From owner-freebsd-bugs@FreeBSD.ORG Wed Sep 7 14:20:06 2011 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A1A0A1065674 for ; Wed, 7 Sep 2011 14:20:06 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 7D6968FC18 for ; Wed, 7 Sep 2011 14:20:06 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p87EK6OW087249 for ; Wed, 7 Sep 2011 14:20:06 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p87EK66J087248; Wed, 7 Sep 2011 14:20:06 GMT (envelope-from gnats) Resent-Date: Wed, 7 Sep 2011 14:20:06 GMT Resent-Message-Id: <201109071420.p87EK66J087248@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nikos Vassiliadis Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C26E11065672 for ; Wed, 7 Sep 2011 14:17:30 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 9772C8FC17 for ; Wed, 7 Sep 2011 14:17:30 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.4/8.14.4) with ESMTP id p87EHUAt010045 for ; Wed, 7 Sep 2011 14:17:30 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.4/8.14.4/Submit) id p87EHUIu010035; Wed, 7 Sep 2011 14:17:30 GMT (envelope-from nobody) Message-Id: <201109071417.p87EHUIu010035@red.freebsd.org> Date: Wed, 7 Sep 2011 14:17:30 GMT From: Nikos Vassiliadis To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/160541: [vimage][pf][patch] panic: userret: Returning on td 0xxxxxxxxx (pid xxxx, pftop) with vnet 0xxxxxxxxx set in pfioctl X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Sep 2011 14:20:06 -0000 >Number: 160541 >Category: kern >Synopsis: [vimage][pf][patch] panic: userret: Returning on td 0xxxxxxxxx (pid xxxx, pftop) with vnet 0xxxxxxxxx set in pfioctl >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Sep 07 14:20:06 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Nikos Vassiliadis >Release: 9.0-CURRENT >Organization: >Environment: FreeBSD lab.local 9.0-BETA2 FreeBSD 9.0-BETA2 #81 r225405M: Wed Sep 7 13:23:11 EEST 2011 root@lab.local:/usr/obj/usr/src/sys/LAB i386 >Description: A VIMAGE kernel panics when certain pf IOCTLs are used. The panic is triggered by pftop for example. Unread portion of the kernel message buffer: panic: userret: Returning on td 0xc3a0e2e0 (pid 1311, pftop) with vnet 0xc35a9000 set in pfioctl cpuid = 0 KDB: enter: panic Physical memory: 491 MB Dumping 55 MB: 40 24 8 >How-To-Repeat: build a VIMAGE kernel build pftop port kldload pf run pftop and cycle through the views the kernel will panic >Fix: For certain IOCTLs, CURVNET_RESTORE() is not called upon return from pfioctl():/sys/contrib/pf/net/pf_ioctl.c Patch attached with submission follows: Index: sys/contrib/pf/net/pf_ioctl.c =================================================================== --- sys/contrib/pf/net/pf_ioctl.c (revision 225405) +++ sys/contrib/pf/net/pf_ioctl.c (working copy) @@ -1517,9 +1517,11 @@ if (((struct pfioc_table *)addr)->pfrio_flags & PFR_FLAG_DUMMY) break; /* dummy operation ok */ - return (EPERM); + error = EPERM; + goto notpermitted; default: - return (EPERM); + error = EPERM; + goto notpermitted; } if (!(flags & FWRITE)) @@ -1564,14 +1566,18 @@ flags |= FWRITE; /* need write lock for dummy */ break; /* dummy operation ok */ } - return (EACCES); + error = EACCES; + goto notpermitted; case DIOCGETRULE: if (((struct pfioc_rule *)addr)->action == - PF_GET_CLR_CNTR) - return (EACCES); + PF_GET_CLR_CNTR) { + error = EACCES; + goto notpermitted; + } break; default: - return (EACCES); + error = EACCES; + goto notpermitted; } if (flags & FWRITE) @@ -3909,6 +3915,8 @@ rw_exit_read(&pf_consistency_lock); #endif +notpermitted: + /* EPERM and EACCES jump here */ CURVNET_RESTORE(); return (error); >Release-Note: >Audit-Trail: >Unformatted: