From nobody Sun Dec 19 11:20:37 2021 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 79BF418EACC3 for ; Sun, 19 Dec 2021 11:20:38 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JH0dK4ZK2z4VKS for ; Sun, 19 Dec 2021 11:20:37 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 670B521A8F for ; Sun, 19 Dec 2021 11:20:37 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 1BJBKb55019283 for ; Sun, 19 Dec 2021 11:20:37 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 1BJBKbt8019282 for bugs@FreeBSD.org; Sun, 19 Dec 2021 11:20:37 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 260539] inp_next() NULL inp dereference? Date: Sun, 19 Dec 2021 11:20:37 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: rtm@lcs.mit.edu X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1639912837; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1LB8T0oRZd6DpNYdPm9QOvPfje4Rq+KAgnfCMAajvLc=; b=INWmTnDWBafnFg1hgpicFFd+cB03PHmBopMpstwkV6vjGYH7Lp/XrAFzlpdvOjMLODi0b3 TL+Am1UbE4+lHeyTuOfj5w2RF3zMBpqs11SgvLTJ51CXYpf6R5ET2ss5+iV8nDqMLq56HY kJ1lgdYrLW5CNuAGbX0gVfLwlb8LSigiMpnpwywkgW92y7oePzw8eFwKwkEMf691GqPrHV 9YliX/bVyDZpQX0nqmyYo0ID8XDWAqCKSQOO3fP1VH1EhXp/Cmaj93AZJWLMNL0gjz+6FY 0NXOTlKn8XJhJVFAF8LCs5ABXkBrQmjc9lIYR4y/5V0yG7RDIDwdKwNNQxktMQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1639912837; a=rsa-sha256; cv=none; b=AnoyBlkpQ5lZzwnzpsNkk8xT1x4Ru4bvqj9PMR9AKrIRhvhuyThUVUi3/DB6Dq4MTohw6/ vtEHPSxDebW4sBHXeLz4ftIJXo1c1hUlJd4xIbIO1Iclz9mScN6SuAiZT5zZ7sHSDgLV4H nJKPnIzxRSk0Mt7aK4t/Z/H74GQRNBfwjU1tfwDahRItPpQCWZjInxKyt+RsvTLCQCwILq WiamJsnxtRBrg5MEjueM0xT/t2IDkq8UFeItriBasCkmDI0iZG0ffcCViFKrtskQU8DUM/ 4HOM4QJ32cr/1QZzXPUZ/Vir/x48nM6dfLhEEK/eRpeywf/+HgAp4V9E9Xp4GA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D260539 Bug ID: 260539 Summary: inp_next() NULL inp dereference? Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu In inp_next(), in this for-loop: if (ii->inp =3D=3D NULL) { /* First call. */ smr_enter(ipi->ipi_smr); /* This is unrolled CK_LIST_FOREACH(). */ for (inp =3D II_LIST_FIRST(ipi, hash); inp !=3D NULL; inp =3D II_LIST_NEXT(inp, hash)) { if (match !=3D NULL && (match)(inp, ctx) =3D=3D fal= se) continue; if (__predict_true(inp_smr_lock(inp, lock))) break; else { smr_enter(ipi->ipi_smr); MPASS(inp !=3D II_LIST_FIRST(ipi, hash)); inp =3D II_LIST_FIRST(ipi, hash); } } I wonder if the last "inp =3D II_LIST_FIRST(ipi, hash)" ought to be followed by "if(inp =3D=3D NULL) break", since it will be immediately followed by the for-loop's II_LIST_NEXT(). I bring this up because I've seen a kernel page fault in the for-loop's II_LIST_NEXT due to a NULL inp. However, I cannot reproduce it. It occured at a time when the kernel was killing processes due to low memory. FreeBSD 14.0-CURRENT FreeBSD 14.0-CURRENT #165 main-n250912-e4746deeda02-dirty: Sat Dec 18 05:12:30 EST 2021=20=20=20=20 rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv panic: Fatal page fault at 0xffffffc0003a6750: 0x000000000001b8 --- exception 13, tval =3D 0x1b8 ck_pr_md_load_ptr() at ck_pr_md_load_ptr+0x14 inp_next() at inp_next+0x206 tcp_drain() at tcp_drain+0xcc mb_reclaim() at mb_reclaim+0x78 vm_pageout_lowmem() at vm_pageout_lowmem+0xf8 vm_pageout_worker() at vm_pageout_worker+0x1ba vm_pageout() at vm_pageout+0x1ce fork_exit() at fork_exit+0x80 fork_trampoline() at fork_trampoline+0xa --=20 You are receiving this mail because: You are the assignee for the bug.=