From owner-freebsd-current@FreeBSD.ORG Fri Jun 8 14:36:10 2007 Return-Path: X-Original-To: current@freebsd.org Delivered-To: freebsd-current@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id C051216A41F for ; Fri, 8 Jun 2007 14:36:10 +0000 (UTC) (envelope-from ianf@clue.co.za) Received: from munchkin.clue.co.za (munchkin.clue.co.za [66.219.59.160]) by mx1.freebsd.org (Postfix) with ESMTP id 8D95E13C480 for ; Fri, 8 Jun 2007 14:36:10 +0000 (UTC) (envelope-from ianf@clue.co.za) DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=20070313; d=clue.co.za; h=Received:Received:Received:To:Subject:From:X-Attribution:Date:Message-Id; b=lmYo5BxEk8H/vCWlN+TxAxyjwAmKM1tjwANa8Iy7WlWBt8Lfd/cFW5fbU5o3Ujjh87EKpxinajiOZ3qcBfEi3QLLnzSN2n3Kc8AP2FBwadyxUGUKFxh2nliqbehX7KYz14MIlS9Coqb4duyyCM5XqHr8IMc8JwBBlnxMxz98PEcWTgudcaKM7uVMmzWtixBRK98CMIy/biyQJO2pG1rkegr8JWXLVxoD0N1saj2NWs/jLSBdicN7ns9Iu8QFAPdY; Received: from uucp by munchkin.clue.co.za with local (Exim 4.66) (envelope-from ) id 1HwfZR-0006z1-TA for current@freebsd.org; Fri, 08 Jun 2007 14:36:10 +0000 Received: from atlas.clue.co.za ([10.0.0.18] helo=clue.co.za) by urchin.clue.co.za with esmtpa (Exim 4.66) (envelope-from ) id 1HwfZH-0003q9-Ua for current@freebsd.org; Fri, 08 Jun 2007 14:35:59 +0000 Received: from localhost ([127.0.0.1] helo=clue.co.za) by clue.co.za with esmtp (Exim 4.67 (FreeBSD)) (envelope-from ) id 1HwfZE-000C9H-C6 for current@freebsd.org; Fri, 08 Jun 2007 16:35:56 +0200 To: current@freebsd.org From: Ian FREISLICH X-Attribution: BOFH Date: Fri, 08 Jun 2007 16:35:56 +0200 Message-Id: Cc: Subject: Re: Panic in ipfw X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jun 2007 14:36:10 -0000 > Ian FREISLICH wrote: > > Hi > > > > I got this panic yesterday on a fairly busy firewall. I have some > > private patches to ip_fw2.c and to the em driver (see the earlier > > "em0 hijacking traffic to port 623" thread). I don't think this > > panic is a result of those changes. > > > > It occurred round about the time an address was added to an interface. > > > > I'll keep the crashdump around for a while in case anyone wants more data. > > > > FreeBSD firewall2 7.0-CURRENT FreeBSD 7.0-CURRENT #4: Thu May 24 10:43:20 SAST 2007 ianf@firewall2:/usr/obj/usr/src/sys/FIREWALL i386 > > > > There is no locking to say between the firewall and the interface addresses. > it probably followed a bad pointer when the addresses were changed.. > > your bug report should say > > "ipfw doesn't take part in interface address locking, > leading to occasional crashes" This is the second crash I've seen as a result of this locking omission in about 1.5 years of production: http://lists.freebsd.org/pipermail/freebsd-current/2006-August/065488.html I'm not sure how to fix this without a large performance penalty. To acquire the lock each time for the "me" check might result in many many acquisitions when checking a packet against the ruleset. However to acquire it once for every packet may be unnecessary. Also, I'm not really sure which lock to use of the plethora that exist. Ian -- Ian Freislich