lagg: Avoid adding a port to a lagg device being destroyed.
The lagg_clone_destroy() handles detach and waiting for ifconfig callers
to drain already.
This narrows the race for 2 panics that the tests triggered. Both were a
consequence of adding a port to the lagg device after it had already detached
from all of its ports. The link state task would run after lagg_clone_destroy()
free'd the lagg softc.
kernel:trap_fatal+0xa4
kernel:trap_pfault+0x61
kernel:trap+0x316
kernel:witness_checkorder+0x6d
kernel:_sx_xlock+0x72
if_lagg.ko:lagg_port_state+0x3b
kernel:if_down+0x144
kernel:if_detach+0x659
if_tap.ko:tap_destroy+0x46
kernel:if_clone_destroyif+0x1b7
kernel:if_clone_destroy+0x8d
kernel:ifioctl+0x29c
kernel:kern_ioctl+0x2bd
kernel:sys_ioctl+0x16d
kernel:amd64_syscall+0x337
kernel:trap_fatal+0xa4
kernel:trap_pfault+0x61
kernel:trap+0x316
kernel:witness_checkorder+0x6d
kernel:_sx_xlock+0x72
if_lagg.ko:lagg_port_state+0x3b
kernel:do_link_state_change+0x9b
kernel:taskqueue_run_locked+0x10b
kernel:taskqueue_run+0x49
kernel:ithread_loop+0x19c
kernel:fork_exit+0x83
PR: 244168
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: Dell EMC
Differential Revision: https://reviews.freebsd.org/D25284
This commit is contained in:
@@ -679,6 +679,9 @@ lagg_port_create(struct lagg_softc *sc, struct ifnet *ifp)
|
||||
return (EINVAL);
|
||||
}
|
||||
|
||||
if (sc->sc_destroying == 1)
|
||||
return (ENXIO);
|
||||
|
||||
/* Limit the maximal number of lagg ports */
|
||||
if (sc->sc_count >= LAGG_MAX_PORTS)
|
||||
return (ENOSPC);
|
||||
@@ -1191,6 +1194,8 @@ lagg_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
|
||||
|
||||
bzero(&rpbuf, sizeof(rpbuf));
|
||||
|
||||
/* XXX: This can race with lagg_clone_destroy. */
|
||||
|
||||
switch (cmd) {
|
||||
case SIOCGLAGG:
|
||||
LAGG_XLOCK(sc);
|
||||
|
||||
Reference in New Issue
Block a user