https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297678
Bug ID: 297678
Summary: pf: page fault in pf_step_into_anchor()
Product: Base System
Version: 15.0-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 273928
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273928&action=edit
pf.conf
using this (partial) ruleset:
anchor out on arpa {
match inet proto tcp scrub (max-mss 1460)
match inet6 proto tcp scrub (max-mss 1440)
pass out inet from 198.18.0.0/15 to any nat-to $ext_nat/32
# Block invalid traffic
block return log quick from any to <droplist> label
"spamhaus-droplist-out"
block return log quick from any to <noinet> label "to-noinet-out"
block return log quick from any to <public> label "to-public-out"
block return log quick from !<public> to any label
"not-from-public-out"
# Block outgoing SMTP, SMB and other bad traffic to the Internet.
block return log quick proto tcp from ! <smtp-allow> to any port 25
label "smtp-out"
block return log quick proto tcp from any to any port { netbios-ns,
netbios-dgm, netbios-ssn, microsoft-ds } label "smb-tcp-out"
block return log quick proto udp from any to any port { netbios-ns,
netbios-dgm, netbios-ssn, microsoft-ds } label "smb-udp-out"
}
causes a reproducible page fault after a few seconds of traffic processing:
Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0xd51649b0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff82780db1
stack pointer = 0x28:0xfffffe00d5164710
frame pointer = 0x28:0xfffffe00d5164770
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (swi1: netisr 0)
rdi: fffffe0019002600 rsi: fffffe0019002600 rdx: 0000000000000001
rcx: 0000000000000001 r8: 0000000000000010 r9: fffffe0018eb9a80
rax: fffffe00d5164bf8 rbx: fffffe00d5164868 rbp: fffffe00d5164770
r10: 0000000000000000 r11: ffffffff83a40500 r12: fffff800750e9800
r13: fffffe00d5164a90 r14: 00000000d51649b0 r15: fffff8034d571110
trap number = 12
panic: page fault
cpuid = 0
time = 1787225169
KDB: stack backtrace:
#0 0xffffffff80be24c3 at kdb_backtrace+0x63
#1 0xffffffff80b94a76 at vpanic+0x136
#2 0xffffffff80b94933 at panic+0x43
#3 0xffffffff810b0312 at trap_pfault+0x3d2
#4 0xffffffff810861a8 at calltrap+0x8
#5 0xffffffff827800db at pf_step_into_anchor+0xcb
#6 0xffffffff82780d28 at pf_match_rule+0xc08
#7 0xffffffff82788714 at pf_test_rule+0x444
#8 0xffffffff82787b6d at pf_test+0x2a2d
#9 0xffffffff827a217e at pf_check_out+0x2e
#10 0xffffffff80ce8b9d at pfil_mbuf_fwd+0x3d
#11 0xffffffff80d64a24 at ip_tryforward+0x264
#12 0xffffffff80d67129 at ip_input+0x2e9
#13 0xffffffff80ce62dd at swi_net+0x12d
#14 0xffffffff80b4db3e at ithread_loop+0x23e
#15 0xffffffff80b4a0a0 at fork_exit+0x80
#16 0xffffffff810871ce at fork_trampoline+0xe
full stack trace:
#2 0xffffffff80b945ee in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:519
#3 0xffffffff80b94b07 in vpanic (fmt=0xffffffff8120a73a "%s",
ap=ap@entry=0xfffffe00d51645d0) at /usr/src/sys/kern/kern_shutdown.c:974
#4 0xffffffff80b94933 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:887
#5 0xffffffff810b0312 in trap_fatal (frame=<optimized out>, eva=<optimized
out>) at /usr/src/sys/amd64/amd64/trap.c:969
#6 0xffffffff810b0312 in trap_pfault (frame=0xfffffe00d5164650,
usermode=false, signo=<optimized out>, ucode=<optimized out>)
#7 <signal handler called>
#8 pf_match_rule (ctx=ctx@entry=0xfffffe00d5164868,
