Re: ng_snd_item: Panic?

From: Andrey V. Elsukov <bu7cher_at_yandex.ru>
Date: Tue, 25 Jun 2019 12:18:43 +0300
On 24.06.2019 23:10, Larry Rosenman wrote:
>>> #5  0xffffffff828ee5b7 in ng_snd_item (item=0xfffff8021e3b4d80, flags=0)
>>>     at /usr/src/sys/netgraph/ng_base.c:2252
>>
>> It looks like you use some netgraph based ethernet interface.
>> The system got received ARP request and is going to send the reply,
>> but somehow mbuf with this ARP request has initialized m_next pointer,
>> thus it is considered as a chain of mbufs.
>>
>> in_arpinput() reuses received mbuf to construct the reply, but it
>> doesn't check that an mbut is a chain. It just sets m_len and sends it.
>> Then since you have INVARIANTS in your kernel, the netgraph code check
>> the actual length of the chain, and it doesn't match to m_len. It panics.
> 
> 
> so, is this a bug?  Timing race? Other?

I think we should determine that my assumption is correct :)
Can you show the output of the following commands from the kgdb for this
core?

(kgdb) f 7
(kgdb) p *m
(kgdb) p *m->m_next

-- 
WBR, Andrey V. Elsukov


Received on Tue Jun 25 2019 - 07:21:31 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:21 UTC