crash in tcp6_usr_accept
Robert Watson
rwatson at FreeBSD.org
Mon Jun 26 09:38:33 UTC 2006
On Mon, 26 Jun 2006, Michiel Boland wrote:
> Hi. I returned from holidays only to find my work machine had crashed. Looks
> like the following line is the culprit.
Indeed -- committed your patch, thanks!
Robert N M Watson
Computer Laboratory
University of Cambridge
>
> static int
> tcp6_usr_accept(struct socket *so, struct sockaddr **nam)
> {
> [...]
> if (so->so_state & SS_ISDISCONNECTED) {
> error = ECONNABORTED;
> goto out;
> }
> [...]
> out:
> [...]
> INP_UNLOCK(inp);
>
> ^^^ inp has not been initialized at this stage
>
>
> quick fix:
>
> --- netinet/tcp_usrreq.c.orig Thu Jun 8 17:28:23 2006
> +++ netinet/tcp_usrreq.c Mon Jun 26 10:29:00 2006
> @@ -647,10 +647,8 @@
> int v4 = 0;
> TCPDEBUG0;
>
> - if (so->so_state & SS_ISDISCONNECTED) {
> - error = ECONNABORTED;
> - goto out;
> - }
> + if (so->so_state & SS_ISDISCONNECTED)
> + return ECONNABORTED;
>
> inp = sotoinpcb(so);
> KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
>
>
> FreeBSD 7.0-CURRENT #1: Fri Jun 16 00:19:30 CEST 2006
> root at leefnet.office.internl.net:/usr/obj/usr/src/sys/LEEFNET
>
> Fatal trap 12: page fault while in kernel mode
> fault virtual address = 0xa0
> fault code = supervisor write, page not present
> instruction pointer = 0x20:0xc0573d7e
> stack pointer = 0x28:0xd6ec7c08
> frame pointer = 0x28:0xd6ec7c2c
> code segment = base 0x0, limit 0xfffff, type 0x1b
> = DPL 0, pres 1, def32 1, gran 1
> processor eflags = interrupt enabled, resume, IOPL = 0
> current process = 766 (httpd)
> trap number = 12
> panic: page fault
> KDB: stack backtrace:
> kdb_backtrace(100,c215dd80,28,d6ec7bc8,c) at kdb_backtrace+0x29
> panic(c063640e,c0644b03,0,fffff,c226e69b) at panic+0xa8
> trap_fatal(d6ec7bc8,a0,c215dd80,0,2) at trap_fatal+0x2a6
> trap_pfault(d6ec7bc8,0,a0) at trap_pfault+0x1eb
> trap(c04b0008,c25a0028,c2150028,0,35) at trap+0x3b5
> calltrap() at calltrap+0x5
> --- trap 0xc, eip = 0xc0573d7e, esp = 0xd6ec7c08, ebp = 0xd6ec7c2c ---
> tcp6_usr_accept(c25d1bac,d6ec7c54,d6ec7c58,d6ec7c7c,c0522193) at
> tcp6_usr_accept+0xc2
> soaccept(c25d1bac,d6ec7c54,c25ac900,0,0) at soaccept+0x7d
> accept1(c215dd80,d6ec7d04,0,d6ec7d30,c0612946) at accept1+0x42f
> accept(c215dd80,d6ec7d04,3,206,c0670028) at accept+0x10
> syscall(3b,3b,3b,82063b0,83dc050) at syscall+0x2ee
> Xint0x80_syscall() at Xint0x80_syscall+0x1f
> --- syscall (30, FreeBSD ELF32, accept), eip = 0x283c37ff, esp = 0xbfbfec0c,
> ebp = 0xbfbfec38 ---
> Uptime: 7d11h16m47s
> Physical memory: 505 MB
> Dumping 127 MB: 112 96 80 64 48 32 16
>
> (kgdb) f 7
> #7 0xc0573d7e in tcp6_usr_accept (so=0xc215dd80, nam=0xd6ec7c54)
> at atomic.h:149
> 149 __asm __volatile (
> (kgdb) info locals
> inp = (struct inpcb *) 0x0
> error = 53
> addr = {s_addr = 3256212864}
> addr6 = {__u6_addr = {__u6_addr8 = "\000\000\000\0004|ìÖ\232kNÀNé2Â",
> __u6_addr16 = {0, 0, 31796, 55020, 27546, 49230, 59726, 49714},
> __u6_addr32 = {0, 3605822516, 3226364826, 3258116430}}}
> port = 0
> v4 = 0
More information about the freebsd-current
mailing list