Re: panic in tunstart_l2()

From: Kyle Evans <>
Date: Tue, 14 May 2019 11:09:47 -0500
On Tue, May 14, 2019 at 10:34 AM Kyle Evans <> wrote:
> On Tue, May 14, 2019 at 10:10 AM Mark Johnston <> wrote:
> >
> > Hi,
> >
> > I hit the following panic last night on a non-INVARIANTS kernel at
> > r347549.  The workload involves running a number of bhyve VMs with
> > frequent restarts, during which a tap interface is destroyed and
> > recreated.  I'm a bit short on time to debug this today, so while I
> > retry with INVARIANTS on I thought I'd also report the issue in case
> > anyone else is seeing it.
> >
> > The panic occurred because the ifnet's softc field is NULL.
> Ah, foo. I'll have to re-examine the ioctl/destroy race... tun_destroy
> grabs the ioctl sx and kills off the if_softc, but it can not and
> should not do this before if_detach or else things go wrong because
> it's still a part of the bridge.

I'm considering this patch [0] to move destroying the if_softc until
after we've detached. We've already closed the tunnel, dropped all of
our routes/addresses, and detach has freed us of our bridge

It seems that we could still have a reference to the ifp in the ioctl
path if something's entered just prior to detach, so we kill off the
if_softc prior to freeing and the rest is safe.

Received on Tue May 14 2019 - 14:10:40 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:20 UTC