From owner-svn-src-head@freebsd.org Wed Nov 29 13:26:28 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EF1DEE53E6A; Wed, 29 Nov 2017 13:26:28 +0000 (UTC) (envelope-from o.hartmann@walstatt.org) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "mout.gmx.net", Issuer "TeleSec ServerPass DE-2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 6D10674321; Wed, 29 Nov 2017 13:26:27 +0000 (UTC) (envelope-from o.hartmann@walstatt.org) Received: from hermann ([78.52.117.12]) by mail.gmx.com (mrgmx103 [212.227.17.168]) with ESMTPSA (Nemesis) id 0MIMyZ-1eGT551mYR-004CYg; Wed, 29 Nov 2017 14:26:24 +0100 Date: Wed, 29 Nov 2017 14:26:23 +0100 From: "Hartmann, O." To: Hans Petter Selasky Cc: "Hartmann, O." , svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r326362 - in head: share/man/man4 sys/net Message-ID: <20171129142619.4525628d@hermann> In-Reply-To: References: <201711290940.vAT9eBWV096246@repo.freebsd.org> <20171129115125.24dd4aa0@hermann> <20171129131556.2247c97c@hermann> Organization: walstatt.org MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:sDn09nX69Qt8wETp9uPMTojW9PaOyYk+Cjhjcyxbfzi30oiJJiF 1UCZkGh+HsLP8Klie5FCq42zYTNE5hF5vi8uXYb3dhZ8fLXvedJmcwnZ91FXqqEef/Bdy8/ Lt6vovNUuTg+s6dy9dyzgFIv2dMxgqsiT4P3pM0pwa0ObhYROYJDrjtSArWU7It6eYNuJT+ DiLmvd0CD2txc+nuoduvQ== X-UI-Out-Filterresults: notjunk:1;V01:K0:2QKcRT+xp7w=:/qao9y1KCcbrLUaucf9HiH P8fXtaQGuQiLK+9hGhkJ5aTvOBtey9ww5FYjnaEJYndP4Whusen9Q9G69xQml9MFsvDhPfj49 /sHcMNWViU3fjJNlQc3erbwij+jLgdNaJCpe7VZnAq9by9CvBgPbfpux5IC4f14+V0sluSMnn dJFcO8TFJl0nPqmyPBf/qKoresaWwMO26ub5VjHNRhMHlSUtsVo2mhZzkIHI5GylFQC5ycxpn RAT1ILCbfk98oj68HfyJkTwlgQfmvJo3ymMSOEWzS5PAcSdU35DjESR/wc+OC4YWF62uHDm9a NTyfpdEfZXMK9XKqqMdriBFm5P4C1nhX6BK5R+MzKuOD8UmC+nnD5kE6WaNaX+qf8GBMzs6ks wPFQT4fjpViNhvHRM12zqbuNAxJBf2GgDsXsZ+RBmnUISn7c4xy21uaazxhio1oPmAn6EYKKI Om/juE/FCM5TsJMgxDhqwiB3KPo7nSqhtTIfsj66TVq2hJopXvfDM0vLt04eXyIyjPifEIXZ1 SWX5cW3XmTFQMQRT5nsQm/JtLVTHCTLt3Xg+ATB3/XXGkqh/ekZDZxX7YUGW+/1PFupkBEdpo EW8NG+SeBp58LTaZmgMdKjZeydyZFm/+fAa5zsGSuTJrIhb1uB4jGbLJzJ/UY6Xw1zO35Lt8C /SQZWvzcrMzDLgM+5LrpE6MaQwK9ujLJXZifE8vXzApvlqYQLjaHtg6f02YfqoIItoRWN+eWU oBbMDox8XgUCTX8dL3Lt3ji+b6VeGgQnfmeScVB1jSkwiJ1Tpif7Vr1riTqQYii1WqgvQXoEb BD2BXHYqX/FvtnvyxuuIwsJ4gf6DD5Z5X6MCRlH8YtaHaA13DE= X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Nov 2017 13:26:29 -0000 On Wed, 29 Nov 2017 13:16:28 +0100 Hans Petter Selasky wrote: > On 11/29/17 13:16, Hartmann, O. wrote: > > On Wed, 29 Nov 2017 12:49:19 +0100 > > Hans Petter Selasky wrote: > > > >> On 11/29/17 11:51, Hartmann, O. wrote: > >>> On Wed, 29 Nov 2017 09:40:11 +0000 (UTC) > >>> Hans Petter Selasky wrote: > >>> > >>>> Author: hselasky > >>>> Date: Wed Nov 29 09:40:11 2017 > >>>> New Revision: 326362 > >>>> URL: https://svnweb.freebsd.org/changeset/base/326362 > >>>> > >>>> Log: > >>>> Disallow TUN and TAP character device IOCTLs to modify the > >>>> network device type to any value. This can cause page faults and > >>>> panics due