Bug #1481
open
panic: assertion: kva_p(buf) in soopt_from_kbuf (after ipfw pipe show, 2.2.1-R)
0%
Description
Host panics when root does "ipfw pipe show".
Doesn't matter if dummynet.ko is loaded via kldload
or it is loaded with loader.
Recompilation of dummynet.ko doesn't solve this.
Dumps availible on http://Sahara.org.ua/~planner/{vmcore,kernel}.{0,1}
(first dump with release binary, second - with module compiled from git branch
v2.2.1)
kgdb output follows:
Unread portion of the kernel message buffer:
panic: assertion: kva_p(buf) in soopt_from_kbuf
Trace beginning at frame 0xc8cccb98
panic(c8cccbbc,0,cb6cfca0,c06845b4,c8cccbc8) at panic+0x8c
panic(c0570d57,c058c319,c054fa2c,0,c8cccd30) at panic+0x8c
soopt_from_kbuf(cb6cfca0,fffffff8,0,c1525440,cacaf000) at soopt_from_kbuf+0x7a
ip_dn_sockopt(cb6cfca0) at ip_dn_sockopt+0xe4
rip_ctloutput(c1622b00,cb6cfca0,1,c8cccd68,c037a3fd) at rip_ctloutput+0xaa
netmsg_pru_ctloutput(cb6cfbfc) at netmsg_pru_ctloutput+0x10
netmsg_service(cb6cfbfc,0,1,c06845b4,ff800000) at netmsg_service+0x53
netmsg_service_loop(c0688014,0,0,0,0) at netmsg_service_loop+0x18
lwkt_exit() at lwkt_exit
syncing disks... 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2
done
Uptime: 5d23h58m0s
dumping to dev #ad/0x20001, blockno 1590920
dump 247 246 245 244 243 242 241 240 239 238 237 236 235 234 233 232 231 230
229 228 227 226 225 224 223 222 221 220 219 218 217 216 215 214 213 212 211 210
209 208 207 206 205 204 203 202 201 200 199 198 197 196 195 194 193 192 191 190
189 188 187 186 185 184 183 182 181 180 179 178 177 176 175 174 173 172 171 170
169 168 167 166 165 164 163 162 161 160 159 158 157 156 155 154 153 152 151 150
149 148 147 146 145 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130
129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110
109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87
86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61
60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35
34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8
7 6 5 4 3 2 1 0
GNU gdb 6.7.1
Copyright (C) 2007 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i386-dragonfly".
(kgdb) bt
#0 dumpsys () at ./machine/thread.h:83
#1 0xc02e3ea6 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:375
#2 0xc02e3fc7 in panic (fmt=0xc0570d57 "assertion: %s in %s") at /usr/src/sys/
kern/kern_shutdown.c:800
#3 0xc0313061 in soopt_from_kbuf (sopt=0x0, buf=0xfffffff8, len=0) at /usr/src/
sys/kern/uipc_socket.c:1451
#4 0xc03a070e in ip_dn_sockopt (sopt=0xcb6cfca0) at /usr/src/sys/net/dummynet/
ip_dummynet_glue.c:499
#5 0xc03a69a9 in rip_ctloutput (so=0x0, sopt=0x0) at /usr/src/sys/netinet/
raw_ip.c:362
#6 0xc0312dc8 in netmsg_pru_ctloutput (msg=0xcb6cfbfc) at /usr/src/sys/kern/
uipc_msg.c:652
#7 0xc037a3fd in netmsg_service (msg=0x0, mpsafe_mode=0, mplocked=1) at /usr/
src/sys/net/netisr.c:307
#8 0xc037a8ad in netmsg_service_loop (arg=0xc0688014) at /usr/src/sys/net/
netisr.c:333
#9 0xc02eaa5e in lwkt_deschedule_self (td=Cannot access memory at address 0x8
) at /usr/src/sys/kern/lwkt_thread.c:253
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(kgdb)
DragonFly 2.2.1-RELEASE #0: Sun Apr 26 18:38:14 GMT 2009
root@test29.backplane.com:/usr/obj/usr/src/sys/DFLYLIVE i386
Updated by sepherosa over 15 years ago
On Tue, Sep 1, 2009 at 11:10 PM, Mykhaylo (via DragonFly issue
tracker)<sinknull@leaf.dragonflybsd.org> wrote:
New submission from Mykhaylo <mclone@gmail.com>:
Host panics when root does "ipfw pipe show".
