Date: Tue, 12 Jul 2016 14:19:15 +0300 From: Michael Zhilin <mizhka@gmail.com> To: freebsd-current@freebsd.org Subject: [panic] ng_uncallout with NULL callout argument Message-ID: <CAF19XBLTDjSkAfSE-WfZUH6N6pJK0h2VC-1Wy35wL3HJHMg-tw@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hi,
I've switched from 10 to head recently. Most of functionalities works
fine except few panics.
The most frequent panic happens when I unplug ethernet cable with
active PPTP VPN connection.
uname -a:
FreeBSD gidrarium 12.0-CURRENT FreeBSD 12.0-CURRENT #1: Sat Jul 9
17:28:38 MSK 2016
jenkins@gidrarium:/builds/FreeBSD-src-head/obj/builds/FreeBSD-src-head/sys/GENERIC
amd64
Test case:
- use wired ethernet connection
- establish PPTP connection using mpd5
- unplug ethernet cable (=> panic)
db> bt
Tracing pid 902 tid 100675 td 0xfffff800169a1000
ng_uncallout() at ng_uncallout+0x3d/frame 0xfffffe04530b3580
ng_pptpgre_disconnect() at ng_pptpgre_disconnect+0xbb/frame 0xfffff*
ng_destroy_hook() at ng_destroy_hook+0xlfe/frame 8xfffffe84538b35d8
ng_ranode() at ng_ranode+0x75/frame 0xfffffe04538b3618
ng_apply_item() at ng_apply_itea+0x4ca/frame 0xfffffeB4538b36a8
ng_snd_item() at ng_snd_itea+0x3a9/frame 0xfffffeB4538b36e0
ngc_send() at ngc_send+0x21b/frame 0xfffffe04530b3790
sosend_generic() at sosend_generic+0x436/frame 0xfffffe04538b3850
kern_sendit() at kern_sendit+0x21b/frame Bxfffffe04538b390B
sendit() at sendit+0x19f/frame 0xfffffeB4530b3950
sys_sendto() at sys_sendto+0x4d/frame 0xfffffe04530b39a0
amd64_syscall() at amd64_syscall+0x2db/frame 0xfffffe04530b3ab0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffeB4530b3abB
--- syscall (133, FreeBSD ELF64, sys_sendto), rip = 0x80253906a, rsp -
0x7fffdfffd72B, rbp - 0x7fffdfffd770
Panic happens due to missing check if item (c->c_arg) is NULL in ng_uncallout:
item = c->c_arg;
/* Do an extra check */
if ((rval > 0) && (c->c_func == &ng_callout_trampoline) &&
(NGI_NODE(item) == node)) { /* <<<< NGI_NODE dereferences item,
but it may be NULL */
I suppose that actual root cause may be in upper stack (PPTP?).
Link to bug report: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=211031
Best regards,
Michael
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAF19XBLTDjSkAfSE-WfZUH6N6pJK0h2VC-1Wy35wL3HJHMg-tw>