Date: Sat, 25 Sep 2021 19:43:35 +0300 From: Andriy Gapon <avg@FreeBSD.org> To: Kristof Provost <kp@FreeBSD.org> Cc: net@freebsd.org, Konstantin Belousov <kib@freebsd.org> Subject: Re: page fault in pfioctl Message-ID: <25ec0404-4fc8-c8c5-3916-20c8e094aa62@FreeBSD.org> In-Reply-To: <e94ad428-095d-e7cd-101f-e93ea995baa8@FreeBSD.org> References: <cc06b2d5-5349-33f3-4bdd-aa2ba5fa75b4@FreeBSD.org> <980E0B5C-41CF-466E-AD45-7B93532199F4@freebsd.org> <a081e770-581a-0e40-4076-ac11b59e1616@FreeBSD.org> <B41D81F5-5B2B-4944-830E-C8F688BC8C62@FreeBSD.org> <e94ad428-095d-e7cd-101f-e93ea995baa8@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 25/09/2021 19:38, Andriy Gapon wrote: > On 25/09/2021 19:34, Kristof Provost wrote: >> On 25 Sep 2021, at 18:25, Andriy Gapon wrote: >>> On 13/06/2021 11:19, Kristof Provost wrote: >>>> On 13 Jun 2021, at 09:41, Andriy Gapon <avg@freebsd.org> wrote: >>>>> Based on >>>>> the panic message (page fault with non-sleepable locks held), it seems that >>>>> the problem is with holding the lock across the copyout. Usually that >>>>> won't panic, but if the destination happens to be paged out... And only >>>>> with INVARIANTS, I guess... >>>> >>>> Oh right. Thanks. I’ve gotten bitten by that one before, but had clearly >>>> garbage collected the memory. >>>> >>>> I’ll fix this one and check for others on Monday. >>>> >>>> I’ll also see of we can persuade copyout to always panic on this bug, not >>>> just when the destination memory is actually paged out. That way we’ll catch >>>> this in the regression tests in the future. >>> >>> I upgraded to the latest stable/13 and hit a fresh panic of the same type. >>> This time it's in pf_getstatus() and it's a copyout while 'pf rulesets' lock >>> is held. >>> >> I believe that’s fixed by >> https://cgit.freebsd.org/src/commit/sys/netpfil/pf/pf_ioctl.c?id=cb13059663e455b3fc69c293dadec53c164490dc >> > > Thank you for the pointer! > I believe it should help with the witness warning. > Still not sure what's going on with copyout_nosmap_std(). > Ah, sorry for the noise, trap_fatal() is exactly because the witness did not like the fault. -- Andriy Gapon
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?25ec0404-4fc8-c8c5-3916-20c8e094aa62>