[Bug 273207] pf_syncookie_mac for IPv6 random cause panic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273207

            Bug ID: 273207
           Summary: pf_syncookie_mac for IPv6 random cause panic
           Product: Base System
           Version: 13.2-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: dev@rincat.ch

When using IPv6, I random but high frequently got kernel panic:


Fatal trap 12: page fault while in kernel mode
cpuid = 3; apic id = 06
fault virtual address       = 0x0
fault code          = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff811525b5
stack pointer               = 0x28:0xfffffe00c5f895e0
frame pointer               = 0x28:0xfffffe00c5f895e0
code segment                = base 0x0, limit 0xfffff, type 0x1b
                   = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags   = interrupt enabled, resume, IOPL = 0
current process            = 0 (if_io_tqg_3)
trap number                = 12
panic: page fault
cpuid = 3
time = 1692374078
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00c5f893a0
vpanic() at vpanic+0x151/frame 0xfffffe00c5f893f0
panic() at panic+0x43/frame 0xfffffe00c5f89450
trap_fatal() at trap_fatal+0x387/frame 0xfffffe00c5f894b0
trap_pfault() at trap_pfault+0x4f/frame 0xfffffe00c5f89510
calltrap() at calltrap+0x8/frame 0xfffffe00c5f89510
--- trap 0xc, rip = 0xffffffff811525b5, rsp = 0xfffffe00c5f895e0, rbp =
0xfffffe00c5f895e0 ---
memmove_erms() at memmove_erms+0xe5/frame 0xfffffe00c5f895e0
SipHash_Update() at SipHash_Update+0x56/frame 0xfffffe00c5f89620
pf_syncookie_mac() at pf_syncookie_mac+0xac/frame 0xfffffe00c5f896a0
pf_syncookie_check() at pf_syncookie_check+0x49/frame 0xfffffe00c5f896c0
pf_test_state_tcp() at pf_test_state_tcp+0x353/frame 0xfffffe00c5f89820
pf_test6() at pf_test6+0xb9b/frame 0xfffffe00c5f899a0
pf_check6_in() at pf_check6_in+0x5b/frame 0xfffffe00c5f899d0
pfil_run_hooks() at pfil_run_hooks+0x97/frame 0xfffffe00c5f89a10
ip6_tryforward() at ip6_tryforward+0x1e3/frame 0xfffffe00c5f89a90
ip6_input() at ip6_input+0x5e4/frame 0xfffffe00c5f89b70
netisr_dispatch_src() at netisr_dispatch_src+0xb9/frame 0xfffffe00c5f89bc0
ether_demux() at ether_demux+0x159/frame 0xfffffe00c5f89bf0
ether_nh_input() at ether_nh_input+0x36b/frame 0xfffffe00c5f89c50
netisr_dispatch_src() at netisr_dispatch_src+0xb9/frame 0xfffffe00c5f89ca0
ether_input() at ether_input+0x69/frame 0xfffffe00c5f89d00
iflib_rxeof() at iflib_rxeof+0xbcb/frame 0xfffffe00c5f89e00
_task_fn_rx() at _task_fn_rx+0x72/frame 0xfffffe00c5f89e40
gtaskqueue_run_locked() at gtaskqueue_run_locked+0x15d/frame 0xfffffe00c5f89ec0
gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0xc3/frame
0xfffffe00c5f89ef0
fork_exit() at fork_exit+0x7e/frame 0xfffffe00c5f89f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00c5f89f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
Timeout initializing vt_vga
Uptime: 6m48s
Dumping 1010 out of 16211 MB:..2%..12%..21%..31%..42%..51%..61%..72%..81%..91%
Dump complete

OPNsense 23.7.1_3-amd64
FreeBSD 13.2-RELEASE-p2
OpenSSL 1.1.1v 1 Aug 2023
Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz (4 cores, 4 threads)

Also https://github.com/opnsense/src/issues/184

-- 
You are receiving this mail because:
You are the assignee for the bug.