Project

General

Profile

Actions
Copy link

Regression #13176

closed

UPnP port mappings cause kernel panic

Added by Steve Wheeler almost 2 years ago. Updated almost 2 years ago.

Status:
Resolved
Priority:
High
Assignee:
-
Category:
UPnP/NAT-PMP
Target version:
2.7.0
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
22.05
Release Notes:
Force Exclusion
Affected Version:
2.7.x
Affected Architecture:
All

Description

Adding a port mapping via UPnP causes a kerlnel panic in 22.05.

Tested here using GUPnP Universal control point. Status queries works as expected.
I tried to add a port mapping, here for port 55555. ~10s later there is a kernel panic:

db:0:kdb.enter.default>  bt
Tracing pid 74547 tid 100613 td 0xfffff8014c1b2740
kdb_enter() at kdb_enter+0x37/frame 0xfffffe003293ef70
vpanic() at vpanic+0x194/frame 0xfffffe003293efc0
panic() at panic+0x43/frame 0xfffffe003293f020
trap_fatal() at trap_fatal+0x38f/frame 0xfffffe003293f080
trap_pfault() at trap_pfault+0x4f/frame 0xfffffe003293f0e0
calltrap() at calltrap+0x8/frame 0xfffffe003293f0e0
--- trap 0xc, rip = 0xffffffff810a8fef, rsp = 0xfffffe003293f1b0, rbp = 0xfffffe003293f1e0 ---
pf_krule_to_nvrule() at pf_krule_to_nvrule+0x55f/frame 0xfffffe003293f1e0
pfioctl() at pfioctl+0x79cf/frame 0xfffffe003293f6d0
devfs_ioctl() at devfs_ioctl+0xb0/frame 0xfffffe003293f720
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x7b/frame 0xfffffe003293f750
vn_ioctl() at vn_ioctl+0x16c/frame 0xfffffe003293f860
devfs_ioctl_f() at devfs_ioctl_f+0x1e/frame 0xfffffe003293f880
kern_ioctl() at kern_ioctl+0x298/frame 0xfffffe003293f8f0
sys_ioctl() at sys_ioctl+0x100/frame 0xfffffe003293f9c0
amd64_syscall() at amd64_syscall+0x387/frame 0xfffffe003293faf0
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe003293faf0
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x8004960da, rsp = 0x7fffffffdc78, rbp = 0x7fffffffdce0 -

Tested:

22.05-BETA (amd64)
built on Mon May 16 06:21:03 UTC 2022
FreeBSD 12.3-STABLE

Also appears in arm7 as:

Enter an option: Fatal kernel mode data abort: 'Translation Fault (L2)' on read
trapframe: 0xde6e9610
FSR=00000007, FAR=00000000, spsr=20000013
r0 =00000003, r1 =00000001, r2 =00000000, r3 =00000000
r4 =00000000, r5 =00000003, r6 =00000000, r7 =00000001
r8 =df818320, r9 =dfa70800, r10=00000000, r11=de6e96d8
r12=fefefeff, ssp=de6e96a0, slr=c004b898, pc =c0771f88

panic: Fatal abort
cpuid = 1
time = 1652746601
Uptime: 12m30s

Actions
Copy link

Also available in: Atom PDF