[Bug 263078] kernel core generated from ipfw_chk() function
Date: Wed, 06 Apr 2022 08:07:36 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263078 Bug ID: 263078 Summary: kernel core generated from ipfw_chk() function Product: Base System Version: Unspecified Hardware: arm64 OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: aadhya@cisco.com We have observed kernel crash from ipfw_chk() function. Environment : =================== hw.model: Intel(R) Xeon(R) Gold 5118 CPU @ 2.30GHz hw.machine: amd64 hw.ncpu: 24 FreeBSD 11.2-RELEASE Here is the BT : =========================== (kgdb) bt #0 doadump (textdump=1) at pcpu.h:229 #1 0xffffffff80610f5b in kern_reboot (howto=260) at ../../../kern/kern_shutdown.c:395 #2 0xffffffff80611459 in vpanic (fmt=<value optimized out>, ap=<value optimized out>) at ../../../kern/kern_shutdown.c:799 #3 0xffffffff80611193 in panic (fmt=<value optimized out>) at ../../../kern/kern_shutdown.c:719 #4 0xffffffff808967df in trap_fatal (frame=0xfffffe1049161250, eva=2) at ../../../amd64/amd64/trap.c:875 #5 0xffffffff80896839 in trap_pfault (frame=0xfffffe1049161250, usermode=0) at pcpu.h:229 #6 0xffffffff80896028 in trap (frame=0xfffffe1049161250) at ../../../amd64/amd64/trap.c:415 #7 0xffffffff8087534e in calltrap () at ../../../amd64/amd64/exception.S:199 #8 0xffffffff807a431f in ipfw_chk (args=<value optimized out>) at ../../../netpfil/ipfw/ip_fw2.c:1287 #9 0xffffffff807ac22f in ipfw_check_packet (arg=<value optimized out>, m0=0xfffffe10491616d0, ifp=<value optimized out>, dir=1, inp=0x0) at ../../../netpfil/ipfw/ip_fw_pfil.c:149 #10 0xffffffff8071f9d4 in pfil_run_hooks (ph=0xffffffff8100e478, mp=<value optimized out>, ifp=0xfffff8000becf000, dir=1, flags=0, inp=0x0) at ../../../net/pfil.c:116 #11 0xffffffff80742a99 in ip_input (m=0xfffff802dfad9600) at ../../../netinet/ip_input.c:601 #12 0xffffffff8071ea21 in netisr_dispatch_src (proto=1, source=<value optimized out>, m=<value optimized out>) at ../../../net/netisr.c:1120 #13 0xffffffff80707132 in ether_demux (ifp=0xfffff8000becf000, m=<value optimized out>) at ../../../net/if_ethersubr.c:884 #14 0xffffffff80708237 in ether_nh_input (m=<value optimized out>) at ../../../net/if_ethersubr.c:660 #15 0xffffffff8071ea21 in netisr_dispatch_src (proto=5, source=<value optimized out>, m=<value optimized out>) at ../../../net/netisr.c:1120 #16 0xffffffff807074b6 in ether_input (ifp=<value optimized out>, m=0x0) at ../../../net/if_ethersubr.c:780 #17 0xffffffff803f2ecc in ixgbe_rxeof (que=0xfffff8000becac00) at ../../../dev/ixgbe/ix_txrx.c:1597 #18 0xffffffff803e72b6 in ixgbe_msix_que (arg=0xfffff8000becac00) at ../../../dev/ixgbe/if_ix.c:1960 #19 0xffffffff805e1d1f in intr_event_execute_handlers (p=<value optimized out>, ie=0xfffff8000baf8a00) at ../../../kern/kern_intr.c:1336 #20 0xffffffff805e23b7 in ithread_loop (arg=0xfffff8000bec3ac0) at ../../../kern/kern_intr.c:1349 #21 0xffffffff805df396 in fork_exit (callout=0xffffffff805e2300 <ithread_loop>, arg=0xfffff8000bec3ac0, frame=0xfffffe1049161ac0) at ../../../kern/kern_fork.c:1054 #22 0xffffffff808761ee in fork_trampoline () at ../../../amd64/amd64/exception.S:951 #23 0x0000000000000000 in ?? () (kgdb) =============================================== After more investigation we observed that probably crash was happening due to line 2706 (f = chain->map[f_pos];) in function ipfw_chk() of file "netpfil/ipfw/ip_fw2.c". --------------- code snippet below --------------------------- case O_SKIPTO: 2692 IPFW_INC_RULE_COUNTER(f, pktlen); 2693 f_pos = JUMP(chain, f, cmd->arg1, tablearg, 0); 2694 /* 2695 * Skip disabled rules, and re-enter 2696 * the inner loop with the correct 2697 * f_pos, f, l and cmd. 2698 * Also clear cmdlen and skip_or 2699 */ 2700 for (; f_pos < chain->n_rules - 1 && 2701 (V_set_disable & 2702 (1 << chain->map[f_pos]->set)); 2703 f_pos++) 2704 ; 2705 /* Re-enter the inner loop at the skipto rule. */ 2706 f = chain->map[f_pos]; 2707 l = f->cmd_len; 2708 cmd = f->cmd; 2709 match = 1; 2710 cmdlen = 0; 2711 skip_or = 0; 2712 continue; 2713 break; /* not reached */ ------------------------------------------------------ What could be the possible fix for this ? I will update if similar crash is found in later version of FreeBSD. -- You are receiving this mail because: You are the assignee for the bug.