Re: ifconfig carp0 destroy = kernel panic

Rudy Rucker wrote:
> 
> This is an old problem with FreeBSD 6.x.
> 
> Three questions:
>  Why has this not been patched in the CVS tree?
>  Is there a solution that works?
>  Should I be posting this to freebsd-questions?

This is just a "mee too".

I find that after giving a CARP interface an address, it is impossible
to remove the address using ifconfig carp200 delete ...  Further
using ifconfig carp200 destroy results in a panic.

It's more of a frustration than a show stopper though since there
are two firewalls and accidentally panicing one just has the other
take over.  It would be nice for this to be sorted out though.

Here's a trace from the last one:

#0  doadump () at pcpu.h:147
#1  0xc04f304d in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc04f3416 in panic (fmt=0xc067a9fe "%s")
    at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc0654ad8 in trap_fatal (frame=0xeb8bda20, eva=308)
    at /usr/src/sys/i386/i386/trap.c:868
#4  0xc065405a in trap (frame=0xeb8bda20) at /usr/src/sys/i386/i386/trap.c:276
#5  0xc063b9cb in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#6  0xc04e6f9b in _mtx_lock_sleep (m=0xc519d64c, tid=3308401936, opts=0, 
    file=0x0, line=0) at /usr/src/sys/kern/kern_mutex.c:337
#7  0xc0584947 in if_delmulti (ifp=0xc519d400, sa=0xc568d770)
    at /usr/src/sys/net/if.c:2358
#8  0xc0595a27 in in_delmulti_locked (inm=0x6)
    at /usr/src/sys/netinet/in.c:1082
#9  0xc0595912 in in_delmulti (inm=0xc5692420)
    at /usr/src/sys/netinet/in.c:1055
#10 0xc0597bfe in carp_multicast_cleanup (sc=0xc525e400)
    at /usr/src/sys/netinet/ip_carp.c:1396
#11 0xc0596355 in carpdetach (sc=0xc525e400, unlock=1)
    at /usr/src/sys/netinet/ip_carp.c:458
#12 0xc05961a3 in carp_clone_destroy (ifp=0xc5249800)
    at /usr/src/sys/netinet/ip_carp.c:415
#13 0xc0586124 in ifc_simple_destroy (ifc=0xc06bfdc0, ifp=0x6)
---Type <return> to continue, or q <return> to quit--- 
    at /usr/src/sys/net/if_clone.c:560
#14 0xc0585443 in if_clone_destroyif (ifc=0xc06bfdc0, ifp=0xc5249800)
    at /usr/src/sys/net/if_clone.c:218
#15 0xc0585358 in if_clone_destroy (name=0x1 <Address 0x1 out of bounds>)
    at /usr/src/sys/net/if_clone.c:196
#16 0xc0583c37 in ifioctl (so=0xc5177cf8, cmd=2149607801, 
    data=0xca9608a0 "vlan1070_vrrp", td=0xc5323510)
    at /usr/src/sys/net/if.c:1810
#17 0xc052cb72 in soo_ioctl (fp=0x1, cmd=2149607801, data=0xca9608a0, 
    active_cred=0xc56bc780, td=0xc5323510)
    at /usr/src/sys/kern/sys_socket.c:202
#18 0xc0526058 in kern_ioctl (td=0xc5323510, fd=3, com=2149607801, 
    data=0xca9608a0 "vlan1070_vrrp") at file.h:266
#19 0xc0525bf2 in ioctl (td=0x1, uap=0xeb8bdd00)
    at /usr/src/sys/kern/sys_generic.c:553
#20 0xc0654e99 in syscall (frame=0xeb8bdd38)
    at /usr/src/sys/i386/i386/trap.c:1008
#21 0xc063ba30 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196
#22 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

Noteable from traces in the past that it's actually died in the
carp code this time and not the arp code.

Ian

--
Ian Freislich