DragonFlyBSD

I can't reproduce the bug maybe because the suspicious code I mention
below seems
exercised by IPv6 only and I haven't configured that.

It looks like so_pru_ctloutput() passes an invalid sopt_val to
kfree(). This code was changed
recently:

http://leaf.dragonflybsd.org/mailarchive/commits/2008-06/msg00123.html

There is some pointer arithmetic on sopt_val in soopt_mcopyout() that
may cause the panic you
observe. sopt_val ends up pointing past the data copied from the
mbuf. Maybe this is
intentional as the code is old (imported straight from fbsd 4 and is
still in fbsd head). This
would allow to append more data later on. On the other hand, maybe
that's a bug. Only a
networking savvy person could say.

In the latter case, you could try the following (untested) patch:

Index: src2/sys/kern/uipc_socket.c ===================================================================
--- src2.orig/sys/kern/uipc_socket.c 2008-06-27 18:24:46.000000000 0200
++ src2/sys/kern/uipc_socket.c 2008-07-05 12:08:49.000000000 +0200
@ -1646,23 +1646,24 @ soopt_mcopyout(struct sockopt *sopt, str {
struct mbuf *m0 = m;
size_t valsize = 0;
+ void *val;

if (sopt->sopt_val == NULL)
         return 0;
+    val = sopt->sopt_val;
     while (m != NULL && sopt->sopt_valsize >= m->m_len) {
         if (sopt->sopt_td != NULL) {
             int error;

- error = copyout(mtod(m, char *), sopt->sopt_val,
- m->m_len);
+ error = copyout(mtod(m, char *), val, m->m_len);
if (error != 0) {
m_freem(m0);
return (error);
}
} else
- bcopy(mtod(m, char *), sopt->sopt_val, m->m_len);
+ bcopy(mtod(m, char *), val, m->m_len);
sopt->sopt_valsize = m>m_len;
- sopt->sopt_val = (caddr_t)sopt->sopt_val + m->m_len;
+ val = (caddr_t)val + m->m_len;
valsize += m->m_len;
m = m->m_next;
}

Cheers,
Nicolas

Forget this, soopt_mcopyout() is called during getsockopt() but the
crash ocurred during setsockopt()...

I'm not a networking savvy person (working on it) but having spent some time
on ctloutput functions lately it seems like an outright bug to me. Even if
some code was depending on it, this behavior violates POLA and would need to
go anyway.

Right, but soopt_mcopyin() does the exact same thing ;) Nice catch. Things
seem to work here with these two changes (+ SOPTF_KVA), wanna commit it?

Aggelos

Oops missed that. Thanks.

Ok. I'll fix soopt_mcopy{in,out} tonight.

Cheers,
Nicolas

Done.

Thanks!

I can't crash vkernel anymore.

-thomas