6.2-PRE: Fatal Trap?

[Robert Watson]

On Sat, 30 Dec 2006, Larry Rosenman wrote:

> I had to on an emergency basis replace my aging P-1 Firewall.  The guys at 
> my hosting company gave me an AthlonXP 2200+, and with 6.1 (all the way up 
> to today's RELENG_6_1), it works fine.
>
> I tried(!) to put 6.2-PRE (RELENG_6) on it, but no matter what I do, it 
> panics when either NTPD or SSHD starts (depending on whats first).
>
> Unfortunately, I don't have the exact panic (it's a page not present, and if 
> I understood my remote eyes/hands right, a NULL de-reference).
>
> The box is 300+ miles away (Distance from Austin, TX to Dallas, TX).
>
> Anyone got ideas?

It looks like the attached patch was missed in the MFC I just pointed at. 
Could you try applying it?

You can also fetch it from:

   http://www.watson.org/~robert/freebsd/20061230-20061230-tcp_pcb_fix.diff

Robert N M Watson
Computer Laboratory
University of Cambridge

Index: tcp_subr.c
===================================================================
RCS file: /zoo/cvsup/FreeBSD-CVS/src/sys/netinet/tcp_subr.c,v
retrieving revision 1.228.2.12
diff -u -r1.228.2.12 tcp_subr.c
--- tcp_subr.c	1 Oct 2006 05:33:50 -0000	1.228.2.12
+++ tcp_subr.c	30 Dec 2006 15:18:25 -0000
@@ -300,6 +300,14 @@
  		uma_zone_set_max(tcptw_zone, tcptw_auto_size());
  }

+static int
+tcp_inpcb_init(void *mem, int size, int flags)
+{
+	struct inpcb *inp = (struct inpcb *) mem;
+	INP_LOCK_INIT(inp, "inp", "tcpinp");
+	return (0);
+}
+
  void
  tcp_init()
  {
@@ -328,7 +336,7 @@
  	tcbinfo.porthashbase = hashinit(hashsize, M_PCB,
  					&tcbinfo.porthashmask);
  	tcbinfo.ipi_zone = uma_zcreate("inpcb", sizeof(struct inpcb),
-	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
+	    NULL, NULL, tcp_inpcb_init, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
  	uma_zone_set_max(tcbinfo.ipi_zone, maxsockets);
  #ifdef INET6
  #define TCP_MINPROTOHDR (sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
@@ -1005,6 +1013,7 @@
  	error = 0;
  	for (i = 0; i < n; i++) {
  		inp = inp_list[i];
+		INP_LOCK(inp);
  		if (inp->inp_gencnt <= gencnt) {
  			struct xtcpcb xt;
  			caddr_t inp_ppcb;
@@ -1028,8 +1037,11 @@
  				xt.xt_socket.xso_protocol = IPPROTO_TCP;
  			}
  			xt.xt_inp.inp_gencnt = inp->inp_gencnt;
+			INP_UNLOCK(inp);
  			error = SYSCTL_OUT(req, &xt, sizeof xt);
-		}
+		} else
+			INP_UNLOCK(inp);
+
  	}
  	if (!error) {
  		/*