[Bug 260539] inp_next() NULL inp dereference?

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260539

            Bug ID: 260539
           Summary: inp_next() NULL inp dereference?
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

In inp_next(), in this for-loop:

        if (ii->inp == NULL) {          /* First call. */
                smr_enter(ipi->ipi_smr);
                /* This is unrolled CK_LIST_FOREACH(). */
                for (inp = II_LIST_FIRST(ipi, hash);
                    inp != NULL;
                    inp = II_LIST_NEXT(inp, hash)) {
                        if (match != NULL && (match)(inp, ctx) == false)
                                continue;
                        if (__predict_true(inp_smr_lock(inp, lock)))
                                break;
                        else {
                                smr_enter(ipi->ipi_smr);
                                MPASS(inp != II_LIST_FIRST(ipi, hash));
                                inp = II_LIST_FIRST(ipi, hash);
                        }
                }

I wonder if the last "inp = II_LIST_FIRST(ipi, hash)" ought to be
followed by "if(inp == NULL) break", since it will be immediately
followed by the for-loop's II_LIST_NEXT().

I bring this up because I've seen a kernel page fault in the
for-loop's II_LIST_NEXT due to a NULL inp. However, I cannot reproduce
it. It occured at a time when the kernel was killing processes due to
low memory.

FreeBSD  14.0-CURRENT FreeBSD 14.0-CURRENT #165
main-n250912-e4746deeda02-dirty: Sat Dec 18 05:12:30 EST 2021    
rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM  riscv

panic: Fatal page fault at 0xffffffc0003a6750: 0x000000000001b8
--- exception 13, tval = 0x1b8
ck_pr_md_load_ptr() at ck_pr_md_load_ptr+0x14
inp_next() at inp_next+0x206
tcp_drain() at tcp_drain+0xcc
mb_reclaim() at mb_reclaim+0x78
vm_pageout_lowmem() at vm_pageout_lowmem+0xf8
vm_pageout_worker() at vm_pageout_worker+0x1ba
vm_pageout() at vm_pageout+0x1ce
fork_exit() at fork_exit+0x80
fork_trampoline() at fork_trampoline+0xa

-- 
You are receiving this mail because:
You are the assignee for the bug.