Project

General

Profile

Bug #4874

pf crash related to source tracking: pf_hashsrc: unknown address family 0

Added by Jim Pingle over 4 years ago. Updated about 4 years ago.

Status:
Resolved
Priority:
Low
Assignee:
Category:
Operating System
Target version:
Start date:
07/23/2015
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.2.x
Affected Architecture:
All

Description

Seems to be fairly rare, but there is a potential crash in pf that has been hit at least once:

panic: pf_hashsrc: unknown address family 0
cpuid = 0
KDB: enter: panic

db:0:kdb.enter.default> show pcpu
cpuid = 0
dynamic pcpu = 0x63a800
curthread = 0xfffff80003468920: pid 5 "pf purge" 
curpcb = 0xfffffe0000246cc0
fpcurthread = none
idlethread = 0xfffff80003211000: tid 100003 "idle: cpu0" 
curpmap = 0xffffffff82181fd8
tssp = 0xffffffff8219cf90
commontssp = 0xffffffff8219cf90
rsp0 = 0xfffffe0000246cc0
gs32p = 0xffffffff8219e9e8
ldt = 0xffffffff8219ea28
tss = 0xffffffff8219ea18
db:0:kdb.enter.default> bt
Tracing pid 5 tid 100043 td 0xfffff80003468920
kdb_enter() at kdb_enter+0x3e/frame 0xfffffe0000246a00
panic() at panic+0x175/frame 0xfffffe0000246a80
pf_src_tree_remove_state() at pf_src_tree_remove_state+0x292/frame 0xfffffe0000246ab0
pf_unlink_state() at pf_unlink_state+0x147/frame 0xfffffe0000246b20
pf_purge_expired_states() at pf_purge_expired_states+0x7d/frame 0xfffffe0000246b80
pf_purge_thread() at pf_purge_thread+0xc6/frame 0xfffffe0000246bb0
fork_exit() at fork_exit+0x9a/frame 0xfffffe0000246bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000246bf0
--- trap 0, rip = 0, rsp = 0xfffffe0000246cb0, rbp = 0 ---
The system in question has:
  • A rule with "max-src-conn-rate 150 /3, overload <virusprot> flush global"
  • set limit src-nodes 1900000
  • set timeout src.track 14400
  • relayd running with "sticky-address" set in a redirect
  • System is a VM on CentOS with virtio enabled.

Appears to be related to FreeBSD Bug 182401 -- details above also copied there.

History

#1 Updated by Jim Pingle over 4 years ago

  • Affected Version changed from 2.2.3 to 2.2.x

Same system crashed identically on 2.2.4:

panic: pf_hashsrc: unknown address family 0
cpuid = 0
KDB: enter: panic

db:0:kdb.enter.default>  show pcpu
cpuid        = 0
dynamic pcpu = 0x63a800
curthread    = 0xfffff80003468920: pid 5 "pf purge" 
curpcb       = 0xfffffe0000246cc0
fpcurthread  = none
idlethread   = 0xfffff80003211000: tid 100003 "idle: cpu0" 
curpmap      = 0xffffffff82181fd8
tssp         = 0xffffffff8219cf90
commontssp   = 0xffffffff8219cf90
rsp0         = 0xfffffe0000246cc0
gs32p        = 0xffffffff8219e9e8
ldt          = 0xffffffff8219ea28
tss          = 0xffffffff8219ea18
db:0:kdb.enter.default>  bt
Tracing pid 5 tid 100043 td 0xfffff80003468920
kdb_enter() at kdb_enter+0x3e/frame 0xfffffe0000246a00
panic() at panic+0x175/frame 0xfffffe0000246a80
pf_src_tree_remove_state() at pf_src_tree_remove_state+0x292/frame 0xfffffe0000246ab0
pf_unlink_state() at pf_unlink_state+0x147/frame 0xfffffe0000246b20
pf_purge_expired_states() at pf_purge_expired_states+0x7d/frame 0xfffffe0000246b80
pf_purge_thread() at pf_purge_thread+0xc6/frame 0xfffffe0000246bb0
fork_exit() at fork_exit+0x9a/frame 0xfffffe0000246bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000246bf0
--- trap 0, rip = 0, rsp = 0xfffffe0000246cb0, rbp = 0 ---

#2 Updated by Luiz Souza about 4 years ago

  • % Done changed from 0 to 100

This was fixed in FreeBSD and pfSense (2.3 and RELENG_2_2).

#3 Updated by Luiz Souza about 4 years ago

  • Status changed from Confirmed to Resolved

#4 Updated by Luiz Souza about 4 years ago

  • Status changed from Resolved to Feedback
  • Target version changed from 2.3 to 2.2.5

#5 Updated by Luiz Souza about 4 years ago

Waiting for feedback from Jimp.

#6 Updated by Chris Buechler about 4 years ago

  • Status changed from Feedback to Resolved
  • Affected Architecture changed from amd64 to All

fix from FreeBSD applied

Also available in: Atom PDF