On Tue, May 14, 2019 at 10:34 AM Kyle Evans <kev...@freebsd.org> wrote: > > On Tue, May 14, 2019 at 10:10 AM Mark Johnston <ma...@freebsd.org> wrote: > > > > Hi, > > > > I hit the following panic last night on a non-INVARIANTS kernel at > > r347549. The workload involves running a number of bhyve VMs with > > frequent restarts, during which a tap interface is destroyed and > > recreated. I'm a bit short on time to debug this today, so while I > > retry with INVARIANTS on I thought I'd also report the issue in case > > anyone else is seeing it. > > > > The panic occurred because the ifnet's softc field is NULL. > > Ah, foo. I'll have to re-examine the ioctl/destroy race... tun_destroy > grabs the ioctl sx and kills off the if_softc, but it can not and > should not do this before if_detach or else things go wrong because > it's still a part of the bridge.
I'm considering this patch  to move destroying the if_softc until after we've detached. We've already closed the tunnel, dropped all of our routes/addresses, and detach has freed us of our bridge responsibilities. It seems that we could still have a reference to the ifp in the ioctl path if something's entered just prior to detach, so we kill off the if_softc prior to freeing and the rest is safe.  https://people.freebsd.org/~kevans/tuntap-bridge.diff _______________________________________________ firstname.lastname@example.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"