From owner-freebsd-net@FreeBSD.ORG  Thu May  5 18:55:19 2011
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 110A81065672
	for <freebsd-net@freebsd.org>; Thu,  5 May 2011 18:55:19 +0000 (UTC)
	(envelope-from lacombar@gmail.com)
Received: from mail-iw0-f182.google.com (mail-iw0-f182.google.com
	[209.85.214.182])
	by mx1.freebsd.org (Postfix) with ESMTP id CAECF8FC0A
	for <freebsd-net@freebsd.org>; Thu,  5 May 2011 18:55:18 +0000 (UTC)
Received: by iwn33 with SMTP id 33so2899643iwn.13
	for <multiple recipients>; Thu, 05 May 2011 11:55:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:in-reply-to:references:date
	:message-id:subject:from:to:cc:content-type
	:content-transfer-encoding;
	bh=1zO0hk/FqptRYn7Y/jwVx3Htu3YwEGzT1SXnd5zcYw4=;
	b=o1unlHSEfHi5CjHyayT+ekJV0JrBkAQKuWuGMLOZUQPqW/ZZSlsB4NX8cr/Lv586TC
	LjCkIel/tQc3n2LpaZ2KLWrFG/PtnWQLGdSUsaf1uxnXM/RAUPca7KMWCmCERoAK3OmF
	t6k+8cv3crwNaqvqOx0aJZHizwGolTuW2rOOI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type:content-transfer-encoding;
	b=m7QEq0Vqwwj1Y7Z0Yw0LqaGhB24w0Q1+hO2IgvZLDpNsZq+mNgdejtYPi6oi7rXVOl
	1y/1F8X/h9mgIbFSYFMoxcG/7WiHKrnb1VAz/msmQtfim8AzQ51OG+UNOIZdL4bdRNMr
	TezOvTPk2QYkOMim/dQcGJsWfkXwOjEnlAXA4=
MIME-Version: 1.0
Received: by 10.42.162.202 with SMTP id z10mr1466530icx.203.1304621718033;
	Thu, 05 May 2011 11:55:18 -0700 (PDT)
Received: by 10.42.167.5 with HTTP; Thu, 5 May 2011 11:55:18 -0700 (PDT)
In-Reply-To: <BANLkTimTUE_SvVUA1RWRBvLWeaYWvT62CQ@mail.gmail.com>
References: <op.vu0q8asqaevz08@ghost-pc.home.lan>
	<BANLkTimvboyYGXL21vzeQ+gPOO4QCUGskQ@mail.gmail.com>
	<BANLkTimTUE_SvVUA1RWRBvLWeaYWvT62CQ@mail.gmail.com>
Date: Thu, 5 May 2011 14:55:18 -0400
Message-ID: <BANLkTi=vBxUm83TCv8JDeSh+U4g0Y=WN3A@mail.gmail.com>
From: Arnaud Lacombe <lacombar@gmail.com>
To: Emil Muratov <gpm@hotplug.ru>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: freebsd-net@freebsd.org, Paolo Pisati <piso@freebsd.org>
Subject: Re: nfe taskq kernel panic
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 05 May 2011 18:55:19 -0000

Hi,

On Thu, May 5, 2011 at 2:49 PM, Arnaud Lacombe <lacombar@gmail.com> wrote:
> There is a stale reference to the mbuf passed to, and freed in
> m_megapullup(); could you test the following patch ?
>
> diff --git a/sys/netinet/ipfw/ip_fw_nat.c b/sys/netinet/ipfw/ip_fw_nat.c
> index f8c3e63..80c13dc 100644
> --- a/sys/netinet/ipfw/ip_fw_nat.c
> +++ b/sys/netinet/ipfw/ip_fw_nat.c
> @@ -263,7 +263,7 @@ ipfw_nat(struct ip_fw_args *args, struct cfg_nat
> *t, struct mbuf *m)
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0retval =3D LibAliasOut(t->lib, c,
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0mcl->m_len + M_TRAILINGSPA=
CE(mcl));
> =A0 =A0 =A0 =A0if (retval =3D=3D PKT_ALIAS_RESPOND) {
> - =A0 =A0 =A0 =A0 =A0 =A0 =A0 m->m_flags |=3D M_SKIP_FIREWALL;
> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 mcl->m_flags |=3D M_SKIP_FIREWALL;
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0retval =3D PKT_ALIAS_OK;
> =A0 =A0 =A0 =A0}
> =A0 =A0 =A0 =A0if (retval !=3D PKT_ALIAS_OK &&
>
> This was introduced in r188294 by piso@ (added to the CC: list).
>
this can only happen if you are NAT'ing SCTP traffic. So it might not
be the culprit in your case..

 =A0- Arnaud