From owner-freebsd-pf@freebsd.org Thu Dec 31 20:56:47 2015 Return-Path: Delivered-To: freebsd-pf@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0DF70A56EB5 for ; Thu, 31 Dec 2015 20:56:47 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E8FC617E5 for ; Thu, 31 Dec 2015 20:56:46 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id tBVKukHV081623 for ; Thu, 31 Dec 2015 20:56:46 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-pf@FreeBSD.org Subject: [Bug 205743] null pointer dereference in PF running a vimage jail Date: Thu, 31 Dec 2015 20:56:46 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 11.0-CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: ing.gila@gmail.com X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-pf@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2015 20:56:47 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D205743 --- Comment #4 from gila --- I've applied the patch against 0efa1469be94566c09b9f4ce538c28e92d26026c and there is another panic. (kgdb) bt #0 doadump (textdump=3D0x1) at pcpu.h:221 During symbol reading, Incomplete CFI data; unspecified registers at 0xffffffff80a9ed76. #1 0xffffffff80a9eaa3 in kern_reboot (howto=3D0x104) at /usr/src/sys/kern/kern_shutdown.c:364 #2 0xffffffff80a9f00b in vpanic (fmt=3D, ap=3D) at /usr/src/sys/kern/kern_shutdown.c:757 #3 0xffffffff80a9ee43 in panic (fmt=3D0x0) at /usr/src/sys/kern/kern_shutdown.c:688 #4 0xffffffff8038a3b7 in db_panic (addr=3D, have_addr= =3D0x0, count=3D0x0, modif=3D0x0) at /usr/src/sys/ddb/db_command.c:473 #5 0xffffffff8038993e in db_command (cmd_table=3D0x0) at /usr/src/sys/ddb/db_command.c:440 #6 0xffffffff803896d4 in db_command_loop () at /usr/src/sys/ddb/db_command.c:493 #7 0xffffffff8038c1db in db_trap (type=3D, code=3D0x0= ) at /usr/src/sys/ddb/db_main.c:251 #8 0xffffffff80ae3803 in kdb_trap (type=3D0xc, code=3D0x0, tf=3D) at /usr/src/sys/kern/subr_kdb.c:654 #9 0xffffffff80f8e711 in trap_fatal (frame=3D0xfffffe0231d4e1c0, eva=3D) at /usr/src/sys/amd64/amd64/trap.c:829 #10 0xffffffff80f8e944 in trap_pfault (frame=3D0xfffffe0231d4e1c0, usermode=3D) at /usr/src/sys/amd64/amd64/trap.c:684 #11 0xffffffff80f8e0fe in trap (frame=3D0xfffffe0231d4e1c0) at /usr/src/sys/amd64/amd64/trap.c:435 #12 0xffffffff80f71337 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:234 #13 0xffffffff80d22752 in pfsync_clear_states (creatorid=3D, ifname=3D0x0) at /usr/src/sys/netpfil/pf/if_pfsync.c:1973 #14 0xffffffff80d3bac5 in pfioctl (dev=3D, cmd=3D, addr=3D0xfffff80006f62500 "", flags=3D, td=3D) at /usr/src/sys/netpfil/pf/pf_ioctl.c:1692 #15 0xffffffff8095a9ab in devfs_ioctl_f (fp=3D0xfffff800068e12d0, com=3D0xc= 0e04412, data=3D0xfffff80006f62500, cred=3D, td=3D0xfffff8004649e000) at /usr/src/sys/fs/devfs/devfs_vnops.c:813 #16 0xffffffff80b00a3c in kern_ioctl (td=3D0xfffff8004649e000, fd=3D, com=3D0x0, data=3D0xfffff80006f62500 "") at file.h:324 #17 0xffffffff80b005be in sys_ioctl (td=3D0xfffff8004649e000, uap=3D0xfffffe0231d4ea40) at /usr/src/sys/kern/sys_generic.c:723 #18 0xffffffff80f8f0e8 in amd64_syscall (td=3D0xfffff8004649e000, traced=3D= 0x0) at subr_syscall.c:135 #19 0xffffffff80f7161b in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:394 #20 0x0000000800de94ba in ?? () Now the panic occurs in pfsync_clear_states() --=20 You are receiving this mail because: You are the assignee for the bug.=