ruleset=0xfffffe0128c22480, match_rules=match_rules@entry=0xfffffe00d5164bf8)
at /usr/src/sys/netpfil/pf/pf.c:5786
#9 0xffffffff827800db in pf_step_into_anchor
(ctx=ctx@entry=0xfffffe00d5164868, r=r@entry=0xfffff8007b628000,
match_rules=match_rules@entry=0xfffffe00d5164bf8) at
/usr/src/sys/netpfil/pf/pf.c:4791
#10 0xffffffff82780d28 in pf_match_rule (ctx=ctx@entry=0xfffffe00d5164868,
ruleset=0xfffffe00c2e032e8, match_rules=0xfffffe00d5164bf8) at
/usr/src/sys/netpfil/pf/pf.c:5830
#11 0xffffffff82788714 in pf_test_rule (rm=rm@entry=0xfffffe00d5164c38,
sm=sm@entry=0xfffffe00d5164c28, pd=pd@entry=0xfffffe00d5164a90,
am=am@entry=0xfffffe00d5164c10, rsm=rsm@entry=0xfffffe00d5164bf0,
reason=reason@entry=0xfffffe00d5164c64, inp=0x0,
match_rules=0xfffffe00d5164bf8) at /usr/src/sys/netpfil/pf/pf.c:5963
#12 0xffffffff82787b6d in pf_test (af=af@entry=2 '\002', dir=dir@entry=2,
pflags=393216, ifp=0xfffff80040db3800, m0=m0@entry=0xfffffe00d5164d28, inp=0x0,
default_actions=0x0) at /usr/src/sys/netpfil/pf/pf.c:11080
#13 0xffffffff827a217e in pf_check_out (m=0xfffffe00d5164d28, ifp=0x1, flags=1,
ruleset=<optimized out>, inp=0xfffffe0018eb9a80) at
/usr/src/sys/netpfil/pf/pf_ioctl.c:6840
#14 0xffffffff80ce8b9d in pfil_mbuf_common (flags=393216, pch=<optimized out>,
m=<optimized out>, ifp=<optimized out>, inp=<optimized out>) at
/usr/src/sys/net/pfil.c:212
#15 pfil_mbuf_fwd (head=<optimized out>, m=m@entry=0xfffffe00d5164d28,
ifp=0xfffff80040db3800, inp=inp@entry=0x0) at /usr/src/sys/net/pfil.c:246
#16 0xffffffff80d64a24 in ip_tryforward (m=0xfffff8034f16a900) at
/usr/src/sys/netinet/ip_fastfwd.c:407
#17 0xffffffff80d67129 in ip_input (m=0xfffff8034f16a900) at
/usr/src/sys/netinet/ip_input.c:585
#18 0xffffffff80ce62dd in netisr_process_workstream_proto
(nwsp=0xffffffff832a7e00, proto=1) at /usr/src/sys/net/netisr.c:926
#19 swi_net (arg=0xffffffff832a7e00) at /usr/src/sys/net/netisr.c:973
#20 0xffffffff80b4db3e in intr_event_execute_handlers (ie=0xfffff80001403700,
p=<optimized out>) at /usr/src/sys/kern/kern_intr.c:1191
#21 ithread_execute_handlers (ie=0xfffff80001403700, p=<optimized out>) at
/usr/src/sys/kern/kern_intr.c:1204
#22 ithread_loop (arg=0xfffff80001306c40) at /usr/src/sys/kern/kern_intr.c:1297
#23 0xffffffff80b4a0a0 in fork_exit (callout=0xffffffff80b4d900 <ithread_loop>,
arg=0xfffff80001306c40, frame=0xfffffe00d5164f40) at
/usr/src/sys/kern/kern_fork.c:1154
the following similar rules do not cause a crash:
anchor out on arpa {
pass out quick inet from 198.18.0.0/15 to any nat-to $ext_nat/32
# Block invalid traffic
block return log quick from any to <droplist> label
"spamhaus-droplist-out"
block return log quick from any to <noinet> label "to-noinet-out"
block return log quick from any to <public> label "to-public-out"
block return log quick from !<public> to any label
"not-from-public-out"
# Block outgoing SMTP, SMB and other bad traffic to the Internet.
block return log quick proto tcp from ! <smtp-allow> to any port 25
label "smtp-out"
block return log quick proto tcp from any to any port { netbios-ns,
netbios-dgm, netbios-ssn, microsoft-ds } label "smb-tcp-out"
block return log quick proto udp from any to any port { netbios-ns,
netbios-dgm, netbios-ssn, microsoft-ds } label "smb-udp-out"
}
i've attached the full pf.conf.
--
You are receiving this mail because:
You are the assignee for the bug.
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.