Hello, On Mon, May 09, 2022 at 06:01:07PM +0300, Barbaros Bilek wrote: > Hello, > > I was using veb (veb+vlan+ixl) interfaces quite stable since 6.9. > My system ran as a firewall under OpenBSD 6.9 and 7.0 quite stable. > Also I've used 7.1 for a limited time and there were no crash. > After OpenBSD' NET_TASKQ upgrade to 4 it crashed after 5 days. > Here crash report and dmesg: > > ether_input(ffff80000520e000,fffffd8053616700) at ether_input+0x3ad > vport_if_enqueue(ffff80000520e000,fffffd8053616700) at vport_if_enqueue+0x19 > veb_port_input(ffff8000051c3800,fffffd806064c200,ffffffffffff,ffff800002066600) > at veb_port_input+0x4d2 > ether_input(ffff8000051c3800,fffffd806064c200) at ether_input+0x100 > end trace frame: 0xffff800025575290, count: 0 > ddb{1}> show panic > > *cpu1: kernel diagnostic assertion "curcpu()->ci_schedstate.spc_smrdepth == > 0" f > ailed: file "/usr/src/sys/kern/subr_xxx.c", line 163 > > ddb{1}> trace > > db_enter() at db_enter+0x10 > > panic(ffffffff81f22e39) at panic+0xbf > > __assert(ffffffff81f96c9d,ffffffff81f85ebc,a3,ffffffff81fd252f) at > __assert+0x2 > > 5 >
diff below attempts to fix this particular panic triggered by veb_span() function. This is fairly simple/straightforward change: we grab references to veb ports inside SMR_READ_ section. we keep those references in single linked list as soon as we leave SMR_READ_ section we process the list: dispatch packets drop references to port The change may uncover similar panics in other veb/bridge area. diff applies to current thanks for testing and reporting back. regards sashan --------8<---------------8<---------------8<------------------8<-------- diff --git a/sys/net/if_veb.c b/sys/net/if_veb.c index 2976cc200f1..a02dbac887f 100644 --- a/sys/net/if_veb.c +++ b/sys/net/if_veb.c @@ -159,6 +159,11 @@ struct veb_softc { struct veb_ports sc_spans; }; +struct veb_span_port { + SLIST_ENTRY(veb_span_port) sp_entry; + struct veb_port *sp_port; +}; + #define DPRINTF(_sc, fmt...) do { \ if (ISSET((_sc)->sc_if.if_flags, IFF_DEBUG)) \ printf(fmt); \ @@ -225,6 +230,7 @@ static struct if_clone veb_cloner = IF_CLONE_INITIALIZER("veb", veb_clone_create, veb_clone_destroy); static struct pool veb_rule_pool; +static struct pool span_port_pool; static int vport_clone_create(struct if_clone *, int); static int vport_clone_destroy(struct ifnet *); @@ -266,6 +272,11 @@ veb_clone_create(struct if_clone *ifc, int unit) 0, IPL_SOFTNET, 0, "vebrpl", NULL); } + if (span_port_pool.pr_size == 0) { + pool_init(&span_port_pool, sizeof(struct veb_span_port), + 0, IPL_SOFTNET, 0, "vebspl", NULL); + } + sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO|M_CANFAIL); if (sc == NULL) return (ENOMEM); @@ -352,22 +363,38 @@ veb_span(struct veb_softc *sc, struct mbuf *m0) struct veb_port *p; struct ifnet *ifp0; struct mbuf *m; + struct veb_span_port *sp; + SLIST_HEAD(, veb_span_port) span_list; + SLIST_INIT(&span_list) smr_read_enter(); SMR_TAILQ_FOREACH(p, &sc->sc_spans.l_list, p_entry) { ifp0 = p->p_ifp0; if (!ISSET(ifp0->if_flags, IFF_RUNNING)) continue; - m = m_dup_pkt(m0, max_linkhdr + ETHER_ALIGN, M_NOWAIT); - if (m == NULL) { - /* XXX count error */ - continue; - } + sp = pool_get(&span_port_pool, PR_NOWAIT); + if (sp == NULL) + continue; /* XXX count error */ - if_enqueue(ifp0, m); /* XXX count error */ + veb_eb_brport_take(p); + sp->sp_port = p; + SLIST_INSERT_HEAD(&span_list, sp, sp_entry); } smr_read_leave(); + + while (!SLIST_EMPTY(&span_list)) { + sp = SLIST_FIRST(&span_list); + SLIST_REMOVE_HEAD(&span_list, sp_entry); + + m = m_dup_pkt(m0, max_linkhdr + ETHER_ALIGN, M_NOWAIT); + if (m != NULL) + if_enqueue(sp->sp_port->p_ifp0, m); + /* XXX count error */ + + veb_eb_brport_rele(sp->sp_port); + pool_put(&span_port_pool, sp); + } } static int