https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217391
Bug ID: 217391
Summary: [ipfw] [panic] erroneous ipfw rule triggers KASSERT
Product: Base System
Version: 11.0-STABLE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: freebsd-bugs@FreeBSD.org
Reporter: po...@grosbein.net
Next three commands trigger KASSERT/panic for INVARIANTS-enabled kernel:
ipfw table 1 create type addr
ipfw add 1 count ip from any to any in recv 'table(10)' # pilot error
ipfw flush # (or "service ipfw start" as it includes flush)
Kernel built without INVARIANTS works fine.
Panic message: panic: wrong type 1 (2) for table id 1
Backtrace follows:
(kgdb) bt
#0 doadump (textdump=1) at pcpu.h:222
#1 0xffffffff80590ac5 in kern_reboot (howto=<value optimized out>)
at /data2/src/sys/kern/kern_shutdown.c:366
#2 0xffffffff805910a0 in vpanic (fmt=<value optimized out>,
ap=<value optimized out>) at /data2/src/sys/kern/kern_shutdown.c:759
#3 0xffffffff80590ed6 in kassert_panic (fmt=<value optimized out>)
at /data2/src/sys/kern/kern_shutdown.c:649
#4 0xffffffff8072c784 in unref_rule_objects (ch=0xffffffff80ec6610,
rule=<value optimized out>)
at /data2/src/sys/netpfil/ipfw/ip_fw_sockopt.c:2613
#5 0xffffffff80732503 in delete_range (chain=<value optimized out>,
rt=0xfffffe0238c907c8, ndel=<value optimized out>)
at /data2/src/sys/netpfil/ipfw/ip_fw_sockopt.c:803
#6 0xffffffff80730c50 in del_rules (chain=0xffffffff80ec6610,
op3=<value optimized out>, sd=0xfffffe0238c90740)
at /data2/src/sys/netpfil/ipfw/ip_fw_sockopt.c:1265
#7 0xffffffff8072e2cd in ipfw_ctl3 (sopt=0xfffffe0238c909b0)
at /data2/src/sys/netpfil/ipfw/ip_fw_sockopt.c:3674
#8 0xffffffff806ddd62 in rip_ctloutput (so=0xfffff8017c82a360,
sopt=0xfffffe0238c909b0) at /data2/src/sys/netinet/raw_ip.c:596
#9 0xffffffff806222a9 in sogetopt (so=0xfffff8017c82a360,
sopt=0xfffffe0238c909b0) at /data2/src/sys/kern/uipc_socket.c:2743
#10 0xffffffff8062678e in kern_getsockopt (td=0xfffff801b10fd000,
---Type <return> to continue, or q <return> to quit---
s=<value optimized out>, level=<value optimized out>,
name=<value optimized out>, val=<value optimized out>,
valseg=<value optimized out>, valsize=0xfffffe0238c90a1c)
at /data2/src/sys/kern/uipc_syscalls.c:1489
#11 0xffffffff80626690 in sys_getsockopt (td=0xfffff801b10fd000,
uap=0xfffffe0238c90b30) at /data2/src/sys/kern/uipc_syscalls.c:1435
#12 0xffffffff8083316c in amd64_syscall (td=0xfffff801b10fd000, traced=0)
at subr_syscall.c:135
#13 0xffffffff8081486b in Xfast_syscall ()
at /data2/src/sys/amd64/amd64/exception.S:396
#14 0x0000000800b3a9da in ?? ()
Current language: auto; currently minimal
(kgdb) frame 4
#4 0xffffffff8072c784 in unref_rule_objects (ch=0xffffffff80ec6610,
rule=<value optimized out>)
at /data2/src/sys/netpfil/ipfw/ip_fw_sockopt.c:2613
2613 KASSERT(no->subtype == subtype,
(kgdb) l
2608 if (rw == NULL)
2609 continue;
2610 no = rw->find_bykidx(ch, kidx);
2611
2612 KASSERT(no != NULL, ("table id %d not found", kidx));
2613 KASSERT(no->subtype == subtype,
2614 ("wrong type %d (%d) for table id %d",
2615 no->subtype, subtype, kidx));
2616 KASSERT(no->refcnt > 0, ("refcount for table %d is %d",
2617 kidx, no->refcnt));
(kgdb)
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
