Enabling IPSec panics stable/9 (runs OK on stable/8)
VANHULLEBUS Yvan
vanhu at FreeBSD.org
Wed Jan 4 16:31:34 UTC 2012
On Wed, Jan 04, 2012 at 04:17:41PM +0100, Attila Nagy wrote:
[....]
> #7 0xffffffff809bf779 in ipsec_process_done (m=0xfffffe000c7c7a00,
> isr=0xfffffe001bf54380) at
> /data/usr/src/sys/netipsec/ipsec_output.c:170
>
> Here seems to be the problem....
> Can you do the following (in this order) in kgdb:
> frame 7
> p saidx
> p *saidx
>
> (kgdb) frame 7
> #7 0xffffffff809bf779 in ipsec_process_done (m=0xfffffe000c7c7a00,
> isr=0xfffffe001bf54380) at
> /data/usr/src/sys/netipsec/ipsec_output.c:170
> 170 switch (saidx->dst.sa.sa_family) {
> (kgdb) p saidx
> No symbol "saidx" in current context.
????
There *is* such a symbol, as confirmed by kgdb's output when you
switched to frame 7 !
Could you check that you are running a correct debug kernel ?
> The latest will probably generate an error, as (if you have the exact
> same ipsec_output.c as I have from HEAD) saidx will probably have an
> invalid adress.
>
> I have the same as in HEAD.
Yep, kgdb's outputs confirms that (at least for this line, which is
the most important).
> [...]
>
> 8-STABLE runs fine with the same config.
>
> Strange.... I'll review changes in IPsec stack which have been done in
> STABLE/9 and not backported to STABLE/8.....
>
> Oh, sorry, not quite an up-to-date 8-STABLE, it's from Sat May 21
> 22:05:26 CEST 2011 (csup'd some hours earlier).
> Should I check with a more recent version? Does that help?
> Thanks for helping.
Yes, this may help if you try with a most recent 8-STABLE: I don't
remember exactly what, but I'm quite sure there have been some IPsec
related commits on stable/8 between that date and now !
Yvan.
More information about the freebsd-stable
mailing list