Bug 189741
| Summary: | 9/STABLE panic at em_msix_rx w/ em(4) + PF | ||
|---|---|---|---|
| Product: | Base System | Reporter: | ncrogers |
| Component: | amd64 | Assignee: | freebsd-amd64 (Nobody) <amd64> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | Unspecified | ||
| Hardware: | Any | ||
| OS: | Any | ||
|
Description
ncrogers
2014-05-13 00:50:00 UTC
> /usr/src/sys/amd64/amd64/exception.S:232 > #7 0xffffffff8033d350 in pf_addrcpy (dst=0xfffffe010c6416b8, > src=0x10, af=2 '\002') at /usr/src/sys/contrib/pf/net/pf.c:522 A 'src' pointer of 0x10 here would explain the crash (and is consistent with the fault address). > #8 0xffffffff8034872d in pf_test_rule (rm=0xffffff8354538788, > sm=0xffffff8354538780, direction=1, kif=0xfffffe0007d08100, > m=0xfffffe0030555d00, off=20, h=0xfffffe0030bad00e, > pd=0xffffff83545386c0, am=0xffffff8354538790, > rsm=0xffffff8354538778, ifq=0x0, inp=0x0) at > /usr/src/sys/contrib/pf/net/pf.c:3900 This is actually in pf_create_state(), and it would seem that 'nk' would have to be NULL for this to happen. However, 'nsn' would have to be non-NULL. I think I see a possible bug that is fixed in 10. Try this: Index: 9/sys/contrib/pf/net/pf_lb.c =================================================================== --- 9/sys/contrib/pf/net/pf_lb.c (revision 266119) +++ 9/sys/contrib/pf/net/pf_lb.c (working copy) @@ -788,6 +788,7 @@ pool_put(&pf_state_key_pl, *skp); #endif *skw = *sks = *nkp = *skp = NULL; + *sn = NULL; return (NULL); } } -- John Baldwin Thank you! I will give that a shot and let you know if the panic continues. On 5/16/14, 10:51 AM, Nick Rogers wrote:
> Thank you! I will give that a shot and let you know if the panic continues.
I just checked and this was the fix made to HEAD in r260377 for PR
182557. It just needs to be merged. I'll try to get to that today.
--
John Baldwin
Author: jhb Date: Sun May 18 14:18:23 2014 New Revision: 266398 URL: http://svnweb.freebsd.org/changeset/base/266398 Log: MFC 260377: When pf_get_translation() fails, it should leave *sn pointer pristine, otherwise we will panic in pf_test_rule(). PR: amd64/189741 Tested by: Nick Rogers <ncrogers@gmail.com> Modified: stable/9/sys/contrib/pf/net/pf_lb.c Directory Properties: stable/9/sys/ (props changed) stable/9/sys/sys/ (props changed) Modified: stable/9/sys/contrib/pf/net/pf_lb.c ============================================================================== --- stable/9/sys/contrib/pf/net/pf_lb.c Sun May 18 13:05:07 2014 (r266397) +++ stable/9/sys/contrib/pf/net/pf_lb.c Sun May 18 14:18:23 2014 (r266398) @@ -788,6 +788,7 @@ pf_get_translation(struct pf_pdesc *pd, pool_put(&pf_state_key_pl, *skp); #endif *skw = *sks = *nkp = *skp = NULL; + *sn = NULL; return (NULL); } } _______________________________________________ svn-src-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org" State Changed From-To: open->closed Fix merged to 9. Already fixed in 10 and HEAD by glebius@. |
