Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 27 Aug 2019 11:22:03 -0600
From:      Alan Somers <asomers@freebsd.org>
To:        Peter Holm <pho@freebsd.org>
Cc:        John Baldwin <jhb@freebsd.org>, src-committers <src-committers@freebsd.org>, svn-src-all <svn-src-all@freebsd.org>, svn-src-head <svn-src-head@freebsd.org>
Subject:   Re: svn commit: r351522 - in head: sbin/ifconfig share/man/man4 sys/conf sys/kern sys/modules sys/modules/ktls_ocf sys/net sys/netinet sys/netinet/tcp_stacks sys/netinet6 sys/opencrypto sys/sys tools/t...
Message-ID:  <CAOtMX2i71h8VUK%2BKHv4X8zhAUJCq0z9VPyJxNhv%2ByREQX%2B6=qg@mail.gmail.com>
In-Reply-To: <20190827170527.GA7111@x8.osted.lan>
References:  <201908270001.x7R01vUB052426@repo.freebsd.org> <20190827143953.GA5092@x8.osted.lan> <6f06637f-6486-bd2c-eebe-f14924e11e38@FreeBSD.org> <20190827170527.GA7111@x8.osted.lan>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Aug 27, 2019 at 11:05 AM Peter Holm <pho@freebsd.org> wrote:

> On Tue, Aug 27, 2019 at 09:02:31AM -0700, John Baldwin wrote:
> > On 8/27/19 7:39 AM, Peter Holm wrote:
> > > On Tue, Aug 27, 2019 at 12:01:57AM +0000, John Baldwin wrote:
> > >> Author: jhb
> > >> Date: Tue Aug 27 00:01:56 2019
> > >> New Revision: 351522
> > >> URL: https://svnweb.freebsd.org/changeset/base/351522
> > >>
> > >> Log:
> > >>   Add kernel-side support for in-kernel TLS.
> > >>
> > >
> > > Could this be yours?
> > >
> > > 20190827 15:55:34 all (496/668): sendfile12.sh
> > > Aug 27 15:56:16 mercat1 kernel: pid 50036 (swap), jid 0, uid 0, was
> killed: out of swap space
> > > panic: non-ext_pgs mbuf with TLS session
> >
> > Possibly, though if sfio was freed and marked with 0xdeadc0de junk, then
> it
> > would trip over this assertion for any use-after-free.  I see in gdb
> that you
> > couldn't see sfio because of clang's poor debug info.  It would be
> really good
> > to try to find the contents of sfio to debug this further.
> >
> > You should be able to find it via 'bp->b_caller1' in frame 14:
> >
> > 'p *(struct sf_io *)bp->b_caller1'
> >
>
> Here's a repeat where the involved files are compiled with "-O0":
> https://people.freebsd.org/~pho/stress/log/jhb009.txt
>
> Let me know if you need the kernel + core.
>
> - Peter
>

This panic is easily reproducible by the fusefs test suite.
$ cd /usr/tests/sys/fs/fusefs/
$ ./read --gtest_filter=Read.sendfile

panic: non-ext_pgs mbuf with TLS session
cpuid = 3
time = 1566926504
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe0050bdc560
vpanic() at vpanic+0x19d/frame 0xfffffe0050bdc5b0
panic() at panic+0x43/frame 0xfffffe0050bdc610
sendfile_iodone() at sendfile_iodone+0x28e/frame 0xfffffe0050bdc660
vn_sendfile() at vn_sendfile+0x1598/frame 0xfffffe0050bdc8f0
sendfile() at sendfile+0x127/frame 0xfffffe0050bdc980
amd64_syscall() at amd64_syscall+0x2b9/frame 0xfffffe0050bdcab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0050bdcab0
--- syscall (393, FreeBSD ELF64, sys_sendfile), rip = 0x80052d9ea, rsp =
0x7fffffffe5a8, rbp = 0x7fffffffe790 ---

-Alan



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAOtMX2i71h8VUK%2BKHv4X8zhAUJCq0z9VPyJxNhv%2ByREQX%2B6=qg>