From owner-freebsd-pf@freebsd.org  Tue Mar  7 01:09:35 2017
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7748DCFACD4
 for <freebsd-pf@mailman.ysv.freebsd.org>; Tue,  7 Mar 2017 01:09:35 +0000 (UTC)
 (envelope-from kp@FreeBSD.org)
Received: from venus.codepro.be (venus.codepro.be [IPv6:2a01:4f8:162:1127::2])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits))
 (Client CN "*.codepro.be", Issuer "Gandi Standard SSL CA 2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 443971FDF
 for <freebsd-pf@freebsd.org>; Tue,  7 Mar 2017 01:09:35 +0000 (UTC)
 (envelope-from kp@FreeBSD.org)
Received: from [10.247.88.168]
 (ec2-54-250-252-97.ap-northeast-1.compute.amazonaws.com [54.250.252.97])
 (Authenticated sender: kp)
 by venus.codepro.be (Postfix) with ESMTPSA id 191941E51F;
 Tue,  7 Mar 2017 02:09:33 +0100 (CET)
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: Kristof Provost <kp@FreeBSD.org>
Mime-Version: 1.0 (1.0)
Subject: Re: sonewconn: pru_attach() failed and kernel panic in PF
Date: Tue, 7 Mar 2017 10:04:00 +0900
Message-Id: <2EA59710-A019-4654-A85C-BE7A7DF56EB3@FreeBSD.org>
References: <CANmv3=xB0Kce4ZQ4GYBE0cNpam0jzGPX7dSYSVBPiT-sryCyHA@mail.gmail.com>
 <D0CD7B4C-2C21-4ABE-9F1B-41E5414A9A8A@FreeBSD.org>
 <F5E22FFD-FE2D-4A1A-B284-D7B660CCF9BF@FreeBSD.org>
Cc: freebsd-pf@freebsd.org
In-Reply-To: <F5E22FFD-FE2D-4A1A-B284-D7B660CCF9BF@FreeBSD.org>
To: Ross <basarevych@gmail.com>
X-Mailer: iPhone Mail (14D27)
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Mar 2017 01:09:35 -0000

So it turns out I shouldn't commit things when jet lagged.=20

You want r314810 in head. The other one was mistakenly done in stable/11. It=
 needed to go there sooner or later so I'm just going to leave it.=20

Regards,
Kristof

> On 5 Mar 2017, at 22:19, Kristof Provost <kp@FreeBSD.org> wrote:
>=20
>> On 5 Mar 2017, at 21:42, Kristof Provost wrote:
>> There=E2=80=99s only a couple of calls to uma_zfree() in pf_get_translati=
ons().
>>=20
>> These are:
>> * uma_zfree(V_pf_state_key_z, skp);
>> * uma_zfree(V_pf_state_key_z, *nkp);
>> * uma_zfree(V_pf_state_key_z, *skp);
>>=20
>> Going by the inconsistent pointer use the first one is rather suspect.
>> Looking a bit deeper, pf_get_translation() is only called from one place,=

>> and it always passes stack variables for skp and nkp, so the first call
>> ends up trying to free that, which won=E2=80=99t work too well.
>>=20
>> That=E2=80=99s a bug (and I=E2=80=99ll fix it), but you=E2=80=99re only r=
unning into it because
>> pf_state_key_clone() returned NULL, which will only happen under memory
>> pressure.
>>=20
> The fix is done in r314702.
>=20
> Regards,
> Kristof