From nobody@FreeBSD.org Sun Aug 30 08:54:33 2009 Return-Path: Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CE5871065675 for ; Sun, 30 Aug 2009 08:54:33 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id BE2B48FC12 for ; Sun, 30 Aug 2009 08:54:33 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n7U8sXx3033218 for ; Sun, 30 Aug 2009 08:54:33 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n7U8sXpH033211; Sun, 30 Aug 2009 08:54:33 GMT (envelope-from nobody) Message-Id: <200908300854.n7U8sXpH033211@www.freebsd.org> Date: Sun, 30 Aug 2009 08:54:33 GMT From: Richard Tector To: freebsd-gnats-submit@FreeBSD.org Subject: ifconfig tun0 destroy causes LOR on 8.0-BETA3 X-Send-Pr-Version: www-3.1 X-GNATS-Notify: >Number: 138332 >Category: kern >Synopsis: [tun] [lor] ifconfig tun0 destroy causes LOR if_adata/mld_mtx on 8.0-BETA3 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-net >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Aug 30 09:00:08 UTC 2009 >Closed-Date: >Last-Modified: Sun Feb 07 20:00:45 UTC 2010 >Originator: Richard Tector >Release: FreeBSD 8.0-BETA3 amd64 >Organization: >Environment: FreeBSD daffy.tector.org.uk 8.0-BETA3 FreeBSD 8.0-BETA3 #17: Sat Aug 29 13:46:30 BST 2009 richard@daffy.tector.org.uk:/usr/obj/usr/src/sys/DAFFY amd64 >Description: Issuing ifconfig tun0 destroy after stopping PPP causes a lock order reversal as follows: tun0: link state changed to DOWN lock order reversal: 1st 0xffffff00037b4bc8 if_afdata (if_afdata) @ /usr/src/sys/net/if.c:912 2nd 0xffffffff80a42200 mld_mtx (mld_mtx) @ /usr/src/sys/netinet6/mld6.c:569 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2a _witness_debugger() at _witness_debugger+0x2e witness_checkorder() at witness_checkorder+0x80b _mtx_lock_flags() at _mtx_lock_flags+0x71 mld_domifdetach() at mld_domifdetach+0x24 in6_domifdetach() at in6_domifdetach+0x11 if_detach() at if_detach+0x792 tun_destroy() at tun_destroy+0x70 ifc_simple_destroy() at ifc_simple_destroy+0x2a if_clone_destroyif() at if_clone_destroyif+0xc0 ifioctl() at ifioctl+0x6f4 kern_ioctl() at kern_ioctl+0xc3 ioctl() at ioctl+0xfc syscall() at syscall+0x1b2 Xfast_syscall() at Xfast_syscall+0xe1 --- syscall (54, FreeBSD ELF64, ioctl), rip = 0x800a7bbbc, rsp = 0x7fffffffe238, rbp = 0x51cf28 --- >How-To-Repeat: /etc/rc.d/ppp stop ifconfig tun0 destroy >Fix: >Release-Note: >Audit-Trail: Responsible-Changed-From-To: freebsd-bugs->freebsd-net Responsible-Changed-By: linimon Responsible-Changed-When: Sun Aug 30 09:22:38 UTC 2009 Responsible-Changed-Why: Over to maintainer(s). http://www.freebsd.org/cgi/query-pr.cgi?pr=138332 >Unformatted: