rev. 1.94 of netinet/in.c broke CARP

Hello, colleagues!

I've just discovered, that revision 1.94 of in.c has broke CARP. This
change adds a code to in_ifdetach() that goes through the global list
of all multicast instances and deletes all the instances, that are
belonging to a particular interface. This is intended to avoid leaking
multicast instances.

Before this change, most of the subsystems, that allocated multicast
membership instances had freed is theirselves. I don't know about others,
but at least CARP is broken now. It attempts to free a memory, that
already has been freed.

The scenario is:

ifconfig vlan0 create
ifconfig vlan0 vlandev em0 vlan 1 10.0.0.1/24
ifconfig carp0 create
ifconfig carp0 vhid 1 10.0.0.2/24
ifconfig vlan0 destroy

The codepath is:

if_detach(vlan0)
event_handler_invoke()
carp_ifdetach(vlan0)
carpdetach(carp0)
carp_multicast_cleanup(carp0)
in_delmulti(a freed inm)

That inm has been freed earlier in if_detach() before event handler has
called its hooks.

Bruce and Robert,

I suppose you can tell me the correct way to deal with multicast
memberships now, when there is a generic GC function for them. Should I
just stop referencing the inms from CARP softc, and don't care about them?

--
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE
_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: rev. 1.94 of netinet/in.c broke CARP
    ... The real fix for netinet is to do what netinet6 does; that is, refcount the memberships and keep them in a list, rather than a vector. ... Unfortunately, due to how CARP works, two bugs were fixed at the expense of introducing another. ... Call multicast cleanup, if we are destroying carp interface itself. ... Resource allocation and free for CARP runs along two separate paths; the case where a member interface is detached cannot be considered the same as when CARP itself is detaching, ...
    (freebsd-net)
  • Re: rev. 1.94 of netinet/in.c broke CARP
    ... the right fix is that CARP needs to have a handler for ... R> ifnet destruction that always runs before the multicast address garbage ... CARP will always have released its multicast address before they ...
    (freebsd-net)
  • Re: rev. 1.94 of netinet/in.c broke CARP
    ... R>>R> ifnet destruction that always runs before the multicast address garbage ... CARP will always have released its multicast address before ... Is adding a generic GC function a correct way or was it better to just fix ...
    (freebsd-net)
  • Re: rev. 1.94 of netinet/in.c broke CARP
    ... the right fix is that CARP needs to have a handler ... for R> ifnet destruction that always runs before the multicast address ... its multicast address before they R> are forceably removed. ...
    (freebsd-net)