From owner-freebsd-bugs@FreeBSD.ORG Wed Nov 3 08:50:15 2010 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0C1231065697 for ; Wed, 3 Nov 2010 08:50:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 591A48FC27 for ; Wed, 3 Nov 2010 08:50:08 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id oA38o81o027898 for ; Wed, 3 Nov 2010 08:50:08 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id oA38o8co027897; Wed, 3 Nov 2010 08:50:08 GMT (envelope-from gnats) Resent-Date: Wed, 3 Nov 2010 08:50:08 GMT Resent-Message-Id: <201011030850.oA38o8co027897@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, chenyl Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EC3C9106566B for ; Wed, 3 Nov 2010 08:45:36 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id C0B918FC12 for ; Wed, 3 Nov 2010 08:45:36 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id oA38jZ0d094476 for ; Wed, 3 Nov 2010 08:45:35 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id oA38jZNc094475; Wed, 3 Nov 2010 08:45:35 GMT (envelope-from nobody) Message-Id: <201011030845.oA38jZNc094475@www.freebsd.org> Date: Wed, 3 Nov 2010 08:45:35 GMT From: chenyl To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: misc/151908: nd6_ns_input:panic may happen, for RTFREE_LOCKED set rt to 0. X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Nov 2010 08:50:15 -0000 >Number: 151908 >Category: misc >Synopsis: nd6_ns_input:panic may happen, for RTFREE_LOCKED set rt to 0. >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Nov 03 08:50:08 UTC 2010 >Closed-Date: >Last-Modified: >Originator: chenyl >Release: FreeBSD 8.1-RELEASE >Organization: array >Environment: FreeBSD 8.1-RELEASE FreeBSD 8.1-RELEASE #0: Mon Jul 19 02:55:53 UTC 2010 >Description: nd6_ns_input: 256 need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && 257 rt->rt_gateway->sa_family == AF_LINK); 258 if (rt) 259 RTFREE_LOCKED(rt); 260 if (need_proxy) { 261 /* 262 * proxy NDP for single entry 263 */ 264 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 265 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST); 266 if (ifa) { 267 proxy = 1; 268 proxydl = SDL(rt->rt_gateway); 269 } 270 } 271 } L259: RTFREE_LOCKED(rt); rt will be set to 0. L268: rt will be referenced. Panic may happen here. >How-To-Repeat: >Fix: --- nd6_nbr.c 2010-06-14 10:09:06.000000000 +0800 +++ nd6_nbr.c.bak 2010-11-04 00:43:15.000000000 +0800 @@ -255,8 +255,6 @@ nd6_ns_input(struct mbuf *m, int off, in #endif need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && rt->rt_gateway->sa_family == AF_LINK); - if (rt) - RTFREE_LOCKED(rt); if (need_proxy) { /* * proxy NDP for single entry @@ -268,6 +266,10 @@ nd6_ns_input(struct mbuf *m, int off, in proxydl = SDL(rt->rt_gateway); } } + if(!proxy) { + if(rt) + RTFREE_LOCKED(rt); + } } if (ifa == NULL) { /* >Release-Note: >Audit-Trail: >Unformatted: