From brooks@FreeBSD.org  Fri Feb 18 06:27:19 2005
Return-Path: <brooks@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 5A54316A4CE; Fri, 18 Feb 2005 06:27:19 +0000 (GMT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 4328243D53; Fri, 18 Feb 2005 06:27:19 +0000 (GMT)
	(envelope-from brooks@FreeBSD.org)
Received: from freefall.freebsd.org (brooks@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.1/8.13.1) with ESMTP id j1I6RJ3G016430;
	Fri, 18 Feb 2005 06:27:19 GMT
	(envelope-from brooks@freefall.freebsd.org)
Received: (from brooks@localhost)
	by freefall.freebsd.org (8.13.1/8.13.1/Submit) id j1I6RJT1016429;
	Fri, 18 Feb 2005 06:27:19 GMT
	(envelope-from brooks)
Message-Id: <200502180627.j1I6RJT1016429@freefall.freebsd.org>
Date: Fri, 18 Feb 2005 06:27:19 GMT
From: Brooks Davis <brooks@FreeBSD.org>
Reply-To: Brooks Davis <brooks@FreeBSD.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc: rwatson@freebsd.org
Subject: multicast sockets + interface removal = panic
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         77665
>Category:       kern
>Synopsis:       [panic] multicast sockets + interface removal = panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    rwatson
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Feb 18 06:30:24 GMT 2005
>Closed-Date:    Sun Nov 27 18:55:07 GMT 2005
>Last-Modified:  Sun Nov 27 18:55:07 GMT 2005
>Originator:     Brooks Davis
>Release:        FreeBSD 6.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD minya 6.0-CURRENT FreeBSD 6.0-CURRENT #13: Wed Feb  9 14:33:45 EST 2005     brooks@minya:/home/brooks/working/freebsd/p4/cleanup/sys/i386/compile/MINYA  i386


	
>Description:

Creating a multicast socket, such as those created by the
net/mDNSResponder port, and then removing an interface that is up will
cause a panic in if_delmulti().  The stack is roughly:

if_delmulti()+0xc
in_delmulti()+0x6a
ip_freemoptions()+0x21
in_pcpdetach()+0x168
udp_detach()+0x65
soclose()+0x1e0
soo_close()+0x4b
fdrop_locked()+0x88
fdrop()+0x24
closef()+0x367
close()+0x1a3
syscall()+0x213

>How-To-Repeat:

Configure a removable interface (ath0 in my case), install and run
net/mDNSResponder, and eject the card.

>Fix:

If the interface is down when ejected, the panic does no occure.

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->rwatson 
Responsible-Changed-By: andre 
Responsible-Changed-When: Tue Aug 30 11:55:04 GMT 2005 
Responsible-Changed-Why:  
Bounce over to rwatson.  He has done some multicast work recently 
which most likely has fixed this issue too. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=77665 

From: "Yar Tikhiy" <yar@comp.chem.msu.su>
To: <bug-followup@FreeBSD.org>
Cc:  
Subject: Re: kern/77665: multicast sockets + interface removal = panic
Date: Wed, 31 Aug 2005 18:39:18 +0400

 For reference, here's the current list of PR's related to the issue of IP
 multicast and interfaces:
 
 PR kern/77665
 PR kern/78227
 PR kern/82882
 

From: Robert Watson <rwatson@FreeBSD.org>
To: Andre Oppermann <andre@FreeBSD.org>
Cc: FreeBSD-gnats-submit@FreeBSD.org
Subject: Re: kern/77665: multicast sockets + interface removal = panic
Date: Mon, 5 Sep 2005 14:38:39 +0100 (BST)

 I've now committed a regression test:
 
    src/tools/regresion/netinet/msocket_ifnet_Remove
 
 The short term solution will likely be to walk the inpcb lists and trim 
 references to removed interfaces -- the long term solution requires us to 
 properly describe what multicast socket semantics should be for removed 
 interfaces.  It could be that, for example, we need to store the 
 "requested" membership information, not just a current ifnet reference, so 
 that the membership can be rebound if it didn't specify an interface, just 
 the default.
 
 We may also want to identify what other systems do for multicast sockets 
 on interface removal.
 
 Simply eliminating the panic now would be a good start though.
 
 Robert N M Watson
State-Changed-From-To: open->closed 
State-Changed-By: rwatson 
State-Changed-When: Sun Nov 27 18:46:06 GMT 2005 
State-Changed-Why:  
Closing, as fixed in if.c:1.247, in.c:1.88, and in.h:1.92.  Merged to 
RELENG_6 as if.c:1.234.2.12, in.c:1.85.2.3, in.h:1.90.2.1. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=77665 
>Unformatted:
