Re: crash in tcp6_usr_accept

On Mon, 26 Jun 2006, Michiel Boland wrote:

> Hi. I returned from holidays only to find my work machine had crashed. Looks 
> like the following line is the culprit.

Indeed -- committed your patch, thanks!

Robert N M Watson
Computer Laboratory
University of Cambridge

>
> static int
> tcp6_usr_accept(struct socket *so, struct sockaddr **nam)
> {
>        [...]
>        if (so->so_state & SS_ISDISCONNECTED) {
>                error = ECONNABORTED;
>                goto out;
>        }
>        [...]
> out:
>        [...]
>        INP_UNLOCK(inp);
>
>                   ^^^ inp has not been initialized at this stage
>
>
> quick fix:
>
> --- netinet/tcp_usrreq.c.orig	Thu Jun  8 17:28:23 2006
> +++ netinet/tcp_usrreq.c	Mon Jun 26 10:29:00 2006
> _at__at_ -647,10 +647,8 _at__at_
> 	int v4 = 0;
> 	TCPDEBUG0;
>
> -	if (so->so_state & SS_ISDISCONNECTED) {
> -		error = ECONNABORTED;
> -		goto out;
> -	}
> +	if (so->so_state & SS_ISDISCONNECTED)
> +		return ECONNABORTED;
>
> 	inp = sotoinpcb(so);
> 	KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
>
>
> FreeBSD 7.0-CURRENT #1: Fri Jun 16 00:19:30 CEST 2006
>    root_at_leefnet.office.internl.net:/usr/obj/usr/src/sys/LEEFNET
>
> Fatal trap 12: page fault while in kernel mode
> fault virtual address	= 0xa0
> fault code		= supervisor write, page not present
> instruction pointer	= 0x20:0xc0573d7e
> stack pointer	        = 0x28:0xd6ec7c08
> frame pointer	        = 0x28:0xd6ec7c2c
> code segment		= base 0x0, limit 0xfffff, type 0x1b
> 			= DPL 0, pres 1, def32 1, gran 1
> processor eflags	= interrupt enabled, resume, IOPL = 0
> current process		= 766 (httpd)
> trap number		= 12
> panic: page fault
> KDB: stack backtrace:
> kdb_backtrace(100,c215dd80,28,d6ec7bc8,c) at kdb_backtrace+0x29
> panic(c063640e,c0644b03,0,fffff,c226e69b) at panic+0xa8
> trap_fatal(d6ec7bc8,a0,c215dd80,0,2) at trap_fatal+0x2a6
> trap_pfault(d6ec7bc8,0,a0) at trap_pfault+0x1eb
> trap(c04b0008,c25a0028,c2150028,0,35) at trap+0x3b5
> calltrap() at calltrap+0x5
> --- trap 0xc, eip = 0xc0573d7e, esp = 0xd6ec7c08, ebp = 0xd6ec7c2c ---
> tcp6_usr_accept(c25d1bac,d6ec7c54,d6ec7c58,d6ec7c7c,c0522193) at 
> tcp6_usr_accept+0xc2
> soaccept(c25d1bac,d6ec7c54,c25ac900,0,0) at soaccept+0x7d
> accept1(c215dd80,d6ec7d04,0,d6ec7d30,c0612946) at accept1+0x42f
> accept(c215dd80,d6ec7d04,3,206,c0670028) at accept+0x10
> syscall(3b,3b,3b,82063b0,83dc050) at syscall+0x2ee
> Xint0x80_syscall() at Xint0x80_syscall+0x1f
> --- syscall (30, FreeBSD ELF32, accept), eip = 0x283c37ff, esp = 0xbfbfec0c, 
> ebp = 0xbfbfec38 ---
> Uptime: 7d11h16m47s
> Physical memory: 505 MB
> Dumping 127 MB: 112 96 80 64 48 32 16
>
> (kgdb) f 7
> #7  0xc0573d7e in tcp6_usr_accept (so=0xc215dd80, nam=0xd6ec7c54)
>    at atomic.h:149
> 149             __asm __volatile (
> (kgdb) info locals
> inp = (struct inpcb *) 0x0
> error = 53
> addr = {s_addr = 3256212864}
> addr6 = {__u6_addr = {__u6_addr8 = "\000\000\000\0004|ìÖ\232kNÀNé2Â",
>    __u6_addr16 = {0, 0, 31796, 55020, 27546, 49230, 59726, 49714},
>    __u6_addr32 = {0, 3605822516, 3226364826, 3258116430}}}
> port = 0
> v4 = 0