to accessing uninitialized fields in the "struct > >>>> ifnet" which are specific to the network device type. > >>>> > >>>> MFC after: 1 week > >>>> Found by: jau@iki.fi > >>>> PR: 223767 > >>>> Sponsored by: Mellanox Technologies > >>>> > >>>> Modified: > >>>> head/share/man/man4/tap.4 > >>>> head/share/man/man4/tun.4 > >>>> head/sys/net/if_tap.c > >>>> head/sys/net/if_tun.c > >>>> > >>>> Modified: head/share/man/man4/tap.4 > >>>> ============================================================================== > >>>> --- head/share/man/man4/tap.4 Wed Nov 29 09:18:24 2017 > >>>> (r326361) +++ head/share/man/man4/tap.4 Wed Nov 29 > >>>> 09:40:11 2017 (r326362) @@ -1,7 +1,7 @@ > >>>> .\" $FreeBSD$ > >>>> .\" Based on PR#2411 > >>>> .\" > >>>> -.Dd April 10, 2015 > >>>> +.Dd November 29, 2017 > >>>> .Dt TAP 4 > >>>> .Os > >>>> .Sh NAME > >>>> @@ -171,7 +171,14 @@ calls are supported > >>>> .In net/if_tap.h ) : > >>>> .Bl -tag -width VMIO_SIOCSETMACADDR > >>>> .It Dv TAPSIFINFO > >>>> -Set network interface information (line speed, MTU and type). > >>>> +Set network interface information (line speed and MTU). > >>>> +The type must be the same as returned by > >>>> +.Dv TAPGIFINFO > >>>> +or set to > >>>> +.Dv IFT_ETHER > >>>> +else the > >>>> +.Xr ioctl 2 > >>>> +call will fail. > >>>> The argument should be a pointer to a > >>>> .Va struct tapinfo . > >>>> .It Dv TAPGIFINFO > >>>> > >>>> Modified: head/share/man/man4/tun.4 > >>>> ============================================================================== > >>>> --- head/share/man/man4/tun.4 Wed Nov 29 09:18:24 2017 > >>>> (r326361) +++ head/share/man/man4/tun.4 Wed Nov 29 > >>>> 09:40:11 2017 (r326362) @@ -2,7 +2,7 @@ > >>>> .\" $FreeBSD$ > >>>> .\" Based on PR#2411 > >>>> .\" > >>>> -.Dd November 30, 2014 > >>>> +.Dd November 29, 2017 > >>>> .Dt TUN 4 > >>>> .Os > >>>> .Sh NAME > >>>> @@ -208,8 +208,15 @@ this stores the internal debugging > >>>> variable's value in .It Dv TUNSIFINFO > >>>> The argument should be a pointer to an > >>>> .Vt struct tuninfo > >>>> -and allows setting the MTU, the type, and the baudrate of the > >>>> tunnel +and allows setting the MTU and the baudrate of the tunnel > >>>> device. > >>>> +The type must be the same as returned by > >>>> +.Dv TUNGIFINFO > >>>> +or set to > >>>> +.Dv IFT_PPP > >>>> +else the > >>>> +.Xr ioctl 2 > >>>> +call will fail. > >>>> The > >>>> .Vt struct tuninfo > >>>> is declared in > >>>> > >>>> Modified: head/sys/net/if_tap.c > >>>> ============================================================================== > >>>> --- head/sys/net/if_tap.c Wed Nov 29 09:18:24 2017 > >>>> (r326361) +++ head/sys/net/if_tap.c Wed Nov 29 09:40:11 > >>>> 2017 (r326362) @@ -737,9 +737,10 @@ tapioctl(struct cdev > >>>> *dev, u_long cmd, caddr_t data, i switch (cmd) { > >>>> case TAPSIFINFO: > >>>> tapp = (struct tapinfo *)data; > >>>> + if (ifp->if_type != tapp->type) > >>>> + return (EPROTOTYPE); > >>>> mtx_lock(&tp->tap_mtx); > >>>> ifp->if_mtu = tapp->mtu; > >>>> - ifp->if_type = tapp->type; > >>>> ifp->if_baudrate = tapp->baudrate; > >>>> mtx_unlock(&tp->tap_mtx); > >>>> break; > >>>> > >>>> Modified: head/sys/net/if_tun.c > >>>> ============================================================================== > >>>> --- head/sys/net/if_tun.c Wed Nov 29 09:18:24 2017 > >>>> (r326361) +++ head/sys/net/if_tun.c Wed Nov 29 09:40:11 > >>>> 2017 (r326362) @@ -676,9 +676,10 @@ tunioctl(struct cdev > >>>> *dev, u_long cmd, caddr_t data, i if (error) > >>>> return (error); > >>>> } > >>>> + if (TUN2IFP(tp)->if_type != tunp->type) > >>>> + return (EPROTOTYPE); > >>>> mtx_lock(&tp->tun_mtx); > >>>> TUN2IFP(tp)->if_mtu = tunp->mtu; > >>>> - TUN2IFP(tp)->if_type = tunp->type; > >>>> TUN2IFP(tp)->if_baudrate = tunp->baudrate; > >>>> mtx_unlock(&tp->tun_mtx); > >>>> break; > >>>> _______________________________________________ > >>>> svn-src-head@freebsd.org mailing list > >>>> https://lists.freebsd.org/mailman/listinfo/svn-src-head > >>>> To unsubscribe, send any mail to > >>>> "svn-src-head-unsubscribe@freebsd.org" > >>> > >>> after updating from r325893 to r326362, FreeBSD CURRENT crashes > >>> while booting the kernel. I'm sorry having no further > >>> informations, it happens on a laptop with reduced space. > >>> > >>> At the moment, it seems that a lot of boxes running most recent > >>> CURRENT tend to crash spontanously. > >>> > >> > >> Hi, > >> > >> And you built the kernel from scratch and made sure your source > >> tree does not contain any .o files nor /usr/obj/* . > >> > >> --HPS > > > > Last time I did the make cleandir was when the OFED driver problem > > occured, that was some days ago. Useually, I build world and kernel > > with WITH_META_MODE set. > > > > Hi, > > Try to do a clean build w/o META mode. > > rm -rf /usr/obj/* > > And check: > > find /usr/src -name "*.o" > > --HPS > The last remaining system I had finished building a clean world. The box is now wrecked, too. As the others. After booting the box in single user mode, performing an installkernel and rebooting the r326363 kernel in single user mode and performing installworld, the box quit service via crashing with an obscure message like "spinlock held too long" and died. Now this last remaining server of mine is also out of service - with the very same message two others died yesterday and this morning. The boxes boot and then I get immediately a dump of CPU registeres from BTX and systems quit service with "BTX halted". In one case I tried to "repair" by copy manually binaries to /sbin, /libexec, /lib and /bin via pax -rw -pe to get rid of the problem, but this also ended in a catastrophy - the kernel, whichever, new one or the old, do not boot anymore, they get stuck at a certain point (probably when they load binary images like init, but I have no clue when this happens in the vein of processes). Thank you very much in advance for some tips. oh