Testing FreeBSD's tun interface create/destroy on 12-STABLE

12.0-STABLE-r347414-core4.txt

 dumped core - see /var/crash/vmcore.4

Thu May  9 23:46:29 UTC 2019

FreeBSD  12.0-STABLE FreeBSD 12.0-STABLE r347414 MGENERIC  amd64

panic: page fault

GNU gdb (GDB) 8.2.1 [GDB v8.2.1 for FreeBSD]
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd12.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...Reading symbols from /usr/lib/debug//boot/kernel/kernel.debug...done.
done.

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x98
fault code		= supervisor write data  , page not present
instruction pointer	= 0x20:0xffffffff80cb6c5b
stack pointer	        = 0x28:0xfffffe001f1fb4f0
frame pointer	        = 0x28:0xfffffe001f1fb530
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 12 (swi4: clock (0))
trap number		= 12
panic: page fault
cpuid = 1
time = 1557445544
KDB: stack backtrace:
#0 0xffffffff80bf4707 at kdb_backtrace+0x67
#1 0xffffffff80ba81a3 at vpanic+0x1a3
#2 0xffffffff80ba7ff3 at panic+0x43
#3 0xffffffff8108791a at trap_fatal+0x38a
#4 0xffffffff81087979 at trap_pfault+0x49
#5 0xffffffff81086f6e at trap+0x29e
#6 0xffffffff81061725 at calltrap+0x8
#7 0xffffffff80e08cf3 at ip6_output+0x2063
#8 0xffffffff80e10592 at mld_dispatch_packet+0x2b2
#9 0xffffffff80e0e4b6 at mld_fasttimo+0xab6
#10 0xffffffff80c33314 at pffasttimo+0x54
#11 0xffffffff80bc218e at softclock_call_cc+0x12e
#12 0xffffffff80bc2679 at softclock+0x79
#13 0xffffffff80b6bd64 at ithread_loop+0x1d4
#14 0xffffffff80b68c03 at fork_exit+0x83
#15 0xffffffff8106271e at fork_trampoline+0xe
Uptime: 11m54s
Dumping 266 out of 3029 MB:..7%..13%..25%..31%..43%..55%..61%..73%..85%..91%

__curthread () at /usr/src/sys/amd64/include/pcpu.h:230
230		__asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (OFFSETOF_CURTHREAD));
(kgdb) #0  __curthread () at /usr/src/sys/amd64/include/pcpu.h:230
#1  doadump (textdump=<optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:371
#2  0xffffffff80ba7d8b in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:451
#3  0xffffffff80ba8203 in vpanic (fmt=<optimized out>, ap=0xfffffe001f1fb230)
    at /usr/src/sys/kern/kern_shutdown.c:877
#4  0xffffffff80ba7ff3 in panic (fmt=<unavailable>)
    at /usr/src/sys/kern/kern_shutdown.c:804
#5  0xffffffff8108791a in trap_fatal (frame=0xfffffe001f1fb430, eva=152)
    at /usr/src/sys/amd64/amd64/trap.c:946
#6  0xffffffff81087979 in trap_pfault (frame=0xfffffe001f1fb430, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:765
#7  0xffffffff81086f6e in trap (frame=0xfffffe001f1fb430)
    at /usr/src/sys/amd64/amd64/trap.c:441
#8  <signal handler called>
#9  0xffffffff80cb6c5b in atomic_fcmpset_long (dst=0x98, 
    expect=<optimized out>, src=<optimized out>)
    at /usr/src/sys/amd64/include/atomic.h:221
#10 tunoutput (ifp=0xfffff80011765000, m0=0xfffff80011b25e00, 
    dst=0xfffffe001f1fb690, ro=<optimized out>)
    at /usr/src/sys/net/if_tun.c:663
#11 0xffffffff80e08cf3 in ip6_output (m0=<optimized out>, 
    opt=0xffffffff81fa97d8 <mld_po>, ro=0x0, flags=1, im6o=<optimized out>, 
    ifpp=0xfffffe001f1fb7f0, inp=0x0)
    at /usr/src/sys/netinet6/ip6_output.c:962
#12 0xffffffff80e10592 in mld_dispatch_packet (m=<optimized out>)
    at /usr/src/sys/netinet6/mld6.c:3145
#13 0xffffffff80e0e4b6 in mld_dispatch_queue (limit=0, mq=<optimized out>)
    at /usr/src/sys/netinet6/mld6.c:433
#14 mld_fasttimo_vnet (inmh=<optimized out>)
    at /usr/src/sys/netinet6/mld6.c:1449
#15 mld_fasttimo () at /usr/src/sys/netinet6/mld6.c:1333
#16 0xffffffff80c33314 in pffasttimo (arg=0xfffff80011765000)
    at /usr/src/sys/kern/uipc_domain.c:521
#17 0xffffffff80bc218e in softclock_call_cc (c=<optimized out>, 
    cc=0xffffffff81ff6440 <cc_cpu>, direct=<optimized out>)
    at /usr/src/sys/kern/kern_timeout.c:731
#18 0xffffffff80bc2679 in softclock (arg=0xffffffff81ff6440 <cc_cpu>)
    at /usr/src/sys/kern/kern_timeout.c:869
#19 0xffffffff80b6bd64 in intr_event_execute_handlers (p=<optimized out>, 
    ie=<optimized out>) at /usr/src/sys/kern/kern_intr.c:1129
#20 ithread_execute_handlers (p=<optimized out>, ie=<optimized out>)
    at /usr/src/sys/kern/kern_intr.c:1142
#21 ithread_loop (arg=<optimized out>) at /usr/src/sys/kern/kern_intr.c:1222
#22 0xffffffff80b68c03 in fork_exit (
    callout=0xffffffff80b6bb90 <ithread_loop>, arg=0xfffff8000322e040, 
    frame=0xfffffe001f1fbac0) at /usr/src/sys/kern/kern_fork.c:1060
#23 <signal handler called>
(kgdb) 

tuntest.sh

#!/bin/sh
count=${1:-1000}
sleep=${2:-0}
for i in $(seq 1 $count); do
        printf "[%06d/%06d]\n" $i $count
        tunif=$(sudo ifconfig tun create)

        if [ -n "$tunif" ]; then
                printf "%s created!\n" $tunif
                sudo ifconfig $tunif inet 10.10.1.1/32 10.10.1.2
                if [ $sleep -gt 0 ]; then
                        printf "Sleeping %d seconds...\n" $sleep
                        sleep $sleep
                fi
                printf "Destroying %s...\n" $tunif
                sudo ifconfig $tunif destroy
        else
                printf "Failed to create tun interface.\n"
        fi
done