IGMP snooping breaks VIF functionality

[rrendec]

While IGMP snooping is active, the kernel crashes as soon as a VIF is assigned an IP address.

Steps to reproduce

[root@chimera tools]# ./swctl add eth2
[root@chimera tools]# ./swctl add eth3
[root@chimera tools]# ./swctl addvlan 2 test
[root@chimera tools]# ./swctl addvif 2
[root@chimera tools]# ip addr add 10.0.0.1/24 dev vlan2

Netconsole output

device eth2 entered promiscuous mode
e1000: eth2 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
ADDRCONF(NETDEV_UP): eth2: link is not ready
ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready
device eth3 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth3: link is not ready
e1000: eth3 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
ADDRCONF(NETDEV_CHANGE): eth3: link becomes ready
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<e10a9a13>] sw_forward+0x273/0x640 [switch]
*pdpt = 000000001f9f9001 *pde = 000000001f9ee067 *pte = 0000000000000000 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/virtual/net/vlan2/address
Modules linked in: switch netconsole configfs ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 ppdev parport_pc parport i2c_piix4 i2c_core snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000 sg ext4 mbcache jbd2 sd_mod crc_t10dif sr_mod cdrom ahci pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]


Pid: 0, comm: swapper Not tainted 2.6.32-279.9.1.el6.lisa2.0.1.build3.i686 #1 innotek GmbH VirtualBox/VirtualBox
EIP: 0060:[<e10a9a13>] EFLAGS: 00010246 CPU: 0
EIP is at sw_forward+0x273/0x640 [switch]
EAX: 00000000 EBX: de265080 ECX: de27c010 EDX: de26d444
ESI: 00000000 EDI: 00000002 EBP: c0a1bd7c ESP: c0a1bd10
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process swapper (pid: 0, ti=c0a1a000 task=c0a425e0 task.ti=c0a1a000)
Stack:
 00000000 e10bd378 de26d444 00000002 e10ad060 c051f701 00000246 1600005e
<0> c0c4e820 00000246 e0fcf40b e0fc9644 de466148 00000020 00000004 0000000c
<0> 00000246 e10227ef 00015080 00000000 de265080 e0fccfdf de265080 de26d3e0
Call Trace:
 [<c051f701>] ? __kmalloc+0x131/0x180
 [<e0fcf40b>] ? __nf_ct_ext_add+0x13b/0x1a0 [nf_conntrack]
 [<e0fc9644>] ? __nf_conntrack_find+0x74/0x110 [nf_conntrack]
 [<e10227ef>] ? ipt_do_table+0x28f/0x580 [ip_tables]
 [<e0fccfdf>] ? packet+0x1f/0x30 [nf_conntrack]
 [<e10abd2e>] ? sw_vif_hard_start_xmit+0x5e/0x90 [switch]
 [<c0794e69>] ? dev_hard_start_xmit+0x199/0x410
 [<e0fca34b>] ? __nf_conntrack_confirm+0x15b/0x340 [nf_conntrack]
 [<c07ad4f3>] ? sch_direct_xmit+0x113/0x180
 [<e10464c8>] ? ipv4_confirm+0x68/0x190 [nf_conntrack_ipv4]
 [<c0798f7d>] ? dev_queue_xmit+0x4ed/0x6f0
 [<c07ac888>] ? eth_header+0x28/0xc0
 [<c07ac860>] ? eth_header+0x0/0xc0
 [<c079d10d>] ? neigh_resolve_output+0xdd/0x330
 [<c07c68c4>] ? ip_finish_output+0x1c4/0x280
 [<c07c6a0a>] ? ip_output+0x8a/0xb0
 [<c07c5ec5>] ? ip_local_out+0x15/0x20
 [<c07f101a>] ? igmp_ifc_timer_expire+0x25a/0x2e0
 [<c0466991>] ? run_timer_softirq+0x131/0x2b0
 [<c07f0dc0>] ? igmp_ifc_timer_expire+0x0/0x2e0
 [<c045cf6a>] ? __do_softirq+0x8a/0x1a0
 [<c045d0bd>] ? do_softirq+0x3d/0x50
 [<c045d215>] ? irq_exit+0x65/0x70
 [<c0428dc3>] ? smp_apic_timer_interrupt+0x53/0x90
 [<c083f505>] ? apic_timer_interrupt+0x31/0x38
