Skip site navigation (1)Skip section navigation (2) 
Date:      Sun, 19 Dec 2021 11:20:37 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 260539] inp_next() NULL inp dereference?
Message-ID:  <bug-260539-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D260539

            Bug ID: 260539
           Summary: inp_next() NULL inp dereference?
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

In inp_next(), in this for-loop:

        if (ii->inp =3D=3D NULL) {          /* First call. */
                smr_enter(ipi->ipi_smr);
                /* This is unrolled CK_LIST_FOREACH(). */
                for (inp =3D II_LIST_FIRST(ipi, hash);
                    inp !=3D NULL;
                    inp =3D II_LIST_NEXT(inp, hash)) {
                        if (match !=3D NULL && (match)(inp, ctx) =3D=3D fal=
se)
                                continue;
                        if (__predict_true(inp_smr_lock(inp, lock)))
                                break;
                        else {
                                smr_enter(ipi->ipi_smr);
                                MPASS(inp !=3D II_LIST_FIRST(ipi, hash));
                                inp =3D II_LIST_FIRST(ipi, hash);
                        }
                }

I wonder if the last "inp =3D II_LIST_FIRST(ipi, hash)" ought to be
followed by "if(inp =3D=3D NULL) break", since it will be immediately
followed by the for-loop's II_LIST_NEXT().

I bring this up because I've seen a kernel page fault in the
for-loop's II_LIST_NEXT due to a NULL inp. However, I cannot reproduce
it. It occured at a time when the kernel was killing processes due to
low memory.

FreeBSD  14.0-CURRENT FreeBSD 14.0-CURRENT #165
main-n250912-e4746deeda02-dirty: Sat Dec 18 05:12:30 EST 2021=20=20=20=20
rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM  riscv

panic: Fatal page fault at 0xffffffc0003a6750: 0x000000000001b8
--- exception 13, tval =3D 0x1b8
ck_pr_md_load_ptr() at ck_pr_md_load_ptr+0x14
inp_next() at inp_next+0x206
tcp_drain() at tcp_drain+0xcc
mb_reclaim() at mb_reclaim+0x78
vm_pageout_lowmem() at vm_pageout_lowmem+0xf8
vm_pageout_worker() at vm_pageout_worker+0x1ba
vm_pageout() at vm_pageout+0x1ce
fork_exit() at fork_exit+0x80
fork_trampoline() at fork_trampoline+0xa

--=20
You are receiving this mail because:
You are the assignee for the bug.=

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-260539-227>