Panic (in firewall while doing lots of ifconfigs)
Ian FREISLICH
if at hetzner.co.za
Tue Aug 29 09:21:12 UTC 2006
Dmitry Pryanishnikov wrote:
>
> Hello!
>
> On Tue, 29 Aug 2006, Ian FREISLICH wrote:
> > 2589 case O_IP_SRC_ME:
> > 2590 if (is_ipv4) {
> > 2591 struct ifnet *tif;
> > 2592
> > 2593 INADDR_TO_IFP(src_ip, tif);
> > 2594 match = (tif != NULL);
> > 2595 }
>
> Looks like a lack of the proper locking against IP address
> addition/removal. These (O_IP_SRC_ME/O_IP_DST_ME),
> as well as matching of interface by IP address in the iface_match():
>
> /* XXX lock? */
> TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) {
> if (ia->ifa_addr == NULL)
> continue;
>
> are worrying for these races exist since version 1.1 of the ip_fw2.c
> for more than 4 years! Alas I'm not an expert in kernel locking, that's why
> I don't know how to correctly lock these places.
I was surprised that I'm not seeing this on my other firewall because
it has 34* the packet rate, but now that I think about it, this is
an SMP machine and the other one with higher load is UP so locking
would be more of an issue here.
Ian
--
Ian Freislich
More information about the freebsd-current
mailing list