kern/49807: Kernel panic with ipf(4) on netbsd-7

[Pierre Pronchery <khorben%NetBSD.org@localhost>]

>Number:         49807
>Category:       kern
>Synopsis:       Kernel panic with ipf(4) on netbsd-7
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Apr 01 10:35:00 +0000 2015
>Originator:     Pierre Pronchery
>Release:        NetBSD 7.0_BETA
>Organization:
The NetBSD Foundation
>Environment:
Architecture: x86_64
Machine: amd64
>Description:
Starting ipfilter on netbsd-7 triggers a kernel panic (UVM fault) as
follows: [typing manually]

uvm_fault(0xfffffe83333c25c8, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff80345c93 cs 8 rflags 10286 cr2 20 i level 0 rsp fffffe81164cd2c8
curlwp 0xfffffe832979d2c0 pid 4015.1 lowest kstack 0xfffffe81164cb2c0
kernel: page fault trap, code=0
Stopped in pid 4015.1 (ipf) at  netbsd:frrequest+0x3af: movl   20(%rcx),%edx
db{1}> bt
frrequest() at netbsd:frrequest+0x3af
ipf_ipf_ioctl() at netbsd:ipf_ipf_ioctl+0x56f
ipfioctl() at netbsd:ipfioctl+0x9f
cdev_ioctl() at netbsd:cdev_ioctl+0x90
VOP_IOCTL() at netbsd:VOP_IOCTL+0x3b
vn_ioctl() at netbsd:vn_ioctl+0xa6
sys_ioctl() at netbsd:sys_ioctl+0x17e
syscall() at netbsd:syscall+0x9a
--- syscall (number 54) ---
7f7ff70ce0ca:

Otherwise running a root-on-cgd setup with cgdroot.kmod loaded at
startup. A similar setup running netbsd-6 does not trigger the panic,
therefore considering it a major regression and rating it as such.

The same could be triggered while running Xen, with an immediate reboot.

>How-To-Repeat:
As root:
# /etc/rc.d/ipfilter onestart

With /etc/ipf.conf created as follows:
#!/sbin/ipf -f -
block in log quick all with short
block in log
block out log
pass in quick on lo0 all
pass out quick on lo0 all
block in log on wm0 head 400
block in log proto tcp flags S head 411 group 400
block in log proto udp head 412 group 400 
block in log proto icmp head 413 group 400
block in log proto esp head 414 group 400
block in log proto igmp head 415 group 400
block out log on wm0 head 450
block out log proto tcp flags S head 461 group 450
block out log proto udp head 462 group 450
block out log proto icmp head 463 group 450
block out log proto esp head 464 group 450
block out log proto igmp head 465 group 450
pass out quick keep state group 461
pass out quick keep state group 462
pass out quick keep state group 463
pass out quick keep state group 464
pass out quick keep state group 465

>Fix:

Unknown
>Unformatted:
 As of March 27th 2015, Ticket #646