Date: Wed, 24 Mar 2021 15:42:50 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 254478] Panic when using ipfw and divert sockets Message-ID: <bug-254478-7501-qWbImFX7hR@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-254478-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-254478-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D254478 --- Comment #3 from Daniel Kempkens <daniel+freebsd@kempkens.io> --- (In reply to Andrey V. Elsukov from comment #1) > I think such problem can be reproduced if you will do open/close divert s= ocket in a loop. Is it possible that your application sometimes does that? We were not able to confirm that this actually happens (yet), but we're fai= rly certain that under the right conditions what you described can indeed happe= n. We have added some logging to confirm our suspicions. Sadly no ETA on when we can try this in production again. We're still worki= ng on a setup to reproduce this in our development environment. > Can you show what contains inp in the last kgdb command? Sure! (kgdb) print *inp $6 =3D {inp_hash =3D {cle_next =3D 0xfffff804bfdd5b70, cle_prev =3D 0xfffff8012784ae20}, inp_pcbgrouphash =3D {cle_next =3D 0x0, cle_prev =3D 0= x0}, inp_lock =3D {lock_object =3D { lo_name =3D 0xffffffff82515931 "divinp", lo_flags =3D 90898432, lo_da= ta =3D 0, lo_witness =3D 0x0}, rw_lock =3D 33}, inp_hpts =3D {tqe_next =3D 0x0, tqe_p= rev =3D 0x0}, inp_hpts_request =3D 0, inp_in_hpts =3D 0 '____preserved_4____00', inp_in= _input =3D 0 '____preserved_4____00', inp_hpts_cpu =3D 0, inp_refcount =3D 1, inp_flag= s =3D 8388616, inp_flags2 =3D 16, inp_input_cpu =3D 0, inp_hpts_cpu_set =3D 0 '____preserved_4____00', inp_input_cpu_set =3D 0 '____preserved_4____00', inp_hpts_calls =3D 0 '____preserved_4____00', inp_input_calls =3D 0 '____preserved_4____00', inp_spare_bits2 =3D 0 '____preserved_4____00', inp_spare_byte =3D 0 '____preserved_4____00', inp_ppcb =3D 0x0, inp_socket =3D 0x0, inp_hptsslot =3D 0, inp_hpts_drop_r= eas =3D 0, inp_input =3D {tqe_next =3D 0x0, tqe_prev =3D 0x0}, inp_pcbinfo =3D 0xfffff= e00006f4538, inp_pcbgroup =3D 0x0, inp_pcbgroup_wild =3D {cle_next =3D 0x0, cle_prev = =3D 0x0}, inp_cred =3D 0xfffff801318fa200, inp_flow =3D 0, inp_vflag =3D 1 '____preserved_4____01', inp_ip_ttl =3D 0 '____preserved_4____00', inp_ip_p =3D 2 '____preserved_4____02', inp_ip_minttl =3D 0 '____preserved_4____00', inp_flowid =3D 0, inp_snd_tag =3D 0x0, inp_flowtyp= e =3D 0, inp_rss_listen_bucket =3D 0, inp_inc =3D {inc_flags =3D 0 '____preserved_4_= ___00', inc_len =3D 0 '____preserved_4____00', inc_fibnum =3D 0, inc_ie =3D {ie= _fport =3D 0, ie_lport =3D 10787, ie_dependfaddr =3D {id46_addr =3D {ia46_pad32 =3D {0= , 0, 0}, ia46_addr4 =3D {s_addr =3D 0}}, id6_addr =3D { __u6_addr =3D {__u6_addr8 =3D '____preserved_4____00' <repeats 15= times>, __u6_addr16 =3D {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 =3D {0, 0, 0, 0}}}}, ie_dependladdr =3D {id46_addr =3D { ia46_pad32 =3D {0, 0, 0}, ia46_addr4 =3D {s_addr =3D 0}}, id6_add= r =3D {__u6_addr =3D {__u6_addr8 =3D '____preserved_4____00' <repeats 15 times>, __u6_addr16 =3D {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 =3D {0, 0, 0, 0}}}}, ie6_zoneid =3D 0}}, inp_label = =3D 0x0, inp_sp =3D 0xfffff80127913ee0, {inp_ip_tos =3D 0 '____preserved_4____00', inp_options =3D 0x0, inp_moptions =3D 0x0}, { in6p_options =3D 0x0, in6p_outputopts =3D 0x0, in6p_moptions =3D 0x0, in6p_icmp6filt =3D 0x0, in6p_cksum =3D 0, in6p_hops =3D 0}, inp_portlist = =3D {cle_next =3D 0x0, cle_prev =3D 0xfffff80127c450a0}, inp_phd =3D 0xfffff80127c45080, inp_g= encnt =3D 74, spare_ptr =3D 0x0, inp_rt_cookie =3D 0, {inp_route =3D {ro_rt =3D 0x0, = ro_lle =3D 0x0, ro_prepend =3D 0x0, ro_plen =3D 0, ro_flags =3D 256, ro_mtu =3D 0, sp= are =3D 0, ro_dst =3D {sa_len =3D 0 '____preserved_4____00', sa_family =3D 0 '____preserved_4____00', sa_data =3D '____preserved_4____00' <repeats 13 times>}}, inp_route6 =3D {ro_rt =3D 0x0, ro_lle =3D 0x0, ro_prepend =3D 0x0, ro_p= len =3D 0, ro_flags =3D 256, ro_mtu =3D 0, spare =3D 0, ro_dst =3D {sin6_len =3D 0 '____preserved_4____00', sin6_family =3D 0 '____preserved_4____00', sin6_port =3D 0, sin6_flowinfo =3D 0, sin6_addr =3D {__u6_addr =3D = {__u6_addr8 =3D '____preserved_4____00' <repeats 15 times>, __u6_addr16 =3D {0, 0, 0, 0= , 0, 0, 0, 0}, __u6_addr32 =3D {0, 0, 0, 0}}}, sin6_scope_id =3D 0}}}, inp_list =3D {cle_next =3D 0xfffff804bfdd5b70, cle_prev =3D 0xfffffe00006f4530}, inp_epoch_ctx =3D {da= ta =3D { 0xffffffff80d43b00 <in_pcbfree_deferred>, 0xfffff80127c45088}}} --=20 You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-254478-7501-qWbImFX7hR>