From owner-freebsd-current@FreeBSD.ORG  Tue Aug 29 09:00:12 2006
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: freebsd-current@freebsd.org
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 180F416A4DE
	for <freebsd-current@freebsd.org>; Tue, 29 Aug 2006 09:00:11 +0000 (UTC)
	(envelope-from dmitry@atlantis.dp.ua)
Received: from postman.atlantis.dp.ua (postman.atlantis.dp.ua [193.108.47.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 334E043D72
	for <freebsd-current@freebsd.org>; Tue, 29 Aug 2006 09:00:10 +0000 (GMT)
	(envelope-from dmitry@atlantis.dp.ua)
Received: from atlantis.dp.ua (localhost [127.0.0.1])
	by postman.atlantis.dp.ua (8.13.1/8.13.1) with ESMTP id k7T90487087491; 
	Tue, 29 Aug 2006 12:00:07 +0300 (EEST)
	(envelope-from dmitry@atlantis.dp.ua)
Received: from localhost (dmitry@localhost)
	by atlantis.dp.ua (8.13.1/8.13.1/Submit) with ESMTP id k7T903Q3087464; 
	Tue, 29 Aug 2006 12:00:03 +0300 (EEST)
	(envelope-from dmitry@atlantis.dp.ua)
Date: Tue, 29 Aug 2006 12:00:03 +0300 (EEST)
From: Dmitry Pryanishnikov <dmitry@atlantis.dp.ua>
To: Ian FREISLICH <if@hetzner.co.za>
In-Reply-To: <E1GHy6f-0002Nr-6c@hetzner.co.za>
Message-ID: <20060829114401.O63269@atlantis.atlantis.dp.ua>
References: <E1GHy6f-0002Nr-6c@hetzner.co.za>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-current@freebsd.org
Subject: Re: Panic (in firewall while doing lots of ifconfigs)
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Aug 2006 09:00:12 -0000


Hello!

On Tue, 29 Aug 2006, Ian FREISLICH wrote:
> 2589                            case O_IP_SRC_ME:
> 2590                                    if (is_ipv4) {
> 2591                                            struct ifnet *tif;
> 2592
> 2593                                            INADDR_TO_IFP(src_ip, tif);
> 2594                                            match = (tif != NULL);
> 2595                                    }

    Looks like a lack of the proper locking against IP address 
addition/removal. These (O_IP_SRC_ME/O_IP_DST_ME), 
as well as matching of interface by IP address in the iface_match():

                 /* XXX lock? */
                 TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) {
                         if (ia->ifa_addr == NULL)
                                 continue;

are worrying for these races exist since version 1.1 of the ip_fw2.c
for more than 4 years! Alas I'm not an expert in kernel locking, that's why
I don't know how to correctly lock these places.

Sincerely, Dmitry
-- 
Atlantis ISP, System Administrator
e-mail:  dmitry@atlantis.dp.ua
nic-hdl: LYNX-RIPE