bnxt: While VLAN TCP Tx is progress, "ifconfig destroy" caused kernel Crash in Iflib code
AcceptedPublic

Authored by bhargava.marreddy_broadcom.com on Nov 6 2017, 1:49 PM.

Details

Summary

This patch is for https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222680

Repro Steps;-

  1. Boot into FreeBSD rev src_head_322823
  2. Create VLAN interface -
    1. ifconfig bnxt0.5 create vlan 5 vlandev bnxt0 inet 5.0.0.1/24
  3. Start Tx TCP using Stratus 100G A1 NIC
  4. While Throughput is ~ 90 Gbps, destroy VLAN interface ##ifconfig bnxt0.5 destroy
  5. Server Crashed
Test Plan

With the attached fix, tried VLAN destroy several times and no crash seen.

Diff Detail

Lint
Lint Skipped
Unit
Unit Tests Skipped
sbruno accepted this revision.Nov 9 2017, 8:12 PM
This revision is now accepted and ready to land.Nov 9 2017, 8:12 PM
mjoras added a subscriber: mjoras.Nov 9 2017, 8:41 PM

First off, please submit future patches with arc diff directly, or with a diff generated with full context.

Second, this only fixes the problem by chance. The fundamental problem here is that the ifnet we are checking has been freed, so accessing ANY memory on it is going to possibly crash the kernel. The only way to really solve this is to either fix the ifnet lifetime issues (not easy), or potentially do some sort of workaround where the BPF_MTAP for a VLAN interface happens within if_vlan itself (the only place where we can be sure the vlan ifnet still exists).

Matt Joras,

Thanks for the review.

The only way to really solve this is to either fix the ifnet lifetime issues (not easy)

<Chenna>
Can we push current patch for now (as quick fix) so that we can get some time to come up with proper fix.

Matt Joras, Sean Bruno, Stephen Hurd,

Can we push this patch for now (as quick fix) so that we can get some time to come up with proper fix.