Date: Sun, 14 Dec 2025 19:13:05 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 289017] [lagg] A time-of-check to time-of-use (TOCTOU) race exists in the Link Aggregation (LAGG) network subsystem Message-ID: <bug-289017-7501-sLd9PpabEB@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-289017-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-289017-7501@https.bugs.freebsd.org/bugzilla/>
index | next in thread | previous in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289017 Gui-Dong Han <hanguidong02@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hanguidong02@gmail.com --- Comment #3 from Gui-Dong Han <hanguidong02@gmail.com> --- (In reply to Zhenlei Huang from comment #1) Update: I have successfully reproduced the race condition on a completely unmodified GENERIC kernel. By maximizing the race window through high-concurrency packet spraying and continuous protocol switching, I can reliably trigger the panic within seconds. Please find the reproduction scripts and the corresponding crash log below. Crash log: Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0x0 fault code = supervisor read instruction, page not present instruction pointer = 0x20:0x0 stack pointer = 0x28:0xfffffe0068f55948 frame pointer = 0x28:0xfffffe0068f55970 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, IOPL = 0 current process = 1040 (poc) rdi: fffff80004444200 rsi: fffff80004f5d900 rdx: 9c58554433221100 rcx: fffffe0068f55ac0 r8: 0008a2ff10fc9c58 r9: fffff80004f5d960 rax: 0000000000000000 rbx: fffff800036fc000 rbp: fffffe0068f55970 r10: 0000000000000090 r11: fffff80004f74000 r12: 000000000000000e r13: 0000000000000008 r14: fffffe0068f55ac0 r15: fffff800036fc000 trap number = 12 panic: page fault cpuid = 0 time = 1765738480 KDB: stack backtrace: #0 0xffffffff80ba8f1d at kdb_backtrace+0x5d #1 0xffffffff80b5aa11 at vpanic+0x161 #2 0xffffffff80b5a8a3 at panic+0x43 #3 0xffffffff8104dbfa at trap_pfault+0x3da #4 0xffffffff81023dd8 at calltrap+0x8 #5 0xffffffff80c85a50 at ether_output+0x6b0 #6 0xffffffff80d21998 at ip_output+0x13a8 #7 0xffffffff80d52c40 at udp_send+0xb60 #8 0xffffffff80c0145c at sosend_dgram+0x31c #9 0xffffffff80c0242f at sousrsend+0x5f #10 0xffffffff80c0aec0 at kern_sendit+0x1c0 #11 0xffffffff80c0b1f2 at sendit+0x1b2 #12 0xffffffff80c0b02d at sys_sendto+0x4d #13 0xffffffff8104e547 at amd64_syscall+0x117 #14 0xffffffff810246eb at fast_syscall_common+0xf8 -- You are receiving this mail because: You are the assignee for the bug.help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-289017-7501-sLd9PpabEB>