From nobody Wed Nov 17 06:56:44 2021 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 9392C189D310 for ; Wed, 17 Nov 2021 06:56:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HvDHc3PFqz3pCJ for ; Wed, 17 Nov 2021 06:56:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 419B11C548 for ; Wed, 17 Nov 2021 06:56:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 1AH6uiqP071722 for ; Wed, 17 Nov 2021 06:56:44 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 1AH6uidL071721 for bugs@FreeBSD.org; Wed, 17 Nov 2021 06:56:44 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 259894] [panic] kernel panic in ng_l2tp Date: Wed, 17 Nov 2021 06:56:44 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 12.2-STABLE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: eugen@freebsd.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D259894 Bug ID: 259894 Summary: [panic] kernel panic in ng_l2tp Product: Base System Version: 12.2-STABLE Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: eugen@freebsd.org One of our servers has been upgraded from 11.4-STABLE/amd64 (completely sta= ble, no panics) to 12.3-PRERELEASE recently. Since then, it panices every several days. I managed to collect crashdump. Unfortunately, the system built with WITHOUT_KERNEL_SYMBOLS, so I have kernel.debug for the kernel but no debugg= ing symbols for modules. Here are kernel config file and kgdb session: include GENERIC ident Base12 options IPDIVERT options IPFIREWALL options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=3D100 options IPFIREWALL_DEFAULT_TO_ACCEPT device enc # EOF GNU gdb (GDB) 11.1 [GDB v11.1 for FreeBSD] Copyright (C) 2021 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-portbld-freebsd12.3". Type "show configuration" for configuration details. For bug reporting instructions, please see: . Find the GDB manual and other documentation resources online at: . For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from kernel.debug... Unread portion of the kernel message buffer: Fatal trap 12: page fault while in kernel mode cpuid =3D 5; apic id =3D 15 fault virtual address =3D 0x1c fault code =3D supervisor read data, page not present instruction pointer =3D 0x20:0xffffffff80c6fab6 stack pointer =3D 0x28:0xfffffe009c6ce9d0 frame pointer =3D 0x28:0xfffffe009c6cea10 code segment =3D base 0x0, limit 0xfffff, type 0x1b =3D DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags =3D interrupt enabled, resume, IOPL =3D 0 current process =3D 1558 (ng_queue2) trap number =3D 12 panic: page fault cpuid =3D 5 time =3D 1637072171 KDB: stack backtrace: #0 0xffffffff80c30235 at kdb_backtrace+0x65 #1 0xffffffff80be43cb at vpanic+0x17b #2 0xffffffff80be4243 at panic+0x43 #3 0xffffffff811239a1 at trap_fatal+0x391 #4 0xffffffff811239ff at trap_pfault+0x4f #5 0xffffffff81123046 at trap+0x286 #6 0xffffffff810fadc8 at calltrap+0x8 #7 0xffffffff82b4c023 at ng_l2tp_seq_rack_timeout+0x203 #8 0xffffffff82b2d5c9 at ng_apply_item+0xd9 #9 0xffffffff82b302a9 at ngthread+0x1e9 #10 0xffffffff80ba579e at fork_exit+0x7e #11 0xffffffff810fbdfe at fork_trampoline+0xe Uptime: 10d7h48m54s Dumping 6651 out of 24261 MB:..1%..11%..21%..31%..41%..51%..61%..71%..81%..= 91% __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55 55 __asm("movq %%gs:%P1,%0" : "=3Dr" (td) : "n" (offsetof(stru= ct pcpu, (kgdb) bt #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55 #1 doadump (textdump=3D) at /usr/src/sys/kern/kern_shutdown= .c:371 #2 0xffffffff80be3fe5 in kern_reboot (howto=3D260) at /usr/src/sys/kern/kern_shutdown.c:452 #3 0xffffffff80be4423 in vpanic (fmt=3D, ap=3D) at /usr/src/sys/kern/kern_shutdown.c:881 #4 0xffffffff80be4243 in panic (fmt=3D) at /usr/src/sys/kern/kern_shutdown.c:808 #5 0xffffffff811239a1 in trap_fatal (frame=3D0xfffffe009c6ce910, eva=3D28) at /usr/src/sys/amd64/amd64/trap.c:921 #6 0xffffffff811239ff in trap_pfault (frame=3D0xfffffe009c6ce910, usermode=3D, signo=3D, ucode=3D) at /usr/src/sys/amd64/amd64/trap.c:739 #7 0xffffffff81123046 in trap (frame=3D0xfffffe009c6ce910) at /usr/src/sys/amd64/amd64/trap.c:405 #8 #9 m_copypacket (m=3D0x0, how=3D1) at /usr/src/sys/kern/uipc_mbuf.c:539 #10 0xffffffff82b4c023 in ng_l2tp_seq_rack_timeout () from /boot/kernel/ng_l2tp.ko #11 0xffffffff82b2d5c9 in ng_apply_item () from /boot/kernel/netgraph.ko #12 0xffffffff82b302a9 in ngthread () from /boot/kernel/netgraph.ko #13 0xffffffff80ba579e in fork_exit (callout=3D0xfffff805c8026300, arg=3D0xfffff8057303f090, frame=3D0xfffff8002babe740) at /usr/src/sys/kern/kern_fork.c:1080 #14 (kgdb) frame 10 #10 0xffffffff82b4c023 in ng_l2tp_seq_rack_timeout () from /boot/kernel/ng_l2tp.ko (kgdb) l 50 static __inline __pure2 struct thread * 51 __curthread(void) 52 { 53 struct thread *td; 54 55 __asm("movq %%gs:%P1,%0" : "=3Dr" (td) : "n" (offsetof(stru= ct pcpu, 56 pc_curthread))); 57 return (td); 58 } 59 #define curthread (__curthread()) (kgdb) --=20 You are receiving this mail because: You are the assignee for the bug.=