From owner-freebsd-current@FreeBSD.ORG Fri Sep 26 20:34:03 2008 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DCA221065688 for ; Fri, 26 Sep 2008 20:34:03 +0000 (UTC) (envelope-from shoesoft@gmx.net) Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by mx1.freebsd.org (Postfix) with SMTP id 26F6F8FC13 for ; Fri, 26 Sep 2008 20:34:02 +0000 (UTC) (envelope-from shoesoft@gmx.net) Received: (qmail invoked by alias); 26 Sep 2008 20:34:00 -0000 Received: from 85-127-94-178.dynamic.xdsl-line.inode.at (EHLO taxman.pepperland) [85.127.94.178] by mail.gmx.net (mp067) with SMTP; 26 Sep 2008 22:34:00 +0200 X-Authenticated: #16703784 X-Provags-ID: V01U2FsdGVkX18clqNzd6IccrkPN/aO2EWF7qStoVD82mOmLShxOJ 79SrR2OfS3OvOv From: Stefan Ehmann To: Robert Watson Date: Fri, 26 Sep 2008 22:33:58 +0200 User-Agent: KMail/1.10.1 (FreeBSD/7.1-PRERELEASE; KDE/4.1.1; i386; ; ) References: <200809231851.42849.shoesoft@gmx.net> <200809260408.35831.shoesoft@gmx.net> In-Reply-To: MIME-Version: 1.0 Message-Id: <200809262233.59216.shoesoft@gmx.net> X-Y-GMX-Trusted: 0 X-FuHaFi: 0.51,0.51 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-current@freebsd.org Subject: Re: ipfw: LOR/panic with uid rules X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Sep 2008 20:34:04 -0000 On Friday 26 September 2008 20:17:10 Robert Watson wrote: > On Fri, 26 Sep 2008, Stefan Ehmann wrote: > > lock order reversal: > > > > 1st 0xc4c9ee94 tcp_sc_head (tcp_sc_head) @ > > /usr/src/sys/kern/kern_mutex.c:137 > > > > 2nd 0xc0e59fd8 PFil hook read/write mutex (PFil hook read/write mutex) @ > > /usr/src/sys/net/pfil.c:74 ... > I believe this is an accepted LOR to do with using an rwlock in this way in > pfil. > > > #10 0xc07eccd6 in _rw_rlock (rw=0xc0e5acec, file=0xc103ceed > > "/usr/src/sys/modules/ipfw/../../netinet/ip_fw2.c", line=2020) at > > /usr/src/sys/kern/kern_rwlock.c:283 > > > > #11 0xc103b92a in ipfw_chk (args=0xc47328a8) at > > /usr/src/sys/modules/ipfw/../../netinet/ip_fw2.c:2020 > > This surprises me -- can in principle we've passed down 'inp' so there > should be no need to look it up. In higher frames, 'inp' is definitely > non-NULL, so what happened here? Could you print out the values of the > local variables in the check_uidgid() frame? Especially, 'inp' and > 'lookup'? Something seems to be broken or I'm doing something wrong. I can't access the locals: (kgdb) fr 11 #11 0xc103b92a in ipfw_chk (args=0xc47328a8) at /usr/src/sys/modules/ipfw/../../netinet/ip_fw2.c:2020 2020 INP_INFO_RLOCK(pi); (kgdb) p inp No symbol "inp" in current context. (kgdb) p lookup $1 = {int (struct nameidata *)} 0xc086acb0 (kgdb) p pi No symbol "pi" in current context. > > #12 0xc103c4c8 in ipfw_check_out (arg=0x0, m0=0xc47329cc, ifp=0xc4b0a000, > > dir=2, inp=0xc50fe420) at > > /usr/src/sys/modules/ipfw/../../netinet/ip_fw_pfil.c:253 > > See non-NULL inp here. -- Stefan