toolchain/52257: evbmips64-eb crash in keysock

To: toolchain-manager%netbsd.org@localhost,gnats-admin%netbsd.org@localhost,netbsd-bugs%netbsd.org@localhost
Subject: toolchain/52257: evbmips64-eb crash in keysock
From: mlelstv%serpens.de@localhost
Date: Thu, 25 May 2017 15:00:01 +0000 (UTC)
>Number:         52257
>Category:       toolchain
>Synopsis:       evbmips64-eb crash in keysock
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    toolchain-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu May 25 15:00:00 +0000 2017
>Originator:     Michael van Elst
>Release:        NetBSD 7.99.70
>Organization:
	
>Environment:
	
	
System: NetBSD cosmicbunny 7.99.70 NetBSD 7.99.70 (COSMICBUNNY) #27: Tue Apr 25 09:30:20 CEST 2017 mlelstv@gossam:/home/netbsd-current/obj.evbmips64-eb/home/netbsd-current/src/sys/arch/evbmips/compile/COSMICBUNNY evbmips
Architecture: mips64eb
Machine: evbmips
>Description:
When initializing ipsec, the kernel crashed with an assertion failure.
The assertion message couldn't be captured, but DDB shows the location
in the backtrace:

| 0x9800000410003770: kern_assert+48 (63061,ffffffff80553a30,ffffffff805641f0,ffff
| ffff8056c5d8) ra ffffffff802fd2a4 sz 96
| 0x98000004100037d0: key_sendup_mbuf+31c (63061,ffffffff80553a30,ffffffff805641f0
| ,ffffffff8056c5d8) ra ffffffff802f12a0 sz 96
| 0x9800000410003830: key_acquire+450 (63061,ffffffff80553a30,ffffffff805641f0,fff
| fffff8056c5d8) ra ffffffff802f3b28 sz 112

which translates to

|  /home/netbsd-current/src/sys/netipsec/keysock.c:300 (discriminator 1)
|         KASSERT(so != NULL || target != KEY_SENDUP_ONE); 

The assertion however fails only because the compiler didn't evaluate
the conditions properly.


	KASSERT(m != NULL);
ffffffff802fcfbc:	10a000a4 	beqz	a1,ffffffff802fd250 <key_sendup_mbuf+0x2c8>
ffffffff802fcfc0:	ffb10018 	sd	s1,24(sp)
	KASSERT(so != NULL || target != KEY_SENDUP_ONE);
ffffffff802fcfc4:	120000ae 	beqz	s0,ffffffff802fd280 <key_sendup_mbuf+0x2f8>
ffffffff802fcfc8:	3c078057 	lui	a3,0x8057

If so == NULL, the code jumps to key_sendup_mbuf+0x2f8 (ffffffff802fd280):


	KASSERT(so != NULL || target != KEY_SENDUP_ONE);
ffffffff802fd278:	1600ff54 	bnez	s0,ffffffff802fcfcc <key_sendup_mbuf+0x44>
ffffffff802fd27c:	3c078057 	lui	a3,0x8057
ffffffff802fd280:	3c068056 	lui	a2,0x8056
ffffffff802fd284:	3c058055 	lui	a1,0x8055
ffffffff802fd288:	3c048055 	lui	a0,0x8055
ffffffff802fd28c:	2408012c 	li	a4,300
ffffffff802fd290:	64e7c5d8 	daddiu	a3,a3,-14888
ffffffff802fd294:	64c641f0 	daddiu	a2,a2,16880
ffffffff802fd298:	64a53a30 	daddiu	a1,a1,14896
ffffffff802fd29c:	0c149dfc 	jal	ffffffff805277f0 <kern_assert>
ffffffff802fd2a0:	64843998 	daddiu	a0,a0,14744
ffffffff802fd2a4:	1000ff4a 	b	ffffffff802fcfd0 <key_sendup_mbuf+0x48>

However, that's a few bytes too far. The second condition checked with
the bnez in ffffffff802fd278 is not executed and the code continues with calling
kern_assert.


Here is the complete objdump output for the key_send_mbuf function:

ffffffff802fcf88 <key_sendup_mbuf>:
{
ffffffff802fcf88:	67bdffa0 	daddiu	sp,sp,-96
ffffffff802fcf8c:	ffb30028 	sd	s3,40(sp)
ffffffff802fcf90:	00a09825 	move	s3,a1
ffffffff802fcf94:	ffb20020 	sd	s2,32(sp)
ffffffff802fcf98:	00c09025 	move	s2,a2
ffffffff802fcf9c:	ffb00010 	sd	s0,16(sp)
ffffffff802fcfa0:	00808025 	move	s0,a0
ffffffff802fcfa4:	ffbf0058 	sd	ra,88(sp)
ffffffff802fcfa8:	ffbe0050 	sd	s8,80(sp)
ffffffff802fcfac:	ffb70048 	sd	s7,72(sp)
ffffffff802fcfb0:	ffb60040 	sd	s6,64(sp)
ffffffff802fcfb4:	ffb50038 	sd	s5,56(sp)
ffffffff802fcfb8:	ffb40030 	sd	s4,48(sp)
	KASSERT(m != NULL);
ffffffff802fcfbc:	10a000a4 	beqz	a1,ffffffff802fd250 <key_sendup_mbuf+0x2c8>
ffffffff802fcfc0:	ffb10018 	sd	s1,24(sp)
	KASSERT(so != NULL || target != KEY_SENDUP_ONE);
ffffffff802fcfc4:	120000ae 	beqz	s0,ffffffff802fd280 <key_sendup_mbuf+0x2f8>
ffffffff802fcfc8:	3c078057 	lui	a3,0x8057
		uint64_t *ps = PFKEY_STAT_GETREF();
ffffffff802fcfcc:	3c11806d 	lui	s1,0x806d
	int sbprio = 0; /* XXX should be a parameter */
ffffffff802fcfd0:	3a550002 	xori	s5,s2,0x2
		uint64_t *ps = PFKEY_STAT_GETREF();
ffffffff802fcfd4:	de24fbf8 	ld	a0,-1032(s1)
	int sbprio = 0; /* XXX should be a parameter */
ffffffff802fcfd8:	24020003 	li	v0,3
ffffffff802fcfdc:	0015100b 	movn	v0,zero,s5
		uint64_t *ps = PFKEY_STAT_GETREF();
ffffffff802fcfe0:	0c10ebc8 	jal	ffffffff8043af20 <percpu_getref>
ffffffff802fcfe4:	ffa20000 	sd	v0,0(sp)
		ps[PFKEY_STAT_IN_TOTAL]++;
ffffffff802fcfe8:	dc450858 	ld	a1,2136(v0)
		ps[PFKEY_STAT_IN_BYTES] += m->m_pkthdr.len;
ffffffff802fcfec:	dc430860 	ld	v1,2144(v0)
		PFKEY_STAT_PUTREF();
ffffffff802fcff0:	de24fbf8 	ld	a0,-1032(s1)
		ps[PFKEY_STAT_IN_TOTAL]++;
ffffffff802fcff4:	64a50001 	daddiu	a1,a1,1
ffffffff802fcff8:	fc450858 	sd	a1,2136(v0)
		ps[PFKEY_STAT_IN_BYTES] += m->m_pkthdr.len;
ffffffff802fcffc:	8e650048 	lw	a1,72(s3)
ffffffff802fd000:	0065182d 	daddu	v1,v1,a1
		PFKEY_STAT_PUTREF();
ffffffff802fd004:	0c10ebea 	jal	ffffffff8043afa8 <percpu_putref>
ffffffff802fd008:	fc430860 	sd	v1,2144(v0)
	if (m->m_len < sizeof(struct sadb_msg)) {
ffffffff802fd00c:	8e620020 	lw	v0,32(s3)
ffffffff802fd010:	2c420010 	sltiu	v0,v0,16
ffffffff802fd014:	14400080 	bnez	v0,ffffffff802fd218 <key_sendup_mbuf+0x290>
ffffffff802fd018:	02602025 	move	a0,s3
		msg = mtod(m, struct sadb_msg *);
