[Bug 257302] net/syncthing panics system with mcast join on ipfw0

From: <bugzilla-noreply_at_freebsd.org>
Date: Wed, 21 Jul 2021 01:50:39 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=257302

            Bug ID: 257302
           Summary: net/syncthing panics system with mcast join on ipfw0
           Product: Base System
           Version: 12.2-STABLE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: lxv@omut.org

It appears that syncthing (installed from port net/syncthing) manages to panic
the system shortly after start-up as follows:

Jul 20 13:43:02 foam syslogd: kernel boot file is /boot/kernel/kernel
Jul 20 13:43:02 foam kernel:
Jul 20 13:43:02 foam syslogd: last message repeated 1 times
Jul 20 13:43:02 foam kernel: Fatal trap 12: page fault while in kernel mode
Jul 20 13:43:02 foam kernel: cpuid = 1; apic id = 01
Jul 20 13:43:02 foam kernel: fault virtual address      = 0x28
Jul 20 13:43:02 foam kernel: fault code         = supervisor read data, page
not present
Jul 20 13:43:02 foam kernel: instruction pointer        =
0x20:0xffffffff80e04a0e
Jul 20 13:43:02 foam kernel: stack pointer              =
0x28:0xfffffe005c61cfa0
Jul 20 13:43:02 foam kernel: frame pointer              =
0x28:0xfffffe005c61d060
Jul 20 13:43:02 foam kernel: code segment               = base 0x0, limit
0xfffff, type 0x1b
Jul 20 13:43:02 foam kernel:                    = DPL 0, pres 1, long 1, def32
0, gran 1
Jul 20 13:43:02 foam kernel: processor eflags   = interrupt enabled, resume,
IOPL = 0
Jul 20 13:43:02 foam kernel: current process            = 1226 (syncthing)
Jul 20 13:43:02 foam kernel: trap number                = 12
Jul 20 13:43:02 foam kernel: panic: page fault
Jul 20 13:43:02 foam kernel: cpuid = 1
Jul 20 13:43:02 foam kernel: time = 1626802891
Jul 20 13:43:02 foam kernel: KDB: stack backtrace:
Jul 20 13:43:02 foam kernel: #0 0xffffffff80c0ae35 at kdb_backtrace+0x65
Jul 20 13:43:02 foam kernel: #1 0xffffffff80bbf0eb at vpanic+0x17b
Jul 20 13:43:02 foam kernel: #2 0xffffffff80bbef63 at panic+0x43
Jul 20 13:43:02 foam kernel: #3 0xffffffff8108f941 at trap_fatal+0x391
Jul 20 13:43:02 foam kernel: #4 0xffffffff8108f99f at trap_pfault+0x4f
Jul 20 13:43:02 foam kernel: #5 0xffffffff8108efe6 at trap+0x286
Jul 20 13:43:02 foam kernel: #6 0xffffffff81066d48 at calltrap+0x8
Jul 20 13:43:02 foam kernel: #7 0xffffffff80e06e3d at ip6_setmoptions+0x101d
Jul 20 13:43:02 foam kernel: #8 0xffffffff80e13929 at ip6_ctloutput+0x229
Jul 20 13:43:02 foam kernel: #9 0xffffffff80c584d6 at sosetopt+0xe6
Jul 20 13:43:02 foam kernel: #10 0xffffffff80c5da70 at kern_setsockopt+0xb0
Jul 20 13:43:02 foam kernel: #11 0xffffffff80c5d9b4 at sys_setsockopt+0x24
Jul 20 13:43:02 foam kernel: #12 0xffffffff810904f7 at amd64_syscall+0x387

(kgdb) where
#0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1  doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:371
#2  0xffffffff80bbed05 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:451
#3  0xffffffff80bbf143 in vpanic (fmt=<optimized out>, ap=<optimized out>) at
/usr/src/sys/kern/kern_shutdown.c:880
#4  0xffffffff80bbef63 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:807
#5  0xffffffff8108f941 in trap_fatal (frame=0xfffffe005c3ceee0, eva=40) at
/usr/src/sys/amd64/amd64/trap.c:921
#6  0xffffffff8108f99f in trap_pfault (frame=0xfffffe005c3ceee0,
usermode=<optimized out>, signo=<optimized out>, ucode=<optimized out>) at
/usr/src/sys/amd64/amd64/trap.c:739
#7  0xffffffff8108efe6 in trap (frame=0xfffffe005c3ceee0) at
/usr/src/sys/amd64/amd64/trap.c:405
#8  <signal handler called>
#9  0xffffffff80e04a0e in in6_getmulti (ifp=<optimized out>,
group=0xfffffe005c3cf118, pinm=<optimized out>) at
/usr/src/sys/netinet6/in6_mcast.c:451
#10 in6_joingroup_locked (ifp=<optimized out>, mcaddr=0xfffffe005c3cf118,
imf=0xfffff80012748dc0, pinm=0xfffff80012748dd8, delay=0) at
/usr/src/sys/netinet6/in6_mcast.c:1241
#11 0xffffffff80e06e3d in in6p_join_group (inp=0xfffff800129673d0,
sopt=<optimized out>) at /usr/src/sys/netinet6/in6_mcast.c:2089
#12 ip6_setmoptions (inp=0xfffff800129673d0, sopt=<optimized out>) at
/usr/src/sys/netinet6/in6_mcast.c:2685
#13 0xffffffff80e13929 in ip6_ctloutput (so=0xfffff80012986a38,
sopt=0xfffffe005c3cfb98) at /usr/src/sys/netinet6/ip6_output.c:1929
#14 0xffffffff80c584d6 in sosetopt (so=0xfffff80012986a38,
sopt=0xfffffe005c3cfb98) at /usr/src/sys/kern/uipc_socket.c:2761
#15 0xffffffff80c5da70 in kern_setsockopt (td=0xfffff800126f9000, s=<optimized
out>, level=<optimized out>, name=<optimized out>, val=<optimized out>,
valseg=<optimized out>, valsize=136) at /usr/src/sys/kern/uipc_syscalls.c:1272
#16 0xffffffff80c5d9b4 in sys_setsockopt (td=0xfffff80003023b40, uap=<optimized
out>) at /usr/src/sys/kern/uipc_syscalls.c:1233
#17 0xffffffff810904f7 in syscallenter (td=0xfffff800126f9000) at
/usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:144
#18 amd64_syscall (td=0xfffff800126f9000, traced=0) at
/usr/src/sys/amd64/amd64/trap.c:1163
#19 <signal handler called>
#20 0x00000000004c310a in ?? ()

(kgdb) f 9
#9  0xffffffff80e04a0e in in6_getmulti (ifp=<optimized out>,
group=0xfffffe005c3cf118, pinm=<optimized out>) at
/usr/src/sys/netinet6/in6_mcast.c:451
451             inm->in6m_mli = MLD_IFINFO(ifp);

(kgdb) p inm->in6m_ifp.if_dname
$1 = 0xffffffff8249c850 <ipfwname> "ipfw"

I suspect the code path in the app is:

- list all network interfaces having MULTICAST flag:
https://github.com/syncthing/syncthing/blob/main/lib/upnp/upnp.go#L91
https://github.com/syncthing/syncthing/blob/main/lib/upnp/upnp.go#L103

- join
https://github.com/syncthing/syncthing/blob/main/lib/upnp/upnp.go#L163

-- 
You are receiving this mail because:
You are the assignee for the bug.