Doesn't matter if dummynet.ko is loaded via kldload
or it is loaded with loader.
Recompilation of dummynet.ko doesn't solve this.
Dumps availible on http://Sahara.org.ua/~planner/{vmcore,kernel}.{0,1}
(first dump with release binary, second - with module compiled from git branch
v2.2.1)
kgdb output follows:Unread portion of the kernel message buffer:
panic: assertion: kva_p(buf) in soopt_from_kbuf
Trace beginning at frame 0xc8cccb98
panic(c8cccbbc,0,cb6cfca0,c06845b4,c8cccbc8) at panic+0x8c
panic(c0570d57,c058c319,c054fa2c,0,c8cccd30) at panic+0x8c
soopt_from_kbuf(cb6cfca0,fffffff8,0,c1525440,cacaf000) at soopt_from_kbuf+0x7a
Looks like zero sized kmalloced memory could not pass kva_p test.
Try following patch:
http://leaf.dragonflybsd.org/~sephe/zero_soopt_from_kbuf.diff
Best Regards,
sephe
ip_dn_sockopt(cb6cfca0) at ip_dn_sockopt+0xe4
rip_ctloutput(c1622b00,cb6cfca0,1,c8cccd68,c037a3fd) at rip_ctloutput+0xaa
netmsg_pru_ctloutput(cb6cfbfc) at netmsg_pru_ctloutput+0x10
netmsg_service(cb6cfbfc,0,1,c06845b4,ff800000) at netmsg_service+0x53
netmsg_service_loop(c0688014,0,0,0,0) at netmsg_service_loop+0x18
lwkt_exit() at lwkt_exit
Updated by combiner over 15 years ago
On Wed, Sep 2, 2009 at 8:08 AM, Sepherosa Ziehau (via DragonFly issue
tracker)<bugs@crater.dragonflybsd.org> wrote:
Looks like zero sized kmalloced memory could not pass kva_p test.
Try following patch:
http://leaf.dragonflybsd.org/~sephe/zero_soopt_from_kbuf.diff
Exactly the same panic.
--
wbr, |\ ,,,---,, dog bless ya!
` Zzz /,`.-'`' . ;;;,_
McLone at GMail dot com |,4- ) )-,_. ,\ ( `'-'
net- and *BSD admin '---''(/--' `-'\) ...translit rawx!
Updated by sepherosa over 15 years ago
On Wed, Sep 2, 2009 at 6:46 PM, McLone<mclone@gmail.com> wrote:
On Wed, Sep 2, 2009 at 8:08 AM, Sepherosa Ziehau (via DragonFly issue
tracker)<bugs@crater.dragonflybsd.org> wrote:Looks like zero sized kmalloced memory could not pass kva_p test.
Try following patch:
http://leaf.dragonflybsd.org/~sephe/zero_soopt_from_kbuf.diffExactly the same panic.
Hmm, it is very strange to me. I reproduced the bug myself today and
the above patch does fix the panic.
Have you recompiled/reinstall the patched kernel (at least quickkernel
+ installkernel)?
Best Regards,
sephe
Updated by dillon over 15 years ago
:Hmm, it is very strange to me. I reproduced the bug myself today and
:the above patch does fix the panic.
:Have you recompiled/reinstall the patched kernel (at least quickkernel
:+ installkernel)?
:
:Best Regards,
:sephe
Hmm. min() uses a signed integer for arguments and result. len
is a size_t. Is sopt->sopt_valsize initialized in that path? If
it is uninitialized and >= 0x80000000 it will turn up negative in
the min() and a very bad value will be returned for the bcopy().-Matt
Matthew Dillon
<dillon@backplane.com>
Updated by tuxillo almost 10 years ago
- Description updated (diff)
- Category set to Kernel
- Status changed from New to Feedback
- Target version set to 4.2
Hi sephe,
Do you know if this bug is still relevant?
Cheers,
Antonio Huete