 [<c04118a1>] ? mwait_idle+0x61/0xc0
 [<c0408964>] ? cpu_idle+0x94/0xd0
 [<c0aa79fc>] ? start_kernel+0x3b0/0x3b5
 [<c0aa748a>] ? unknown_bootoption+0x0/0x190
Code: 24 0c 8b 44 24 0c 8b 54 24 08 83 c6 07 85 ff 8b 7c 24 0c 0f 49 74 24 0c c1 f8 1f c1 e8 1d 01 c7 83 e7 07 29 c7 8b 42 1c c1 fe 03 <0f> b6 04 30 0f a3 f8 0f 82 dd 01 00 00 8b 4c 24 10 8b 01 39 c1 
EIP: [<e10a9a13>] sw_forward+0x273/0x640 [switch] SS:ESP 0068:c0a1bd10
CR2: 0000000000000000
---[ end trace 669a8703b8bb24f3 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Pid: 0, comm: swapper Tainted: G      D    ---------------    2.6.32-279.9.1.el6.lisa2.0.1.build3.i686 #1
Call Trace:
 [<c083c48c>] ? panic+0x68/0x11c
 [<c0840398>] ? oops_end+0xc8/0xd0
 [<c0433dd2>] ? no_context+0xc2/0x190
 [<c0433fff>] ? bad_area_nosemaphore+0xf/0x20
 [<c04344e8>] ? __do_page_fault+0x2d8/0x430
 [<c07e7397>] ? arp_constructor+0x167/0x1a0
 [<c07e70fb>] ? arp_bind_neighbour+0x9b/0xa0
 [<c0841cea>] ? do_page_fault+0x2a/0x90
 [<c0841cc0>] ? do_page_fault+0x0/0x90
 [<c083f777>] ? error_code+0x73/0x78
 [<e10a9a13>] ? sw_forward+0x273/0x640 [switch]
 [<c051f701>] ? __kmalloc+0x131/0x180
 [<e0fcf40b>] ? __nf_ct_ext_add+0x13b/0x1a0 [nf_conntrack]
 [<e0fc9644>] ? __nf_conntrack_find+0x74/0x110 [nf_conntrack]
 [<e10227ef>] ? ipt_do_table+0x28f/0x580 [ip_tables]
 [<e0fccfdf>] ? packet+0x1f/0x30 [nf_conntrack]
 [<e10abd2e>] ? sw_vif_hard_start_xmit+0x5e/0x90 [switch]
 [<c0794e69>] ? dev_hard_start_xmit+0x199/0x410
 [<e0fca34b>] ? __nf_conntrack_confirm+0x15b/0x340 [nf_conntrack]
 [<c07ad4f3>] ? sch_direct_xmit+0x113/0x180
 [<e10464c8>] ? ipv4_confirm+0x68/0x190 [nf_conntrack_ipv4]
 [<c0798f7d>] ? dev_queue_xmit+0x4ed/0x6f0
 [<c07ac888>] ? eth_header+0x28/0xc0
 [<c07ac860>] ? eth_header+0x0/0xc0
 [<c079d10d>] ? neigh_resolve_output+0xdd/0x330
 [<c07c68c4>] ? ip_finish_output+0x1c4/0x280
 [<c07c6a0a>] ? ip_output+0x8a/0xb0
 [<c07c5ec5>] ? ip_local_out+0x15/0x20
 [<c07f101a>] ? igmp_ifc_timer_expire+0x25a/0x2e0
 [<c0466991>] ? run_timer_softirq+0x131/0x2b0
 [<c07f0dc0>] ? igmp_ifc_timer_expire+0x0/0x2e0
 [<c045cf6a>] ? __do_softirq+0x8a/0x1a0
 [<c045d0bd>] ? do_softirq+0x3d/0x50
 [<c045d215>] ? irq_exit+0x65/0x70
 [<c0428dc3>] ? smp_apic_timer_interrupt+0x53/0x90
 [<c083f505>] ? apic_timer_interrupt+0x31/0x38
 [<c04118a1>] ? mwait_idle+0x61/0xc0
 [<c0408964>] ? cpu_idle+0x94/0xd0
 [<c0aa79fc>] ? start_kernel+0x3b0/0x3b5
 [<c0aa748a>] ? unknown_bootoption+0x0/0x190

[rrendec]

Perhaps it's better to leave igmp snooping disabled by default and, at module loading time, only enable it if igmp_snooping=1 is passed as module parameter.

Reasoning:

• The reason why it should be disabled is obvious: to avoid confusing developers, existing users and new users who may experiment with lisa.
• The reason for adding a module parameter is to keep backwards compatibility and config builder compatiblity - the config builder only adds "no ip igmp snooping" when igmp snooping is disabled, as it assumes that igmp snooping is enabled by default.

Somebody should check if igmp snooping is enabled by default on Cisco. If it's not, then adding the module parameter makes no sense, we should not enable igmp snooping by default, and the logic inside the config builder should be changed accordingly.