Hello Hrvoje,

On 23/01/18(Tue) 14:33, Hrvoje Popovski wrote:
> [...] 
> uvm_fault(0xffffffff81b23f30, 0xb8, 0, 1) -> e
                                ^^^^
                        This is the offset of `if_carp'.

Since you're destroying vlans, which are the parent of your carps, we
can assume that `if_carpdev' is NULL which is why you're getting this
fault.

This problem is similar to the one you reported previously with carp
and IPsec.  Diff below should prevent it.

Index: netinet/ip_carp.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_carp.c,v
retrieving revision 1.327
diff -u -p -r1.327 ip_carp.c
--- netinet/ip_carp.c   12 Jan 2018 23:47:24 -0000      1.327
+++ netinet/ip_carp.c   23 Jan 2018 14:29:00 -0000
@@ -601,12 +601,21 @@ carp_proto_input_c(struct ifnet *ifp, st
        struct timeval sc_tv, ch_tv;
        struct srpl *cif;
 
-       if (ifp->if_type == IFT_CARP)
+       KERNEL_ASSERT_LOCKED(); /* touching if_carp + carp_vhosts */
+
+       if (ifp->if_type == IFT_CARP) {
+               /*
+                * If the parent of this carp(4) got destroyed while
+                * `m' was being processed, silently drop it.
+                */
+               if (ifp->if_carpdev == NULL) {
+                       m_freem(m);
+                       return;
+               }
                cif = &ifp->if_carpdev->if_carp;
-       else
+       } else
                cif = &ifp->if_carp;
 
-       KERNEL_ASSERT_LOCKED(); /* touching if_carp + carp_vhosts */
        SRPL_FOREACH_LOCKED(sc, cif, sc_list) {
                if (af == AF_INET &&
                    ismulti != IN_MULTICAST(sc->sc_peer.s_addr))

Reply via email to