Bug 278171

Summary:

Reproducible kernel crash on 14.0-RELEASE and 14.0-STABLE

Product:

Base System

Reporter:

Thomas Dreibholz <thomas.dreibholz>

Component:

kern

Assignee:

Michael Tuexen <tuexen>

Status:

Closed FIXED

Severity:

Affects Some People

CC:

markj, tuexen

Priority:

---

Flags:

tuexen: mfc-stable14+

Version:

14.0-RELEASE

Hardware:

Any

OS:

Any

Attachments:

Description	Flags
PCAP trace of the SCTP communication	none
/var/crash/info.0	none

Description Thomas Dreibholz 2024-04-04 16:42:24 UTC

Created attachment 249709 [details]
PCAP trace of the SCTP communication

I made some tests with rsplib (https://github.com/dreibh/rsplib) on freshly installed FreeBSD VMs (14.0-RELEASE and 14.0-STABLE) under VirtualBox as well as Proxmox. With the following simple steps, I can reproducibly crash all these systems:

Build:
git clone https://github.com/dreibh/rsplib
cd rsplib
cmake . -DENABLE_QT=OFF
make
cd src
./rspregistrar

In another shell, or on another machine in the same network:
./rspserver
=> crash with reboot

Background:
rspserver finds rspregistrar by its ASAP Announces via UDP. Then, it establishes an SCTP association via SCTP 1-to-many-style socket calls. For the established association to rspregistrar, it calls sctp_peeloff() to get a new socket descriptor. I suspect that something is wrong here with SCTP, leading to the crash.

Attachments:
* A PCAP trace on another machine, where rspregistrar had been started, in order to get a PCAP trace up to the crash.

Comment 1 Thomas Dreibholz 2024-04-04 16:43:08 UTC

Created attachment 249710 [details]
/var/crash/info.0

Comment 2 Mark Johnston freebsd_committer

2024-04-04 16:47:22 UTC

Could you please also provide the core.txt file?

Comment 3 Michael Tuexen freebsd_committer

2024-04-04 17:00:22 UTC

Hi Thomas,

thank for testing rsplib on a recent version of FreeBSD. I can reproduce the issue on FreeBSD main. I'll take a look.

Best regards
Michael

Comment 4 Michael Tuexen freebsd_committer

2024-04-04 21:29:46 UTC

A patch is under review D44640.

Comment 5 commit-hook freebsd_committer

2024-04-05 16:22:57 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=681711b77cde2cf3d64dc1e4951ec8287bc4f3e8

commit 681711b77cde2cf3d64dc1e4951ec8287bc4f3e8
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2024-04-05 16:14:54 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2024-04-05 16:20:19 +0000

    uipc_socket: handle socket buffer locks in sopeeloff

    PR:                     278171
    Reviewed by:            markj
    Fixes:                  a4fc41423f7d ("sockets: enable protocol specific socket buffers")
    MFC after:              3 days
    Differential Revision:  https://reviews.freebsd.org/D44640

 sys/kern/uipc_socket.c | 4 ++++
 1 file changed, 4 insertions(+)

Comment 6 Thomas Dreibholz 2024-04-10 10:22:21 UTC

Commit 681711b77cde2cf3d64dc1e4951ec8287bc4f3e8 fixes the issue.

Comment 7 commit-hook freebsd_committer

2024-04-17 13:59:47 UTC

A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=7a019565ff6dc6efb5c6ab091343740fd6dd0377

commit 7a019565ff6dc6efb5c6ab091343740fd6dd0377
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2024-04-05 16:14:54 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2024-04-17 13:58:22 +0000

    uipc_socket: handle socket buffer locks in sopeeloff

    PR:                     278171
    Reviewed by:            markj
    Fixes:                  a4fc41423f7d ("sockets: enable protocol specific socket buffers")
    Differential Revision:  https://reviews.freebsd.org/D44640

    (cherry picked from commit 681711b77cde2cf3d64dc1e4951ec8287bc4f3e8)

 sys/kern/uipc_socket.c | 4 ++++
 1 file changed, 4 insertions(+)