 4.x we'll definatly fix it, but I find it hard to belive it is a
 problem given how long cloning has been stable there.  It looks like
 destroying is some how connecting the clone struct of the type destroyed
 to the head of the list so you get an infinite loop.  That's a very
 weird symptom and I don't see any simple way for it to happen.
 
 -- Brooks

From: Robert Watson <rwatson@FreeBSD.org>
To: FreeBSD-gnats-submit@FreeBSD.org
Cc:  
Subject: Re: kern/71695: ifconfig hanging box
Date: Mon, 13 Sep 2004 23:11:00 -0400 (EDT)

 On Mon, 13 Sep 2004, Neo-Vortex wrote:
 
 > 	ifconfig -C
 > 			Output: lo ppp faith gif
 > 	ifconfig ppp0 create
 > 	ifconfig ppp0 destroy
 > 	ifconfig -C
 > 			Output: ppp lo ppp lo ppp
 > 	ifconfig gif0 create
 > 	
 > 	I suspect the ifconfig -C lines can be left out, but it shows interesting results, and thats how i caused it each time, so they were left in.
 > 	After you run 'ifconfig gif0 create' the box will hang.
 
 I don't see the hang on 5.3/6.x, but I do see the following WITNESS lock
 order reversal that, in another life, could be a hang:
 
 inet1420-2# ifconfig -C
 lock order reversal
  1st 0xc08e8e00 if_cloners lock (if_cloners lock) @ net/if_clone.c:242
  2nd 0xc58b5878 user map (user map) @ vm/vm_map.c:2994
 KDB: stack backtrace:
 kdb_backtrace(0,ffffffff,c08c42e8,c08c4e28,c08585ac) at kdb_backtrace+0x29
 witness_checkorder(c58b5878,9,c0812247,bb2) at witness_checkorder+0x544
 _sx_xlock(c58b5878,c081223e,bb2) at _sx_xlock+0x50
 _vm_map_lock_read(c58b5834,c081223e,bb2,28bc3e0,c58dbcac) at
 _vm_map_lock_read+0x37
 vm_map_lookup(eb95baa0,8054000,2,eb95baa4,eb95ba94) at vm_map_lookup+0x28
 vm_fault(c58b5834,8054000,2,8,c58df190) at vm_fault+0x66
 trap_pfault(eb95bb68,0,8054000) at trap_pfault+0xf2
 trap(c0800018,c08e0010,10,8054000,eb95bbd4) at trap+0x335
 calltrap() at calltrap+0x5
 --- trap 0xc, eip = 0xc078ed4c, esp = 0xeb95bba8, ebp = 0xeb95bbf0 ---
 slow_copyout(eb95bc60,eb95bc14,c0628292,eb95bc60,eb95bc60) at
 slow_copyout+0x4
 ifioctl(c588f144,c00c6978,eb95bc60,c58df190,0) at ifioctl+0x95
 soo_ioctl(c58d0264,c00c6978,eb95bc60,c5e68800,c58df190) at soo_ioctl+0x2b1
 ioctl(c58df190,eb95bd14,3,0,292) at ioctl+0x3e0
 syscall(2f,2f,2f,bfbfec5c,8054000) at syscall+0x213
 Xint0x80_syscall() at Xint0x80_syscall+0x1f
 --- syscall (54, FreeBSD ELF32, ioctl), eip = 0x280cc083, esp =
 0xbfbfec3c, ebp = 0xbfbfec78 ---
 lo ppp faith gif
 inet1420-2# ifconfig gif0 create
 
 The lock order reversal occurs because a mutex is held over a call to
 copyout(), which hits a page fault and so acquires VM locks and may also
 sleep (undesirable).  There's a related issue with ifconf() holding the
 ifnet lock over a copyout() that also needs to be corrected.  I'd like to
 see these fixed for 5.3-RELEASE, if possible.
 
 Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
 robert@fledge.watson.org      Principal Research Scientist, McAfee Research
 
 

From: "Oleg Gawriloff" <barzog@telecom.by>
To: <freebsd-gnats-submit@FreeBSD.org>, <root@Neo-Vortex.Ath.Cx>
Cc:  
Subject: Re: kern/71695: [hang] ifconfig hanging box
Date: Sun, 10 Oct 2004 16:03:24 +0300

 Expiriencing the same problem on 4.10-R during 
 ifconfig vlan<> destroy
 ifconfig vlan<> create. 
 System hangs after ifconfig destroy command.
 
 

From: Neo-Vortex <root@Neo-Vortex.Ath.Cx>
To: Oleg Gawriloff <barzog@telecom.by>
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: kern/71695: [hang] ifconfig hanging box
Date: Mon, 11 Oct 2004 16:27:50 +1000 (EST)

 yay! i knew there must have been some clonable interface on 4.x which had
 the same problem :P (im not crazy)
 
 On Sun, 10 Oct 2004, Oleg Gawriloff wrote:
 
 > Expiriencing the same problem on 4.10-R during
 > ifconfig vlan<> destroy
 > ifconfig vlan<> create.
 > System hangs after ifconfig destroy command.
 >
 >
 >
State-Changed-From-To: feedback->closed 
State-Changed-By: brooks 
State-Changed-When: Wed Jan 11 06:31:38 UTC 2006 
State-Changed-Why:  
No reports on 5.3+.  If you can replicate this on 5.4 or 6.0, please 
respond and we'll re-open this PR. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=71695 
>Unformatted:
