Re: kern/49488 (npf: assertion "ret == con" failed at npf_conn.c:747)

[Tobias Nygren <tnn-netbsd%nygren.pp.se@localhost>]

The following reply was made to PR kern/49488; it has been noted by GNATS.

From: Tobias Nygren <tnn-netbsd%nygren.pp.se@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/49488 (npf: assertion "ret == con" failed at
 npf_conn.c:747)
Date: Mon, 5 Jan 2015 12:53:54 +0100

 Possible fix, no guarantee about correctness:
 
 Index: npf_conn.c
 ===================================================================
 RCS file: /cvsroot/src/sys/net/npf/npf_conn.c,v
 retrieving revision 1.14
 diff -u -p -r1.14 npf_conn.c
 --- npf_conn.c	20 Dec 2014 16:19:43 -0000	1.14
 +++ npf_conn.c	5 Jan 2015 11:50:06 -0000
 @@ -563,6 +563,7 @@ npf_conn_setnat(const npf_cache_t *npc, 
  	npf_addr_t *taddr;
  	in_port_t tport;
  	u_int tidx;
 +	bool forw;
  
  	KASSERT(con->c_refcnt > 0);
  
 @@ -589,6 +590,16 @@ npf_conn_setnat(const npf_cache_t *npc, 
  		return EISCONN;
  	}
  
 +	/* kern/49488: check for conflicting connection in opposite direction(?) */
 +	ret = npf_conndb_lookup(conn_db, &key, &forw);
 +	KASSERT(ret == con);
 +	atomic_dec_uint(&con->c_refcnt); /* lookup did increase refcnt */
 +	if (__predict_false(forw == true)) {
 +		printf("npf_conn_setnat: expected backwards entry but got forwards one\n");
 +		mutex_exit(&con->c_lock);
 +		return EBUSY; /* XXX */
 +	}
 +
  	/* Remove the "backwards" entry. */
  	ret = npf_conndb_remove(conn_db, &key);
  	KASSERT(ret == con);