From owner-freebsd-bugs@FreeBSD.ORG Fri May 2 05:50:00 2014 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id C8F00DCD for ; Fri, 2 May 2014 05:50:00 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A60F01B65 for ; Fri, 2 May 2014 05:50:00 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s425o0Xc016209 for ; Fri, 2 May 2014 05:50:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s425o0Yp016207; Fri, 2 May 2014 05:50:00 GMT (envelope-from gnats) Resent-Date: Fri, 2 May 2014 05:50:00 GMT Resent-Message-Id: <201405020550.s425o0Yp016207@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, David Cross Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 5CCE1C24 for ; Fri, 2 May 2014 05:40:05 +0000 (UTC) Received: from cgiserv.freebsd.org (cgiserv.freebsd.org [IPv6:2001:1900:2254:206a::50:4]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 31E5D1AA0 for ; Fri, 2 May 2014 05:40:05 +0000 (UTC) Received: from cgiserv.freebsd.org ([127.0.1.6]) by cgiserv.freebsd.org (8.14.8/8.14.8) with ESMTP id s425e3mD041437 for ; Fri, 2 May 2014 05:40:03 GMT (envelope-from nobody@cgiserv.freebsd.org) Received: (from nobody@localhost) by cgiserv.freebsd.org (8.14.8/8.14.8/Submit) id s425e1IM040758; Fri, 2 May 2014 05:40:01 GMT (envelope-from nobody) Message-Id: <201405020540.s425e1IM040758@cgiserv.freebsd.org> Date: Fri, 2 May 2014 05:40:01 GMT From: David Cross To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: kern/189219: using dummynet on sparc64 and configuring a pipe is an insta-panic X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 May 2014 05:50:00 -0000 >Number: 189219 >Category: kern >Synopsis: using dummynet on sparc64 and configuring a pipe is an insta-panic >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri May 02 05:50:00 UTC 2014 >Closed-Date: >Last-Modified: >Originator: David Cross >Release: 10.0 >Organization: >Environment: FreeBSD REDACTED 10.0-RELEASE FreeBSD 10.0-RELEASE #1: Sat Apr 26 00:00:39 EDT 2014 root@REDACTED:/usr/obj/usr/src/sys/GWSPARC sparc64 >Description: enabling ipfw with dummynet and running ipfw pipe 1 config bw 100mbit panics the machine on an unaligned memory access >How-To-Repeat: spar64 machine + ipfw + dummynet, then run: ipfw pipe 1 config bw 100mbit >Fix: A bit of a kludge, basically creates a new structure in memory to force align it, and then copies it all over (after verifying length) --- src/sys/netpfil/ipfw/ip_dummynet.c.orig 2014-05-02 01:36:59.000000000 -0400 +++ src/sys/netpfil/ipfw/ip_dummynet.c 2014-05-02 01:35:58.000000000 -0400 @@ -1210,15 +1210,18 @@ * configure a link (and its FIFO instance) */ static int -config_link(struct dn_link *p, struct dn_id *arg) +config_link(struct dn_link *op, struct dn_id *arg) { + struct dn_link np; int i; - if (p->oid.len != sizeof(*p)) { - D("invalid pipe len %d", p->oid.len); + bcopy(&(op->oid.len), &(np.oid.len), sizeof(np.oid.len)); + if (np.oid.len != sizeof(np)) { + D("invalid pipe len %d", np.oid.len); return EINVAL; } - i = p->link_nr; + bcopy(op, &np, sizeof(np)); + i = np.link_nr; if (i <= 0 || i >= DN_MAX_ID) return EINVAL; /* @@ -1228,9 +1231,9 @@ * qsize = slots/bytes * burst ??? */ - p->delay = (p->delay * hz) / 1000; + np.delay = (np.delay * hz) / 1000; /* Scale burst size: bytes -> bits * hz */ - p->burst *= 8 * hz; + np.burst *= 8 * hz; DN_BH_WLOCK(); /* do it twice, base link and FIFO link */ @@ -1247,15 +1250,15 @@ s->profile = NULL; } /* copy all parameters */ - s->link.oid = p->oid; + s->link.oid = np.oid; s->link.link_nr = i; - s->link.delay = p->delay; - if (s->link.bandwidth != p->bandwidth) { + s->link.delay = np.delay; + if (s->link.bandwidth != np.bandwidth) { /* XXX bandwidth changes, need to update red params */ - s->link.bandwidth = p->bandwidth; + s->link.bandwidth = np.bandwidth; update_red(s); } - s->link.burst = p->burst; + s->link.burst = np.burst; schk_reset_credit(s); } dn_cfg.id++; >Release-Note: >Audit-Trail: >Unformatted: >panic<