https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242415
Bug ID: 242415
Summary: Running sockstat as underprivileged user panics the OS
when using pf
Product: Base System
Version: CURRENT
Hardware: amd64
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: b...@freebsd.org
Reporter: msh...@daemon-security.com
Created attachment 209677
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=209677&action=edit
Crash dump from FreeBSD
FreeBSD 13.0-CURRENT #0 r355121: Wed Nov 27 04:20:46 UTC 2019
r...@releng1.nyi.freebsd.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC
Originally discovered on HardenedBSD, but the issue appears to occur when using
pf and running sockstat -4 as a non-root user. I know there has been some
recent work to remove locks so I wanted to make sure to log this bug (Crash
dump is attached)
<118>Wed Dec 4 03:42:25 UTC 2019
<118>Dec 4 03:42:25 freebsd ntpd[16430]: error resolving pool
0.freebsd.pool.ntp.org: Name does not resolve (8)
<118>Dec 4 03:42:27 freebsd login[37838]: ROOT LOGIN (root) ON ttyu0
lock order reversal: (sleepable after non-sleepable)
1st 0xfffff80017f327c0 tcpinp (tcpinp) @ /usr/src/sys/netinet/tcp_subr.c:2169
2nd 0xffffffff81c7e168 sysctl lock (sysctl lock) @
/usr/src/sys/kern/kern_sysctl.c:181
stack backtrace:
#0 0xffffffff80c32a81 at witness_debugger+0x71
#1 0xffffffff80c327f1 at witness_checkorder+0xab1
#2 0xffffffff80bc054b at _rm_rlock_debug+0x13b
#3 0xffffffff80bd59af at sysctl_root_handler_locked+0xcf
#4 0xffffffff80bd4d0a at sysctl_root+0x20a
#5 0xffffffff80bd53bb at userland_sysctl+0x17b
#6 0xffffffff80bd5759 at kern___sysctlbyname+0x219
#7 0xffffffff80bd57ad at sys___sysctlbyname+0x2d
#8 0xffffffff81064846 at amd64_syscall+0x2d6
#9 0xffffffff8103aa70 at fast_syscall_common+0x101
lock order reversal: (sleepable after non-sleepable)
1st 0xfffff80017f327c0 tcpinp (tcpinp) @ /usr/src/sys/netinet/tcp_subr.c:2169
2nd 0xfffff80019546070 vm map (user) (vm map (user)) @
/usr/src/sys/vm/vm_map.c:2927
stack backtrace:
#0 0xffffffff80c32a81 at witness_debugger+0x71
#1 0xffffffff80c327f1 at witness_checkorder+0xab1
#2 0xffffffff80bcf687 at _sx_xlock+0x67
#3 0xffffffff80f0f8c8 at vm_map_unwire+0x68
#4 0xffffffff80bd544b at userland_sysctl+0x20b
#5 0xffffffff80bd5759 at kern___sysctlbyname+0x219
#6 0xffffffff80bd57ad at sys___sysctlbyname+0x2d
#7 0xffffffff81064846 at amd64_syscall+0x2d6
#8 0xffffffff8103aa70 at fast_syscall_common+0x101
userret: returning with the following locks held:
shared rw tcpinp (tcpinp) r = 0 (0xfffff80017f327c0) locked @
/usr/src/sys/netinet/tcp_subr.c:2169
shared rw tcpinp (tcpinp) r = 0 (0xfffff80017f325d8) locked @
/usr/src/sys/netinet/tcp_subr.c:2169
shared rw tcpinp (tcpinp) r = 0 (0xfffff80017f32020) locked @
/usr/src/sys/netinet/tcp_subr.c:2169
shared rw tcpinp (tcpinp) r = 0 (0xfffff80017f323f0) locked @
/usr/src/sys/netinet/tcp_subr.c:2169
panic: witness_warn
cpuid = 0
time = 1575430988
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00247668f0
vpanic() at vpanic+0x17e/frame 0xfffffe0024766950
panic() at panic+0x43/frame 0xfffffe00247669b0
witness_warn() at witness_warn+0x413/frame 0xfffffe0024766a70
userret() at userret+0xc0/frame 0xfffffe0024766ac0
amd64_syscall() at amd64_syscall+0x543/frame 0xfffffe0024766bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0024766bf0
--- syscall (2, FreeBSD ELF64, sys_fork), rip = 0x8003ad85a, rsp =
0x7fffffffead8, rbp = 0x7fffffffeb80 ---
KDB: enter: panic
sysctl.conf
#security.bsd.see_other_uids=0
security.bsd.see_other_uids=0
security.bsd.see_other_gids=0
security.bsd.see_jail_proc=0
security.bsd.unprivileged_read_msgbuf=0
security.bsd.unprivileged_proc_debug=0
kern.randompid=1
vfs.zfs.min_auto_ashift=12
rc.conf
clear_tmp_enable="YES"
syslogd_flags="-ss"
sendmail_enable="NONE"
hostname="freebsd"
ifconfig_vtnet0="DHCP"
local_unbound_enable="YES"
sshd_enable="YES"
ntpdate_enable="YES"
ntpd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
zfs_enable="YES"
pf_enable="YES"
pflog_enable="YES"
pflog_flags="-s 1500"
ddb_enable="yes"
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
