From owner-freebsd-pf@freebsd.org  Sun Jul 26 10:15:30 2015
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 41F709A734E
 for <freebsd-pf@mailman.ysv.freebsd.org>; Sun, 26 Jul 2015 10:15:30 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
 [IPv6:2001:1900:2254:206a::16:76])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 2E1937B9
 for <freebsd-pf@FreeBSD.org>; Sun, 26 Jul 2015 10:15:30 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from bugs.freebsd.org ([127.0.1.118])
 by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id t6QAFUd0085886
 for <freebsd-pf@FreeBSD.org>; Sun, 26 Jul 2015 10:15:30 GMT
 (envelope-from bugzilla-noreply@freebsd.org)
From: bugzilla-noreply@freebsd.org
To: freebsd-pf@FreeBSD.org
Subject: [Bug 201879] panic: boot time panic with a scrub rule on "exclusive
 sleep mutex pf fragments"...
Date: Sun, 26 Jul 2015 10:15:30 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Base System
X-Bugzilla-Component: kern
X-Bugzilla-Version: 11.0-CURRENT
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: Affects Only Me
X-Bugzilla-Who: kp@freebsd.org
X-Bugzilla-Status: New
X-Bugzilla-Priority: ---
X-Bugzilla-Assigned-To: freebsd-pf@FreeBSD.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-201879-17777-jXXRG8PhgF@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-201879-17777@https.bugs.freebsd.org/bugzilla/>
References: <bug-201879-17777@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 26 Jul 2015 10:15:30 -0000

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=201879

Kristof Provost <kp@freebsd.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kp@freebsd.org

--- Comment #1 from Kristof Provost <kp@freebsd.org> ---
The dump suggests something's wrong with the pf_fragqueue.
It looks like an element was freed but not removed from the list (based on the
fault address of 0xdeadc0de, and the PC shows the panic is at the first
dereference of the frag taken from the list).

I don't understand how that can happen though. The list manipulations are
always done with the pf_frag_mtx mutex held so it can't be a race. Any free of
fragments is done through pf_remove_fragment(), which immediately removes it
from the tailq.

-- 
You are receiving this mail because:
You are the assignee for the bug.