From nobody Thu Oct 26 08:29:40 2023 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SGJr72R66z4xTt5 for ; Thu, 26 Oct 2023 08:29:43 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4SGJr71m33z3Gwp; Thu, 26 Oct 2023 08:29:43 +0000 (UTC) (envelope-from kp@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1698308983; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=q/P+cbvsmwYHSyjGdrtF38sOoSM2PNFKD7R2Kfryfqk=; b=J0ZRQmCJqSJcb0q4uoFTT9Vfd0D4hK2sv1j/KyJ1Fedd7NiNFPY1TId0NzE24KTKTpeGDX RvBB5Xm7J85VMSMTsjaa5UF2ogRgL1D3j93u/Ol9be6IH1Mp/xuMOq/lQ5+inzZlvQx34z JH4rnXZMqReAWFVT4x9MQUD9F4yQq2U+zRQSi7n80cB7HAIFjfj/ELPG0rHvm79lR/Kz0i 9EydoM+slB3Rnx8UVL/VRZJs+/3+eeengxuIK1hMIrkhJBG28OxVFpQ62VGhmRv5esTmh4 GgYMp7wPCS6f+HfEAR/6UHGfBYGWASIJXlB9Lx8Mv/royDVBwuMJWXSZs9zW9A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1698308983; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=q/P+cbvsmwYHSyjGdrtF38sOoSM2PNFKD7R2Kfryfqk=; b=MlN+idCkx0VC2gLBbqMrS42KqOUJ6FBWkxoFGtZvcJJZQmEmmwKPrXWe3T7c03yNu2OCB1 xIDSVBRVjCWSeU6wOjlGWDoJinsJ4T2a23HHO5ArAFY5NKNBEJvRAGgTy3+aiu2QheBBek uloiqErPFf19j5KbhwwnmewrVCslaO5xhQVuM+6cakXk0l0sZ4BckLk3H4JjJEhNnfM/xP MgRIAwXnoHnWmli4foGYN8uaRsBnfxpElTXO21O+V5zNj8Sz6yoOGdDGHiYeNcRT+mprpv fx00dEKnc7tI9ysHjzlvwvEh07xwdG+pTIUtbpL5XjHvV/m66STDspgXT3a8bg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1698308983; a=rsa-sha256; cv=none; b=TjzktMGE15Zf1bCfdoWcOXmW5/b31lcUYEhSFsWV3RfIzbjVWWZJJp+C6HQy+gDt/ifvdt 1AQBFbXFAoss4ug9qAHhelgPY4kPNj5a7P6f6zSIn825AyrAxpafQNq6H9QruS444tos66 VFmQ3fD5aXZTV35M1vuJ+iP98mAMZquWDpXFWMQvOgTgbLvdBCmrZCkWk5XyMntEqBqC3y /aorPHIlcDAP0jleEMIPomxTc2I4s9vMDzAdzsATnEpU52h0hx6NGbNXOI2arOHA6/R+1X 79G2G6qyGkvJbLDLqrnwVF7O2gXDUm5SIe1ZygDZqe4MKzPGB0cklj1qRiwJzQ== Received: from venus.codepro.be (venus.codepro.be [5.9.86.228]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mx1.codepro.be", Issuer "R3" (verified OK)) (Authenticated sender: kp) by smtp.freebsd.org (Postfix) with ESMTPSA id 4SGJr701q8z1Cdt; Thu, 26 Oct 2023 08:29:42 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: by venus.codepro.be (Postfix, authenticated sender kp) id 6E25E1CC84; Thu, 26 Oct 2023 10:29:41 +0200 (CEST) From: Kristof Provost To: Zhenlei Huang Cc: FreeBSD Net , Alexander Chernikov Subject: Re: fib6_lookup() returning deleted struct ifnet Date: Thu, 26 Oct 2023 10:29:40 +0200 X-Mailer: MailMate (1.14r5937) Message-ID: <2B21403B-A939-4484-B83B-85ECDC51D22A@FreeBSD.org> In-Reply-To: <3A4AA88F-E352-46DC-81DB-7408CD0A4D77@FreeBSD.org> References: <3A4AA88F-E352-46DC-81DB-7408CD0A4D77@FreeBSD.org> List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 26 Oct 2023, at 3:49, Zhenlei Huang wrote: >> On Oct 25, 2023, at 11:27 PM, Kristof Provost wrote: >> The call in tcp_default_output() is in6_selecthlim(int, NULL);, so we = don=E2=80=99t get an ifp from the caller, but instead perform a route loo= kup, and try to obtain the hop limit through ND_IFINFO(nh->nh_ifp). This = panics because the afdata[AF_INET6] pointer is NULL. The core dump shows = a deleted structure ifnet: >> >> > > `egrep -r 'if_afdata\[AF_INET6\]\s*[!=3D]=3D\s*NULL' sys/netinet6'` sho= ws there're many places do the NULL check. I think we can do it in in6_se= lecthlim() as a workaround. > We could (either check for if_afdata[AF_INET], or for the absence of IFF_= DYING in if_flags), but that feels a lot like hiding the problem rather t= han fixing it. As you say, fib6_lookup() should not be returning invalid next hops, so i= t might make sense to add the check there, but I still want to understand= why we end up in this state in the first place. >> We=E2=80=99ve also gone through if_free(), as the ifindex_table no lon= ger contains the struct ifnet pointer for the relevant interface. >> We appear to have not yet called if_free_deferred() (and indeed, ifp->= if_refcount is 4, so we wouldn=E2=80=99t have called that yet). >> >> I=E2=80=99m confused as to how this can happen, and would appreciate h= ints. >> > > I believe Alexander has insight on this. > I=E2=80=99m certainly hoping smarter people than me will know more :) Best regards, Kristof