[Bug 279899] pf_unlink_state mutex unlock page fault panic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279899

            Bug ID: 279899
           Summary: pf_unlink_state mutex unlock page fault panic
           Product: Base System
           Version: 14.1-STABLE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: amigan@gmail.com

14-STABLE 935c5a5554e9. Issue was not present as of ff27c3872300. The crash
happens pretty reliably within a couple minutes of boot.

#0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
        td = <optimized out>
#1  doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:405
        error = 0
        coredump = <optimized out>
#2  0xffffffff8086b987 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:523
        once = 0
#3  0xffffffff8086be5e in vpanic (fmt=0xffffffff80e7a878 "%s",
    ap=ap@entry=0xfffffe0090e36c50) at /usr/src/sys/kern/kern_shutdown.c:967
        buf = "page fault", '\000' <repeats 245 times>
        __pc = 0x0
        __pc = 0x0
        __pc = 0x0
        other_cpus = {__bits = {14, 0 <repeats 15 times>}}
        td = 0xfffff800079d6000
        bootopt = <unavailable>
        newpanic = <optimized out>
#4  0xffffffff8086bcb3 in panic (fmt=<unavailable>)
    at /usr/src/sys/kern/kern_shutdown.c:891
        ap = {{gp_offset = 16, fp_offset = 48,
            overflow_arg_area = 0xfffffe0090e36c80,
            reg_save_area = 0xfffffe0090e36c20}}
#5  0xffffffff80d63e2b in trap_fatal (frame=0xfffffe0090e36d30, eva=32)
    at /usr/src/sys/amd64/amd64/trap.c:952
        __pc = 0x0
        __pc = 0x0
        __pc = 0x0
        softseg = {ssd_base = 0, ssd_limit = 1048575, ssd_type = 27,
          ssd_dpl = 0, ssd_p = 1, ssd_long = 1, ssd_def32 = 0, ssd_gran = 1}
        code = 0
        ss = 40
        type = <optimized out>
        gdt = <optimized out>
        handled = <optimized out>
#6  0xffffffff80d63e76 in trap_pfault (frame=<unavailable>, usermode=false,
    signo=<optimized out>, ucode=<optimized out>)
    at /usr/src/sys/amd64/amd64/trap.c:760
        __pc = 0x0
        __pc = 0x0
        __pc = 0x0
        td = 0xfffff800079d6000
        p = <optimized out>
        eva = <unavailable>
        map = <optimized out>
        ftype = <optimized out>
        rv = <optimized out>
#7  <signal handler called>
No locals.
#8  0xffffffff808d28c0 in turnstile_broadcast (ts=0x0, queue=queue@entry=0)
    at /usr/src/sys/kern/subr_turnstile.c:900
        td = <optimized out>
        ts1 = <optimized out>
        tc = <optimized out>
#9  0xffffffff80848c63 in __mtx_unlock_sleep (c=<optimized out>,
    v=<optimized out>) at /usr/src/sys/kern/kern_mutex.c:1056
        tid = <optimized out>
        m = 0xfffffe0091b89548
        ts = 0x0
#10 0xffffffff80b6c268 in pf_unlink_state (s=s@entry=0xfffff801c6a56840)
    at /usr/src/sys/netpfil/pf/pf.c:2146
        _v = 0
        ih = 0xfffffe0091b89540
#11 0xffffffff80b6b7b8 in pf_purge_expired_states (i=103382, maxcheck=108)
    at /usr/src/sys/netpfil/pf/pf.c:2206
        count = 0
        ih = 0xfffffe0091af1970
        s = 0xfffff801c6a56840
        mrm = <optimized out>
#12 0xffffffff80b6b5db in pf_purge_thread (unused=<optimized out>)
    at /usr/src/sys/netpfil/pf/pf.c:1949
        saved_vnet = 0x0
        vnet_iter = 0xfffff800010af9c0
#13 0xffffffff8082677f in fork_exit (
    callout=0xffffffff80b6b4a0 <pf_purge_thread>, arg=0x0,
    frame=0xfffffe0090e36f40) at /usr/src/sys/kern/kern_fork.c:1164
        __pc = 0x0
        __pc = 0x0
        td = 0xfffff800079d6000
        p = 0xfffffe0010def5a0
        dtd = <optimized out>
#14 <signal handler called>

-- 
You are receiving this mail because:
You are the assignee for the bug.