[Bug 279653] Page fault in in6_selecthlim

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279653

--- Comment #12 from [email protected] ---
I have not reproduced the crash but I guess the following patch for
if_detach_internal() would fix the problem:

----
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -1235,6 +1235,8 @@ if_detach_internal(struct ifnet *ifp, bool vmove)
 #ifdef VIMAGE
 finish_vnet_shutdown:
 #endif
+       epoch_wait_preempt(net_epoch_preempt);
+       NET_EPOCH_DRAIN_CALLBACKS();
        /*
         * We cannot hold the lock over dom_ifdetach calls as they might
         * sleep, for example trying to drain a callout, thus open up the
----

The routing entries that are related with the detaching ifnet are removed
in if_purgeaddrs() and rt_flushifroutes().  It seems that the transport
layer protects itself from freeing objects with NET_EPOCH_ENTER/EXIT.
So there should be no threads that still reference nhop_objects
related to the ifnet after rt_flushifroutes() + epoch_wait_preempt().
I am not sure that NET_EPOCH_DRAIN_CALLBACKS() is required but it is
probably harmless.

-- 
You are receiving this mail because:
You are the assignee for the bug.