[Bug 258183] [tcp] [panic] [RACK] kernel panic in rack_setup_offset_for_rsm() at netinet/tcp_stacks/rack.c:6050

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258183

            Bug ID: 258183
           Summary: [tcp] [panic] [RACK] kernel panic in
                    rack_setup_offset_for_rsm() at
                    netinet/tcp_stacks/rack.c:6050
           Product: Base System
           Version: 13.0-STABLE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: iron.udjin@gmail.com

Hello,

OS: 13.0-STABLE stable/13-n247000-5a67aaf1fa2c

It seems related to tcp RACK.

Fatal trap 12: page fault while in kernel mode
cpuid = 16; apic id = 14
fault virtual address   = 0x18
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff8161731e
stack pointer          = 0x28:0xfffffe0201d8daf0
frame pointer          = 0x28:0xfffffe0201d8dbe0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (if_io_tqg_16)
trap number             = 12
panic: page fault
cpuid = 16
time = 1630412741
KDB: stack backtrace:
#0 0xffffffff805f7d75 at kdb_backtrace+0x65
#1 0xffffffff805ace27 at vpanic+0x187
#2 0xffffffff805acc93 at panic+0x43
#3 0xffffffff80858b17 at trap_fatal+0x387
#4 0xffffffff80858b6f at trap_pfault+0x4f
#5 0xffffffff8085820a at trap+0x25a
#6 0xffffffff80830c48 at calltrap+0x8
#7 0xffffffff8161508a at rack_log_ack+0x88a
#8 0xffffffff816130cc at rack_process_ack+0x13c
#9 0xffffffff81610c8e at rack_do_established+0xffe
#10 0xffffffff816073a4 at rack_do_segment_nounlock+0x2244
#11 0xffffffff8161e13d at ctf_process_inbound_raw+0x9d
#12 0xffffffff8161e576 at ctf_do_queued_segments+0x36
#13 0xffffffff80716ca6 at tcp_lro_flush+0xb76
#14 0xffffffff80716f8b at tcp_lro_flush_all+0x17b
#15 0xffffffff806d1692 at _task_fn_rx+0xc12
#16 0xffffffff805f67ed at gtaskqueue_run_locked+0x16d
#17 0xffffffff805f6453 at gtaskqueue_thread_loop+0xc3
Uptime: 1d11h24m18s
Dumping 24198 out of 196241
MB:..1%..11%..21%..31%..41%..51%..61%..71%..81%..91%

__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
55              __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct
pcpu,
(kgdb) bt
#0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1  doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xffffffff805aca25 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:486
#3  0xffffffff805ace96 in vpanic (fmt=0xffffffff808b9aee "%s", ap=<optimized
out>) at /usr/src/sys/kern/kern_shutdown.c:919
#4  0xffffffff805acc93 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:843
#5  0xffffffff80858b17 in trap_fatal (frame=0xfffffe0201d8da30, eva=24) at
/usr/src/sys/amd64/amd64/trap.c:941
#6  0xffffffff80858b6f in trap_pfault (frame=frame@entry=0xfffffe0201d8da30,
usermode=false, signo=<optimized out>, signo@entry=0x0, ucode=<optimized out>,
ucode@entry=0x0) at /usr/src/sys/amd64/amd64/trap.c:760
#7  0xffffffff8085820a in trap (frame=0xfffffe0201d8da30) at
/usr/src/sys/amd64/amd64/trap.c:438
#8  <signal handler called>
#9  rack_setup_offset_for_rsm (src_rsm=<optimized out>, rsm=0xfffff80568cc88c0)
at /usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack.c:6050
#10 rack_proc_sack_blk (tp=<optimized out>, tp@entry=0xfffffe05926e8518,
rack=rack@entry=0xfffffe03d3606040, sack=sack@entry=0xfffffe0201d8dc10,
to=<optimized out>, prsm=<optimized out>, prsm@entry=0xfffffe0201d8dc78,
cts=cts@entry=2904271550, moved_two=0xfffffe0201d8dc94)
    at /usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack.c:8507
#11 0xffffffff8161508a in rack_log_ack (tp=<optimized out>,
tp@entry=0xfffffe05926e8518, to=<optimized out>, to@entry=0xfffffe0201d8e080,
th=th@entry=0xfffff801e62bd47a, entered_recovery=0, dup_ack_struck=<optimized
out>) at /usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack.c:9325
#12 0xffffffff816130cc in rack_process_ack (m=m@entry=0xfffff801e62bd400,
th=th@entry=0xfffff801e62bd47a, so=so@entry=0xfffff8113b427000,
tp=tp@entry=0xfffffe05926e8518, to=to@entry=0xfffffe0201d8e080,
tiwin=<optimized out>, tlen=0, ofia=0x0, thflags=16,
ret_val=0xfffffe0201d8ded4)
    at /usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack.c:9830
#13 0xffffffff81610c8e in rack_do_established (m=0xfffff801e62bd400,
th=<optimized out>, so=0xfffff8113b427000, tp=0xfffffe05926e8518,
to=0xfffffe0201d8e080, drop_hdrlen=52, tlen=-748658560, tiwin=131328,
thflags=0, nxt_pkt=1, iptos=0 '\000') at
/usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack.c:11346
#14 0xffffffff816073a4 in rack_do_segment_nounlock (m=0xfffff801e62bd400,
th=<optimized out>, so=0xfffff8113b427000, tp=0xfffffe05926e8518,
drop_hdrlen=780023670, tlen=<optimized out>, iptos=0 '\000', nxt_pkt=1,
tv=0xfffffe0201d8e128) at
/usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack.c:13986
#15 0xffffffff8161e13d in ctf_process_inbound_raw (tp=0xfffffe05926e8518,
so=0xfffff8113b427000, m=0xfffff801e62bd400, has_pkt=0) at
/usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack_bbr_common.c:502
#16 0xffffffff8161e576 in ctf_do_queued_segments (so=0x0, tp=<optimized out>,
have_pkt=0) at
/usr/src/sys/modules/tcp/rack/../../../netinet/tcp_stacks/rack_bbr_common.c:538
#17 0xffffffff80716ca6 in tcp_lro_flush_tcphpts (lc=<optimized out>,
le=<optimized out>) at /usr/src/sys/netinet/tcp_lro.c:1328
#18 tcp_lro_flush (lc=lc@entry=0xfffffe014d159a30, le=0xfffffe0150585690) at
/usr/src/sys/netinet/tcp_lro.c:1345
#19 0xffffffff80716f8b in tcp_lro_rx_done (lc=0xfffffe014d159a30) at
/usr/src/sys/netinet/tcp_lro.c:562
#20 tcp_lro_flush_all (lc=lc@entry=0xfffffe014d159a30) at
/usr/src/sys/netinet/tcp_lro.c:1506
#21 0xffffffff806d1692 in iflib_rxeof (rxq=<optimized out>, budget=<optimized
out>) at /usr/src/sys/net/iflib.c:3056
#22 _task_fn_rx (context=<optimized out>) at /usr/src/sys/net/iflib.c:3988
#23 0xffffffff805f67ed in gtaskqueue_run_locked
(queue=queue@entry=0xfffff80104ce1300) at
/usr/src/sys/kern/subr_gtaskqueue.c:371
#24 0xffffffff805f6453 in gtaskqueue_thread_loop (arg=<optimized out>,
arg@entry=0xfffffe014d8cd188) at /usr/src/sys/kern/subr_gtaskqueue.c:547
#25 0xffffffff8056cef9 in fork_exit (callout=0xffffffff805f6390
<gtaskqueue_thread_loop>, arg=0xfffffe014d8cd188, frame=0xfffffe0201d8e480) at
/usr/src/sys/kern/kern_fork.c:1083
#26 <signal handler called>
(kgdb)

-- 
You are receiving this mail because:
You are the assignee for the bug.