Re: panic after ifioctl/if_clone_destroy

The struct thread is typesafe. The problem is that the link is no longer
typesafe now that it’s not part of the thread. Thanks for pointing this
out. I’ll commit a fix later today.

-M



On Mon, Aug 6, 2018 at 02:39 Hans Petter Selasky <hps_at_selasky.org> wrote:

> Hi Matthew,
>
> On 08/06/18 10:02, Hans Petter Selasky wrote:
> > -             if ((tdwait = TAILQ_FIRST(&record->er_tdlist)) != NULL &&
> > -                 TD_IS_RUNNING(tdwait->et_td)) {
>
> At least the TD_IS_RUNNING() check is invalid. The "tdwait" structure is
> in the control of the other CPU and "tdwait->et_td" might be invalid at
> any time, so accessing any members here is not a good idea.
>
> It is pretty clear that the epoch was exited during the loop:
>
>          etd->et_td = (void*)0xDEADBEEF;
>
> fault virtual address   = 0xdeadc2ff
> fault code              = supervisor read data, page not present
>
>
> If you remove the TD_IS_RUNNING() check I'm not sure how useful this
> loop will be ...
>
> --HPS
>