Is this related to https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=234985 <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=234985> and https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238326 <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238326>
/Peter > 21 juli 2020 kl. 22:23 skrev John-Mark Gurney <j...@funkthat.com>: > > Marko Zec wrote this message on Tue, Jul 21, 2020 at 11:31 +0200: >> On Tue, 21 Jul 2020 02:16:55 -0700 >> John-Mark Gurney <j...@funkthat.com> wrote: >> >>> I'm running: >>> FreeBSD test 13.0-CURRENT FreeBSD 13.0-CURRENT #0 r362596: Thu Jun 25 >>> 05:02:51 UTC 2020 >>> r...@releng1.nyi.freebsd.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC >>> amd64 >>> >>> and I'm working on improve the if_ure driver. I've put together a >>> little script that I've attached that I'm using to test the driver.. >>> It puts a couple ue interfaces each into their own jail, configures >>> them, and tries to pass traffic. This assumes that the two interfaces >>> are connected together. >>> >>> Pretty regularly when destroying the jails, I get the following >>> panic: CURVNET_SET at /usr/src/sys/netinet/in_mcast.c:626 >>> inm_release() curvnet=0 vnet=0xfffff80154c82a80 >> >> Perhaps the attached patch could help? (disclaimer: not even >> compile-tested) > > The patch compiled, but it just moved the panic earlier than before. > > #4 0xffffffff80bc2123 in panic (fmt=<unavailable>) > at ../../../kern/kern_shutdown.c:839 > #5 0xffffffff80d61726 in inm_release_task (arg=<optimized out>, > pending=<optimized out>) at ../../../netinet/in_mcast.c:633 > #6 0xffffffff80c2166a in taskqueue_run_locked (queue=0xfffff800033cfd00) > at ../../../kern/subr_taskqueue.c:476 > #7 0xffffffff80c226e4 in taskqueue_thread_loop (arg=<optimized out>) > at ../../../kern/subr_taskqueue.c:793 > > Now it panics at the location of the new CURVNET_SET and not the > old one.. > > Ok, decided to dump the contents of the vnet, and it looks like > it's a use after free: > (kgdb) print/x *(struct vnet *)0xfffff8012a283140 > $2 = {vnet_le = {le_next = 0xdeadc0dedeadc0de, le_prev = 0xdeadc0dedeadc0de}, > vnet_magic_n = 0xdeadc0de, > vnet_ifcnt = 0xdeadc0de, vnet_sockcnt = 0xdeadc0de, vnet_state = 0xdeadc0de, > vnet_data_mem = 0xdeadc0dedeadc0de, > vnet_data_base = 0xdeadc0dedeadc0de, vnet_shutdown = 0xde} > > The patch did seem to make it happen quicker, or maybe I was just more > lucky this morning... > >>> (kgdb) #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55 >>> #1 doadump (textdump=1) at /usr/src/sys/kern/kern_shutdown.c:394 >>> #2 0xffffffff80bc6250 in kern_reboot (howto=260) >>> at /usr/src/sys/kern/kern_shutdown.c:481 >>> #3 0xffffffff80bc66aa in vpanic (fmt=<optimized out>, ap=<optimized >>> out>) at /usr/src/sys/kern/kern_shutdown.c:913 >>> #4 0xffffffff80bc6403 in panic (fmt=<unavailable>) >>> at /usr/src/sys/kern/kern_shutdown.c:839 >>> #5 0xffffffff80d6553b in inm_release (inm=0xfffff80029043700) >>> at /usr/src/sys/netinet/in_mcast.c:630 >>> #6 inm_release_task (arg=<optimized out>, pending=<optimized out>) >>> at /usr/src/sys/netinet/in_mcast.c:312 >>> #7 0xffffffff80c2521a in taskqueue_run_locked >>> (queue=0xfffff80003116b00) at /usr/src/sys/kern/subr_taskqueue.c:476 >>> #8 0xffffffff80c26294 in taskqueue_thread_loop (arg=<optimized out>) >>> at /usr/src/sys/kern/subr_taskqueue.c:793 >>> #9 0xffffffff80b830f0 in fork_exit ( >>> callout=0xffffffff80c26200 <taskqueue_thread_loop>, >>> arg=0xffffffff81cf4f70 <taskqueue_thread>, >>> frame=0xfffffe0049e99b80) at /usr/src/sys/kern/kern_fork.c:1052 >>> #10 <signal handler called> >>> (kgdb) >>> >>> I have the core files so I can get additional information. >>> >>> Let me know if you need any additional information. >>> >> > >> Index: sys/netinet/in_mcast.c >> =================================================================== >> --- sys/netinet/in_mcast.c (revision 363386) >> +++ sys/netinet/in_mcast.c (working copy) >> @@ -309,8 +309,10 @@ >> IN_MULTI_LOCK(); >> SLIST_FOREACH_SAFE(inm, &inm_free_tmp, inm_nrele, tinm) { >> SLIST_REMOVE_HEAD(&inm_free_tmp, inm_nrele); >> + CURVNET_SET(inm->inm_ifp->if_vnet); >> MPASS(inm); >> inm_release(inm); >> + CURVNET_RESTORE(); >> } >> IN_MULTI_UNLOCK(); >> } > > > -- > John-Mark Gurney Voice: +1 415 225 5579 > > "All that I will do, has been done, All that I have, has not." > _______________________________________________ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" _______________________________________________ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"