ffffffff802fd01c:	de740010 	ld	s4,16(s3)
		PFKEY_STATINC(PFKEY_STAT_IN_MSGTYPE + msg->sadb_msg_type);
ffffffff802fd020:	0c10ebc8 	jal	ffffffff8043af20 <percpu_getref>
ffffffff802fd024:	de24fbf8 	ld	a0,-1032(s1)
ffffffff802fd028:	92830001 	lbu	v1,1(s4)
ffffffff802fd02c:	2463010d 	addiu	v1,v1,269
ffffffff802fd030:	000318f8 	dsll	v1,v1,0x3
ffffffff802fd034:	0043102d 	daddu	v0,v0,v1
ffffffff802fd038:	dc430000 	ld	v1,0(v0)
ffffffff802fd03c:	64630001 	daddiu	v1,v1,1
ffffffff802fd040:	fc430000 	sd	v1,0(v0)
ffffffff802fd044:	0c10ebea 	jal	ffffffff8043afa8 <percpu_putref>
ffffffff802fd048:	de24fbf8 	ld	a0,-1032(s1)
	LIST_FOREACH(rp, &rawcb, rcb_list)
ffffffff802fd04c:	3c028062 	lui	v0,0x8062
ffffffff802fd050:	dc5554d0 	ld	s5,21712(v0)
ffffffff802fd054:	12a0002a 	beqz	s5,ffffffff802fd100 <key_sendup_mbuf+0x178>
ffffffff802fd058:	2654020d 	addiu	s4,s2,525
				if (kso->so_rcv.sb_cc <= key_registered_sb_max)
ffffffff802fd05c:	3c028062 	lui	v0,0x8062
			  		printf("keysock: "
ffffffff802fd060:	3c168057 	lui	s6,0x8057
		PFKEY_STATINC(PFKEY_STAT_IN_MSGTARGET + target);
ffffffff802fd064:	0014a0f8 	dsll	s4,s4,0x3
		if (rp->rcb_proto.sp_family != PF_KEY)
ffffffff802fd068:	241e001d 	li	s8,29
			  		printf("keysock: "
ffffffff802fd06c:	66d6c690 	daddiu	s6,s6,-14704
				if (kso->so_rcv.sb_cc <= key_registered_sb_max)
ffffffff802fd070:	10000004 	b	ffffffff802fd084 <key_sendup_mbuf+0xfc>
ffffffff802fd074:	ffa20008 	sd	v0,8(sp)
	LIST_FOREACH(rp, &rawcb, rcb_list)
ffffffff802fd078:	deb50000 	ld	s5,0(s5)
ffffffff802fd07c:	12a00020 	beqz	s5,ffffffff802fd100 <key_sendup_mbuf+0x178>
ffffffff802fd080:	00000000 	nop
		if (rp->rcb_proto.sp_family != PF_KEY)
ffffffff802fd084:	96a20028 	lhu	v0,40(s5)
ffffffff802fd088:	145efffb 	bne	v0,s8,ffffffff802fd078 <key_sendup_mbuf+0xf0>
ffffffff802fd08c:	00000000 	nop
		if (rp->rcb_proto.sp_protocol
ffffffff802fd090:	96a2002a 	lhu	v0,42(s5)
ffffffff802fd094:	3042fffd 	andi	v0,v0,0xfffd
ffffffff802fd098:	1440fff7 	bnez	v0,ffffffff802fd078 <key_sendup_mbuf+0xf0>
ffffffff802fd09c:	00000000 	nop
		if (((struct keycb *)rp)->kp_promisc) {
ffffffff802fd0a0:	8ea20040 	lw	v0,64(s5)
ffffffff802fd0a4:	14400028 	bnez	v0,ffffffff802fd148 <key_sendup_mbuf+0x1c0>
ffffffff802fd0a8:	deb70010 	ld	s7,16(s5)
		if (so && sotorawcb(so) == rp)
ffffffff802fd0ac:	12000004 	beqz	s0,ffffffff802fd0c0 <key_sendup_mbuf+0x138>
ffffffff802fd0b0:	24020001 	li	v0,1
