4.8-stable kernel panic

[Maxim Konovalov]

On Sun, 14 Sep 2003, 23:05-0500, Mike Silbersack wrote:

>
> On Sun, 14 Sep 2003 sysadmin at wvths.com wrote:
>
> > Hello,
> >
> > It's been almost a month now since I posted the original message on the
> > list and I'm wondering about the progress on resolving this problem.
> >
> > I still can reproduce the panics after cvs-supping to RELENG_4 ~ 23:00 EDT
> > today.
> >
> > Thanks much.
>
> Ooops, I forgot to follow up on this.
>
> Ok, a few questions:
>
> 1.  Can you compile INVARIANTS and INVARIANT_SUPPORT into your kernel?
> That might help us track down the problem.
>
> 2.  What does your network setup look like?  Are you using divert sockets,
> is there ppp in action, etc.
>
> I believe that I tried out your script at the time, and I couldn't find it
> to cause any problems on my system.

rwatson has fixed this panic in rev. 1.115 in -current:

revision 1.115
date: 2003/08/26 14:11:48;  author: rwatson;  state: Exp;  lines: +2 -0
M_PREPEND() with an argument of M_TRYWAIT can fail, meaning the
returned mbuf can be NULL.  Check for NULL in rip_output() when
prepending an IP header.  This prevents mbuf exhaustion from
causing a local kernel panic when sending raw IP packets.

PR:             kern/55886
Reported by:    Pawel Malachowski <pawmal-posting at freebsd.lublin.pl>
MFC after:      3 days

and haven't MFCed it yet.  Here is a patch for -stable:

Index: sys/netinet/raw_ip.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/raw_ip.c,v
retrieving revision 1.64.2.17
diff -u -r1.64.2.17 raw_ip.c
--- sys/netinet/raw_ip.c	9 Sep 2003 19:09:22 -0000	1.64.2.17
+++ sys/netinet/raw_ip.c	15 Sep 2003 04:21:59 -0000
@@ -257,6 +257,8 @@
 			return(EMSGSIZE);
 		}
 		M_PREPEND(m, sizeof(struct ip), M_WAIT);
+		if (m == NULL)
+			return(ENOBUFS);
 		ip = mtod(m, struct ip *);
 		ip->ip_tos = inp->inp_ip_tos;
 		ip->ip_off = 0;
%%%

-- 
Maxim Konovalov, maxim at macomnet.ru, maxim at FreeBSD.org