[Bug 269441] crash running jail network command from different jail

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=269441

            Bug ID: 269441
           Summary: crash running jail network command from different jail
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: olivier@freebsd.org

Created attachment 240030
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=240030&action=edit
core dump text

kernel crash if running a network command (like a ping) in a jail/vnet from a
shell running in a different fib.

Tested on:
FreeBSD  14.0-CURRENT FreeBSD 14.0-CURRENT #36 main-n260757-ded5f2954e1a: Wed
Feb  8 22:32:37 CET 2023  

How to reproduce:
--------
#!/bin/sh
echo "Creating an empty jail/vnet..."
ifconfig lo888 create
jail -c name=bug persist vnet vnet.interface=lo888
jexec bug ifconfig lo888 1.1.1.1/24 up
echo "Starting a shell on fib 2..."
sysctl net.fibs=3
setfib 2 sh
echo "crashing by generating network traffic into jail from fib 2:"
jexec bug ping -c 1 1.1.1
----------


core dump extract (full log attached):

(kgdb) #0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:59
#1  dump_savectx () at /usr/src/sys/kern/kern_shutdown.c:403
#2  0xffffffff80be8d48 in dumpsys (di=0x0)
    at /usr/src/sys/x86/include/dump.h:87
#3  doadump (textdump=1) at /usr/src/sys/kern/kern_shutdown.c:432
#4  kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:539
#5  0xffffffff80be928f in vpanic (fmt=<optimized out>,
    ap=ap@entry=0xfffffe0429c18900) at /usr/src/sys/kern/kern_shutdown.c:983
#6  0xffffffff80be90c3 in panic (fmt=<unavailable>)
    at /usr/src/sys/kern/kern_shutdown.c:907
#7  0xffffffff810b88c9 in trap_fatal (frame=0xfffffe0429c189f0, eva=0)
    at /usr/src/sys/amd64/amd64/trap.c:955
#8  0xffffffff810b891f in trap_pfault (frame=0xfffffe0429c189f0,
    usermode=false, signo=<optimized out>, ucode=<optimized out>)
    at /usr/src/sys/amd64/amd64/trap.c:763
#9  <signal handler called>
#10 0x0000000000000000 in ?? ()
#11 0xffffffff80d912ed in fib4_lookup (fibnum=<optimized out>, dst=...,
    scopeid=scopeid@entry=0, flags=flags@entry=0, flowid=flowid@entry=0)
    at /usr/src/sys/netinet/in_fib.c:121
#12 0xffffffff80d9aa54 in in_pcbladdr (inp=inp@entry=0xfffff81109481380,
    faddr=faddr@entry=0xfffff810970368a8,
    laddr=laddr@entry=0xfffff810970368a4, cred=0xfffff81110c47200)
    at /usr/src/sys/netinet/in_pcb.c:1145
#13 0xffffffff80da8df1 in rip_send (so=<optimized out>,
    pruflags=<optimized out>, m=0xfffff81097036800, nam=<optimized out>,
    control=<optimized out>, td=<optimized out>)
    at /usr/src/sys/netinet/raw_ip.c:496
#14 0xffffffff80c90839 in sosend_generic (so=0xfffff81097071b40, addr=0x0,
    uio=0xfffffe0429c18ce8, top=0xfffff81097036800, control=0x0, flags=0,
    td=0xfffffe01bff4b740) at /usr/src/sys/kern/uipc_socket.c:1783

-- 
You are receiving this mail because:
You are the assignee for the bug.