ffffffff802fd0b4:	de020030 	ld	v0,48(s0)
ffffffff802fd0b8:	1055ffef 	beq	v0,s5,ffffffff802fd078 <key_sendup_mbuf+0xf0>
ffffffff802fd0bc:	24020001 	li	v0,1
		switch (target) {
ffffffff802fd0c0:	12420037 	beq	s2,v0,ffffffff802fd1a0 <key_sendup_mbuf+0x218>
ffffffff802fd0c4:	24020002 	li	v0,2
ffffffff802fd0c8:	1242002d 	beq	s2,v0,ffffffff802fd180 <key_sendup_mbuf+0x1f8>
ffffffff802fd0cc:	00000000 	nop
		PFKEY_STATINC(PFKEY_STAT_IN_MSGTARGET + target);
ffffffff802fd0d0:	0c10ebc8 	jal	ffffffff8043af20 <percpu_getref>
ffffffff802fd0d4:	de24fbf8 	ld	a0,-1032(s1)
ffffffff802fd0d8:	0054102d 	daddu	v0,v0,s4
ffffffff802fd0dc:	dc440000 	ld	a0,0(v0)
ffffffff802fd0e0:	64840001 	daddiu	a0,a0,1
ffffffff802fd0e4:	fc440000 	sd	a0,0(v0)
ffffffff802fd0e8:	0c10ebea 	jal	ffffffff8043afa8 <percpu_putref>
ffffffff802fd0ec:	de24fbf8 	ld	a0,-1032(s1)
	LIST_FOREACH(rp, &rawcb, rcb_list)
ffffffff802fd0f0:	deb50000 	ld	s5,0(s5)
ffffffff802fd0f4:	16a0ffe3 	bnez	s5,ffffffff802fd084 <key_sendup_mbuf+0xfc>
ffffffff802fd0f8:	00000000 	nop
ffffffff802fd0fc:	00000000 	nop
	if (so) {
ffffffff802fd100:	1200006a 	beqz	s0,ffffffff802fd2ac <key_sendup_mbuf+0x324>
ffffffff802fd104:	02602825 	move	a1,s3
ffffffff802fd108:	de040030 	ld	a0,48(s0)
		error = key_sendup0(sotorawcb(so), m, 0, sbprio);
ffffffff802fd10c:	dfa70000 	ld	a3,0(sp)
ffffffff802fd110:	00003025 	move	a2,zero
}
ffffffff802fd114:	dfbf0058 	ld	ra,88(sp)
		error = key_sendup0(sotorawcb(so), m, 0, sbprio);
ffffffff802fd118:	64840010 	daddiu	a0,a0,16
}
ffffffff802fd11c:	dfbe0050 	ld	s8,80(sp)
ffffffff802fd120:	dfb70048 	ld	s7,72(sp)
ffffffff802fd124:	dfb60040 	ld	s6,64(sp)
ffffffff802fd128:	dfb50038 	ld	s5,56(sp)
ffffffff802fd12c:	dfb40030 	ld	s4,48(sp)
ffffffff802fd130:	dfb30028 	ld	s3,40(sp)
ffffffff802fd134:	dfb20020 	ld	s2,32(sp)
ffffffff802fd138:	dfb10018 	ld	s1,24(sp)
ffffffff802fd13c:	dfb00010 	ld	s0,16(sp)
		error = key_sendup0(sotorawcb(so), m, 0, sbprio);
ffffffff802fd140:	080bf2fa 	j	ffffffff802fcbe8 <key_sendup0.isra.10>
ffffffff802fd144:	67bd0060 	daddiu	sp,sp,96
			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
ffffffff802fd148:	24070001 	li	a3,1
ffffffff802fd14c:	2406ffff 	li	a2,-1
ffffffff802fd150:	00002825 	move	a1,zero
ffffffff802fd154:	0c11c702 	jal	ffffffff80471c08 <m_copym>
ffffffff802fd158:	02602025 	move	a0,s3
ffffffff802fd15c:	1040ffd3 	beqz	v0,ffffffff802fd0ac <key_sendup_mbuf+0x124>
ffffffff802fd160:	00003825 	move	a3,zero
				(void)key_sendup0(rp, n, 1, 0);
ffffffff802fd164:	24060001 	li	a2,1
ffffffff802fd168:	00402825 	move	a1,v0
ffffffff802fd16c:	0c0bf2fa 	jal	ffffffff802fcbe8 <key_sendup0.isra.10>
ffffffff802fd170:	66a40010 	daddiu	a0,s5,16
ffffffff802fd174:	1000ffcd 	b	ffffffff802fd0ac <key_sendup_mbuf+0x124>
ffffffff802fd178:	00000000 	nop
ffffffff802fd17c:	00000000 	nop
			if (kp->kp_registered) {
ffffffff802fd180:	8ea20044 	lw	v0,68(s5)
ffffffff802fd184:	1040ffd2 	beqz	v0,ffffffff802fd0d0 <key_sendup_mbuf+0x148>
ffffffff802fd188:	dfa20008 	ld	v0,8(sp)
				if (kso->so_rcv.sb_cc <= key_registered_sb_max)
ffffffff802fd18c:	dee501a8 	ld	a1,424(s7)
ffffffff802fd190:	8c46dd08 	lw	a2,-8952(v0)
ffffffff802fd194:	00c5102b 	sltu	v0,a2,a1
ffffffff802fd198:	14400029 	bnez	v0,ffffffff802fd240 <key_sendup_mbuf+0x2b8>
ffffffff802fd19c:	00000000 	nop
		PFKEY_STATINC(PFKEY_STAT_IN_MSGTARGET + target);
ffffffff802fd1a0:	de24fbf8 	ld	a0,-1032(s1)
ffffffff802fd1a4:	0c10ebc8 	jal	ffffffff8043af20 <percpu_getref>
ffffffff802fd1a8:	3c17806d 	lui	s7,0x806d
ffffffff802fd1ac:	0054102d 	daddu	v0,v0,s4
ffffffff802fd1b0:	dc440000 	ld	a0,0(v0)
ffffffff802fd1b4:	64840001 	daddiu	a0,a0,1
ffffffff802fd1b8:	fc440000 	sd	a0,0(v0)
ffffffff802fd1bc:	0c10ebea 	jal	ffffffff8043afa8 <percpu_putref>
ffffffff802fd1c0:	de24fbf8 	ld	a0,-1032(s1)
		if ((n = m_copy(m, 0, (int)M_COPYALL)) == NULL) {
ffffffff802fd1c4:	24070001 	li	a3,1
ffffffff802fd1c8:	2406ffff 	li	a2,-1
ffffffff802fd1cc:	00002825 	move	a1,zero
ffffffff802fd1d0:	0c11c702 	jal	ffffffff80471c08 <m_copym>
ffffffff802fd1d4:	02602025 	move	a0,s3
ffffffff802fd1d8:	10400046 	beqz	v0,ffffffff802fd2f4 <key_sendup_mbuf+0x36c>
ffffffff802fd1dc:	00003825 	move	a3,zero
		if ((error = key_sendup0(rp, n, 0, 0)) != 0) {
ffffffff802fd1e0:	00003025 	move	a2,zero
ffffffff802fd1e4:	00402825 	move	a1,v0
ffffffff802fd1e8:	0c0bf2fa 	jal	ffffffff802fcbe8 <key_sendup0.isra.10>
ffffffff802fd1ec:	66a40010 	daddiu	a0,s5,16
ffffffff802fd1f0:	1040ffa1 	beqz	v0,ffffffff802fd078 <key_sendup_mbuf+0xf0>
ffffffff802fd1f4:	3c048054 	lui	a0,0x8054
			m_freem(m);
ffffffff802fd1f8:	02603025 	move	a2,s3
ffffffff802fd1fc:	24050193 	li	a1,403
ffffffff802fd200:	6484fe30 	daddiu	a0,a0,-464
ffffffff802fd204:	0c11c514 	jal	ffffffff80471450 <m__freem>
ffffffff802fd208:	ffa20000 	sd	v0,0(sp)
			return error;
ffffffff802fd20c:	1000002d 	b	ffffffff802fd2c4 <key_sendup_mbuf+0x33c>
ffffffff802fd210:	dfa20000 	ld	v0,0(sp)
ffffffff802fd214:	00000000 	nop
		m = m_pullup(m, sizeof(struct sadb_msg));
ffffffff802fd218:	0c11c7f2 	jal	ffffffff80471fc8 <m_pullup>
ffffffff802fd21c:	24050010 	li	a1,16
		if (m == NULL) {
ffffffff802fd220:	10400042 	beqz	v0,ffffffff802fd32c <key_sendup_mbuf+0x3a4>
ffffffff802fd224:	00409825 	move	s3,v0
	if (m->m_len >= sizeof(struct sadb_msg)) {
ffffffff802fd228:	8c420020 	lw	v0,32(v0)
ffffffff802fd22c:	2c420010 	sltiu	v0,v0,16
ffffffff802fd230:	1440ff87 	bnez	v0,ffffffff802fd050 <key_sendup_mbuf+0xc8>
ffffffff802fd234:	3c028062 	lui	v0,0x8062
ffffffff802fd238:	1000ff79 	b	ffffffff802fd020 <key_sendup_mbuf+0x98>
ffffffff802fd23c:	de740010 	ld	s4,16(s3)
			  		printf("keysock: "
ffffffff802fd240:	0c110770 	jal	ffffffff80441dc0 <printf>
ffffffff802fd244:	02c02025 	move	a0,s6
ffffffff802fd248:	1000ffa1 	b	ffffffff802fd0d0 <key_sendup_mbuf+0x148>
ffffffff802fd24c:	00000000 	nop
	KASSERT(m != NULL);
ffffffff802fd250:	3c078057 	lui	a3,0x8057
ffffffff802fd254:	3c068056 	lui	a2,0x8056
ffffffff802fd258:	3c058055 	lui	a1,0x8055
ffffffff802fd25c:	3c048055 	lui	a0,0x8055
ffffffff802fd260:	2408012b 	li	a4,299
ffffffff802fd264:	64e7c5d8 	daddiu	a3,a3,-14888
ffffffff802fd268:	64c639e8 	daddiu	a2,a2,14824
ffffffff802fd26c:	64a53a30 	daddiu	a1,a1,14896
ffffffff802fd270:	0c149dfc 	jal	ffffffff805277f0 <kern_assert>
ffffffff802fd274:	64843998 	daddiu	a0,a0,14744
	KASSERT(so != NULL || target != KEY_SENDUP_ONE);
ffffffff802fd278:	1600ff54 	bnez	s0,ffffffff802fcfcc <key_sendup_mbuf+0x44>
ffffffff802fd27c:	3c078057 	lui	a3,0x8057
ffffffff802fd280:	3c068056 	lui	a2,0x8056
ffffffff802fd284:	3c058055 	lui	a1,0x8055
ffffffff802fd288:	3c048055 	lui	a0,0x8055
ffffffff802fd28c:	2408012c 	li	a4,300
ffffffff802fd290:	64e7c5d8 	daddiu	a3,a3,-14888
ffffffff802fd294:	64c641f0 	daddiu	a2,a2,16880
ffffffff802fd298:	64a53a30 	daddiu	a1,a1,14896
ffffffff802fd29c:	0c149dfc 	jal	ffffffff805277f0 <kern_assert>
ffffffff802fd2a0:	64843998 	daddiu	a0,a0,14744
ffffffff802fd2a4:	1000ff4a 	b	ffffffff802fcfd0 <key_sendup_mbuf+0x48>
ffffffff802fd2a8:	3c11806d 	lui	s1,0x806d
		m_freem(m);
ffffffff802fd2ac:	3c048054 	lui	a0,0x8054
ffffffff802fd2b0:	02603025 	move	a2,s3
ffffffff802fd2b4:	240501a0 	li	a1,416
ffffffff802fd2b8:	0c11c514 	jal	ffffffff80471450 <m__freem>
ffffffff802fd2bc:	6484fe30 	daddiu	a0,a0,-464
		error = 0;
ffffffff802fd2c0:	00001025 	move	v0,zero
}
ffffffff802fd2c4:	dfbf0058 	ld	ra,88(sp)
ffffffff802fd2c8:	dfbe0050 	ld	s8,80(sp)
ffffffff802fd2cc:	dfb70048 	ld	s7,72(sp)
ffffffff802fd2d0:	dfb60040 	ld	s6,64(sp)
ffffffff802fd2d4:	dfb50038 	ld	s5,56(sp)
ffffffff802fd2d8:	dfb40030 	ld	s4,48(sp)
ffffffff802fd2dc:	dfb30028 	ld	s3,40(sp)
ffffffff802fd2e0:	dfb20020 	ld	s2,32(sp)
ffffffff802fd2e4:	dfb10018 	ld	s1,24(sp)
ffffffff802fd2e8:	dfb00010 	ld	s0,16(sp)
ffffffff802fd2ec:	03e00008 	jr	ra
ffffffff802fd2f0:	67bd0060 	daddiu	sp,sp,96
			m_freem(m);
ffffffff802fd2f4:	3c048054 	lui	a0,0x8054
ffffffff802fd2f8:	02603025 	move	a2,s3
ffffffff802fd2fc:	2405018d 	li	a1,397
ffffffff802fd300:	0c11c514 	jal	ffffffff80471450 <m__freem>
ffffffff802fd304:	6484fe30 	daddiu	a0,a0,-464
			PFKEY_STATINC(PFKEY_STAT_IN_NOMEM);
ffffffff802fd308:	0c10ebc8 	jal	ffffffff8043af20 <percpu_getref>
ffffffff802fd30c:	dee4fbf8 	ld	a0,-1032(s7)
ffffffff802fd310:	dc431080 	ld	v1,4224(v0)
ffffffff802fd314:	dee4fbf8 	ld	a0,-1032(s7)
ffffffff802fd318:	64630001 	daddiu	v1,v1,1
ffffffff802fd31c:	0c10ebea 	jal	ffffffff8043afa8 <percpu_putref>
ffffffff802fd320:	fc431080 	sd	v1,4224(v0)
			return ENOBUFS;
ffffffff802fd324:	1000ffe7 	b	ffffffff802fd2c4 <key_sendup_mbuf+0x33c>
ffffffff802fd328:	24020037 	li	v0,55
			PFKEY_STATINC(PFKEY_STAT_IN_NOMEM);
ffffffff802fd32c:	0c10ebc8 	jal	ffffffff8043af20 <percpu_getref>
ffffffff802fd330:	de24fbf8 	ld	a0,-1032(s1)
ffffffff802fd334:	dc431080 	ld	v1,4224(v0)
ffffffff802fd338:	de24fbf8 	ld	a0,-1032(s1)
ffffffff802fd33c:	64630001 	daddiu	v1,v1,1
ffffffff802fd340:	0c10ebea 	jal	ffffffff8043afa8 <percpu_putref>
ffffffff802fd344:	fc431080 	sd	v1,4224(v0)
			return ENOBUFS;
ffffffff802fd348:	1000ffde 	b	ffffffff802fd2c4 <key_sendup_mbuf+0x33c>
ffffffff802fd34c:	24020037 	li	v0,55


>How-To-Repeat:

Use ipsec with a 7.99.70 64bit mips kernel.


>Fix:
	

>Unformatted:
Follow-Ups:
- Re: toolchain/52257: evbmips64-eb crash in keysock
  - From: Nick Hudson
Prev by Date: Re: kern/51623: running qemu-x86_64 with -smp 4 - the additional CPUs don't start
Next by Date: Re: toolchain/52257: evbmips64-eb crash in keysock
Previous by Thread: Re: kern/51623: running qemu-x86_64 with -smp 4 - the additional CPUs don't start
Next by Thread: Re: toolchain/52257: evbmips64-eb crash in keysock
Indexes:
Home | Main Index | Thread Index | Old Index