IPSec Panic/Shutdown

[Bjoern A. Zeeb]

On Wed, 7 Jan 2004, Larry Rosenman wrote:

hi,

> On a shutdown, I got the following panic:
> Sources from Last Nite ~19:30 US/Central.
..
> #11 0xc071c768 in calltrap () at {standard input}:94
> #12 0xc066985e in key_freesp (sp=0xc469a980) at
> /usr/src/sys/netkey/key.c:1106
> #13 0xc065b6c4 in ipsec4_delete_pcbpolicy (inp=0xc469a980)
>     at /usr/src/sys/netinet6/ipsec.c:1532
> #14 0xc062045a in in_pcbdetach (inp=0xc469a980) at
> /usr/src/sys/netinet/in_pcb.c:689


I am finally up and running for
 6:01AM  up  8:24, 1 user, load averages: 0.15, 0.14, 0.10

and all methods I previously could crash this router due to IPSec
related problems have failed yet.

In the case above an extra --sp->refcnt led to a free of an SP
(secpolicy) and the memory gets touched after free (in this special
case the refcnt is decremented by one - obviously this is the one that
should lead to the free).

So I should have a patch for this in the queue. Should be able to
build a new kernel with minimalistic changes this evening and if
everything still is ok submit a patch for review in 24 hours.

Hopefully I am not overconfident ;-)

-- 
Bjoern A. Zeeb				bzeeb at Zabbadoz dot NeT
56 69 73 69 74				http://www.zabbadoz.net/