Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > muc.lists.netbsd.tech.toolchain > #3599

Re: netbsd-11 gcc bug

Show all headers | View raw

On Sat, May 23, 2026 at 08:38:03PM +0200, Roland Illig wrote:
> Am 23.05.2026 um 10:59 schrieb Manuel Bouyer:
> > Hello,
> > I tried upgrading a server to netbsd-11 and quickly got a panic
> > in ipf:
> > [ 150.0240120] fatal page fault in supervisor mode
> > [ 150.0586271] trap type 6 code 0 rip 0xffffffff8056dffa cs 0x8 rflags 0x10286 cr2 0xec ilevel 0x4 rsp 0xffff870268a63a50
> > [ 150.1225901] curlwp 0xffff869617c47400 pid 0.3 lowest kstack 0xffff870268a5f2c0
> > [ 150.1657501] panic: trap
> > [ 150.1803103] cpu0: Begin traceback...
> > [ 150.2016313] vpanic() at netbsd:vpanic+0x171
> > [ 150.2257081] panic() at netbsd:panic+0x3c
> > [ 150.2473911] trap() at netbsd:trap+0xb43
> > [ 150.2743808] --- trap (number 6) ---
> > [ 150.2951811] ipf_fastroute() at netbsd:ipf_fastroute+0x6ea
> > [ 150.3266935] ipf_send_ip() at netbsd:ipf_send_ip+0x127
> > [ 150.3544099] ipf_check() at netbsd:ipf_check+0xfd5
> > [ 150.3859226] pfil_run_hooks() at netbsd:pfil_run_hooks+0x11e
> > [ 150.4164994] ipintr() at netbsd:ipintr+0x21e
> > [ 150.4451003] softint_dispatch() at netbsd:softint_dispatch+0x112
> > 
> > ipf_fastroute+0x6ea points to external/bsd/ipf/netinet/ip_fil_netbsd.c
> > line 1200:
> >                 if (!fr || !(fr->fr_flags & FR_RETMASK)) {
> 
> line 1214 says:
> > 	if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) {
> 
> After this point, fr is guaranteed to be non-null, as the expression
> &fr->fr_dif would invoke undefined behavior, even though no memory near
> the null pointer would be accessed.

We're just taking computing the address here, we're not telling anything
about its validity.

> 
> C99 6.5.3.2 doesn't explicitly mention taking the address of
> nullptr->member, but it may be possible to construct a valid argument
> using that section.

I guess there's still variants of offsetof() around which uses this.

So what are you suggesting ? changing line 1214 to
if ((fdp != &fr->fr_dif || fr == NULL) && (fin->fin_out == 0)) {

-- 
Manuel Bouyer <bouyer@antioche.eu.org>
     NetBSD: 26 ans d'experience feront toujours la difference
--

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de

Back to muc.lists.netbsd.tech.toolchain | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

netbsd-11 gcc bug Manuel Bouyer <bouyer@antioche.eu.org> - 2026-05-23 10:59 +0200
  Re: netbsd-11 gcc bug Manuel Bouyer <bouyer@antioche.eu.org> - 2026-05-23 12:55 +0200
    Re: netbsd-11 gcc bug Manuel Bouyer <bouyer@antioche.eu.org> - 2026-05-23 20:45 +0200
  Re: netbsd-11 gcc bug Valery Ushakov <uwe@stderr.spb.ru> - 2026-05-23 14:22 +0300
    Re: netbsd-11 gcc bug Manuel Bouyer <bouyer@antioche.eu.org> - 2026-05-23 13:28 +0200
  Re: netbsd-11 gcc bug Roland Illig <roland.illig@gmx.de> - 2026-05-23 20:38 +0200
    Re: netbsd-11 gcc bug Manuel Bouyer <bouyer@antioche.eu.org> - 2026-05-23 20:47 +0200
      Re: netbsd-11 gcc bug Robert Elz <kre@munnari.OZ.AU> - 2026-05-24 02:29 +0700
        Re: netbsd-11 gcc bug Mouse <mouse@Rodents-Montreal.ORG> - 2026-05-23 19:11 -0400
          Re: netbsd-11 gcc bug Martin Husemann <martin@duskware.de> - 2026-05-24 10:44 +0200
            Re: netbsd-11 gcc bug Mouse <mouse@Rodents-Montreal.ORG> - 2026-05-24 08:33 -0400
              Re: netbsd-11 gcc bug Jason Thorpe <thorpej@me.com> - 2026-05-24 11:38 -0400
                Re: netbsd-11 gcc bug "Greg A. Woods" <woods@planix.ca> - 2026-05-24 16:53 -0700
              Re: netbsd-11 gcc bug David Holland <dholland-tech@netbsd.org> - 2026-05-25 00:02 +0000
                Re: netbsd-11 gcc bug Mouse <mouse@Rodents-Montreal.ORG> - 2026-05-25 08:23 -0400
                C compiler (over-)optimization (was: netbsd-11 gcc bug) Edgar Fuß <ef@math.uni-bonn.de> - 2026-05-29 19:12 +0200
                Re: C compiler (over-)optimization (was: netbsd-11 gcc bug) Mouse <mouse@Rodents-Montreal.ORG> - 2026-05-29 14:21 -0400
                Re: C compiler (over-)optimization (was: netbsd-11 gcc bug) "Greg A. Woods" <woods@planix.ca> - 2026-05-29 14:27 -0700
                Re: C compiler (over-)optimization Anders Magnusson <ragge@tethuvudet.se> - 2026-05-30 12:30 +0200
                Re: C compiler (over-)optimization (was: netbsd-11 gcc bug) Andrew Cagney <andrew.cagney@gmail.com> - 2026-05-31 13:02 -0400
                Re: C compiler (over-)optimization (was: netbsd-11 gcc bug) Jason Thorpe <thorpej@me.com> - 2026-05-31 14:29 -0500
                Re: netbsd-11 gcc bug "Greg A. Woods" <woods@planix.ca> - 2026-05-28 14:40 -0700
                Re: netbsd-11 gcc bug Mouse <mouse@Rodents-Montreal.ORG> - 2026-05-28 18:36 -0400
                Re: netbsd-11 gcc bug Jason Thorpe <thorpej@me.com> - 2026-05-28 19:04 -0400
                Re: netbsd-11 gcc bug "Greg A. Woods" <woods@planix.ca> - 2026-05-29 14:31 -0700
      Re: netbsd-11 gcc bug Jörg Sonnenberger <joerg@bec.de> - 2026-05-26 13:52 +0200
        Re: netbsd-11 gcc bug Jason Thorpe <thorpej@me.com> - 2026-05-26 10:02 -0400

csiph-web