From owner-freebsd-i386@FreeBSD.ORG Thu Feb 5 00:30:20 2004 Return-Path: Delivered-To: freebsd-i386@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 535DF16A4D8 for ; Thu, 5 Feb 2004 00:30:20 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id D17F843D46 for ; Thu, 5 Feb 2004 00:30:16 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i158UFFR076064 for ; Thu, 5 Feb 2004 00:30:15 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i158UFHo076060; Thu, 5 Feb 2004 00:30:15 -0800 (PST) (envelope-from gnats) Resent-Date: Thu, 5 Feb 2004 00:30:15 -0800 (PST) Resent-Message-Id: <200402050830.i158UFHo076060@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-i386@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, "Roberto Trovo'" Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B416716A4CF for ; Thu, 5 Feb 2004 00:20:52 -0800 (PST) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id A760F43D39 for ; Thu, 5 Feb 2004 00:20:50 -0800 (PST) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.12.10/8.12.10) with ESMTP id i158KjdL094010 for ; Thu, 5 Feb 2004 00:20:46 -0800 (PST) (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.12.10/8.12.10/Submit) id i158KjaK094008; Thu, 5 Feb 2004 00:20:45 -0800 (PST) (envelope-from nobody) Message-Id: <200402050820.i158KjaK094008@www.freebsd.org> Date: Thu, 5 Feb 2004 00:20:45 -0800 (PST) From: "Roberto Trovo'" To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.0 Subject: i386/62374: kernel panic: free: multiple frees X-BeenThere: freebsd-i386@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: I386-specific issues for FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Feb 2004 08:30:20 -0000 >Number: 62374 >Category: i386 >Synopsis: kernel panic: free: multiple frees >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-i386 >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Feb 05 00:30:14 PST 2004 >Closed-Date: >Last-Modified: >Originator: Roberto Trovo' >Release: FreeBSD 4.9-RELEASE i386 >Organization: >Environment: System: FreeBSD microbsd 4.9-RELEASE FreeBSD 4.9-RELEASE #0: Mon Oct 27 17:51:09 GMT 2003 root@freebsd-stable.sentex.ca:/usr/obj/usr/src/sys/GENERIC i386 >Description: FreeBSD 4.9-RELEASE CPU: VIA EDEN 500MHz (MB CV860A) RAM: 256MB DISK: 128MB Compact Flash No swap 3 10/100Mbit NIC, realteck on board Bridge 020214 + ipf 3.4.31 enabled Two NIC are configured in the bridge and ipf (transparent filtering) filter the packets through the bridge. sysctl -a: net.link.ether.bridge_cfg: rl0:0,rl1:0 net.link.ether.bridge: 1 net.link.ether.bridge_ipfw: 0 net.link.ether.bridge_ipf: 1 net.link.ether.bridge_ipfw_drop: 0 net.link.ether.bridge_ipfw_collisions: 0 ----- The bridge connects two identical LAN with the same IPs but filter some packet to protect the internal LAN. Only the NIC on internal LAN is setup with a IP address. A simple ipf rules are loaded: block in log on rl1 all block in log on rl0 all pass in quick on rl1 proto udp from 192.168.0.0/16 port = 67 to 255.255.255.255 port = 68 pass in quick on rl1 proto udp from 192.168.0.0/16 port = 67 to 192.168.0.0/16 port = 68 pass in quick on rl1 proto tcp from 192.168.0.0/16 to 192.168.0.20/32 port = 9100 block in quick on rl1 from 10.0.0.0/8 to any block in quick on rl1 from 172.16.0.0/12 to any block in quick on rl1 from 192.168.0.0/16 to any pass in quick on rl0 proto tcp from 192.168.0.0/16 to any keep state pass in quick on rl0 proto udp from 192.168.0.0/16 to any keep state pass in quick on rl0 proto icmp from 192.168.0.0/16 to any keep state pass in quick on rl0 proto gre from 192.168.0.0/16 to any keep state pass in quick on rl0 proto ip from 192.168.0.0/16 to any keep state pass in quick on rl0 proto udp from 0.0.0.0 port = 68 to 255.255.255.255 port = 67 pass in quick on rl1 proto udp from 0.0.0.0 port = 67 to 255.255.255.255 port = 68 pass in quick on rl0 proto udp from 0.0.0.0 port = 68 to 192.168.0.0/16 port = 67 ======= end ipf ruleset >From internal LAN I've started a ping flooding on a host on the external LAN passing through the bridge. (ex. ping -f 192.168.0.1 ) In about 5 min. the system crash with the messages: panic: free: multiple frees syncing disk... done uptime: 4m51s .. >How-To-Repeat: I've repeated the same steps, and in all the test (3-4 times) the systems crash. >Fix: >Release-Note: >Audit-Trail: >Unformatted: