NULL pointer crash in iflib_rxd_pkt_get with vmxnet3
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 18 Oct 2021 10:48:18 UTC
This happened on FreeBSD 12.2 running as an ESXi guest with vmxnet3 network interface. Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0x0 fault code = supervisor read data, page not present instruction pointer = 0x20:0xffffffff809d4bad stack pointer = 0x28:0xfffffe00c85cba40 frame pointer = 0x28:0xfffffe00c85cba40 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 0 (if_io_tqg_0) trap number = 12 panic: page fault (kgdb) bt #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55 #1 doadump (textdump=-933448896) at /usr/src/sys/kern/kern_shutdown.c:447 #2 0xffffffff8038f1cc in db_fncall_generic (addr=<optimized out>, nargs=0, args=<optimized out>, rv=<optimized out>) at /usr/src/sys/ddb/db_command.c:622 #3 db_fncall (dummy1=<optimized out>, dummy2=<optimized out>, dummy3=<optimized out>, dummy4=<optimized out>) at /usr/src/sys/ddb/db_command.c:670 #4 0xffffffff8038eaf6 in db_command (last_cmdp=<optimized out>, cmd_table=<optimized out>, dopager=0) at /usr/src/sys/ddb/db_command.c:494 #5 0xffffffff80393a68 in db_script_exec (scriptname=<optimized out>, warnifnotfound=<optimized out>) at /usr/src/sys/ddb/db_script.c:304 #6 0xffffffff80393892 in db_script_kdbenter (eventname=<optimized out>) at /usr/src/sys/ddb/db_script.c:326 #7 0xffffffff80391ac3 in db_trap (type=<optimized out>, code=<optimized out>) at /usr/src/sys/ddb/db_main.c:251 #8 0xffffffff807821e2 in kdb_trap (type=3, code=0, tf=0xfffffe00c85cb630) at /usr/src/sys/kern/subr_kdb.c:700 #9 0xffffffff809d870e in trap (frame=0xfffffe00c85cb630) at /usr/src/sys/amd64/amd64/trap.c:583 #10 <signal handler called> #11 kdb_enter (why=0xffffffff80b17af9 "panic", msg=0xffffffff80b17af9 "panic") at /usr/src/sys/kern/subr_kdb.c:486 #12 0xffffffff8073ddce in vpanic (fmt=<optimized out>, ap=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:975 #13 0xffffffff8073dc23 in panic (fmt=0xffffffff81178120 <cnputs_mtx+24> "") at /usr/src/sys/kern/kern_shutdown.c:909 #14 0xffffffff809d8b31 in trap_fatal (frame=0xfffffe00c85cb980, eva=0) at /usr/src/sys/amd64/amd64/trap.c:921 #15 0xffffffff809d8b8f in trap_pfault (frame=0xfffffe00c85cb980, usermode=<optimized out>, signo=<optimized out>, ucode=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:739 #16 0xffffffff809d8256 in trap (frame=0xfffffe00c85cb980) at /usr/src/sys/amd64/amd64/trap.c:405 #17 <signal handler called> #18 memcpy_erms () at /usr/src/sys/amd64/amd64/support.S:577 #19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000, ri=<optimized out>) at /usr/src/sys/net/iflib.c:2737 #20 iflib_rxeof (rxq=<optimized out>, budget=<optimized out>) at /usr/src/sys/net/iflib.c:2879 #21 _task_fn_rx (context=<optimized out>) at /usr/src/sys/net/iflib.c:3868 #22 0xffffffff807808bd in gtaskqueue_run_locked (queue=0xfffff800020c7200) at /usr/src/sys/kern/subr_gtaskqueue.c:362 #23 0xffffffff8078068e in gtaskqueue_thread_loop (arg=<optimized out>) at /usr/src/sys/kern/subr_gtaskqueue.c:537 #24 0xffffffff8070792d in fork_exit (callout=0xffffffff80780610 <gtaskqueue_thread_loop>, arg=0xfffffe00007f8008, frame=0xfffffe00c85cbc00) at /usr/src/sys/kern/kern_fork.c:1088 #25 <signal handler called> (kgdb) fr 19 #19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000, ri=<optimized out>) at /usr/src/sys/net/iflib.c:2737 2737 /usr/src/sys/net/iflib.c: No such file or directory. (kgdb) i loc sd = {ifsd_cl = 0xfffff80002d61a38, ifsd_m = 0xfffff80002d62a38, ifsd_fl = 0xfffff80002d93400} m = 0xfffff80123211c00 (kgdb) p m->m_data $1 = (caddr_t) 0xfffff80123211c58 "" (kgdb) p sd.ifsd_cl $2 = (caddr_t *) 0xfffff80002d61a38 (kgdb) p *sd.ifsd_cl $3 = (caddr_t) 0x0 Is this a known issue? Is there a chance that this has already been fixed? Thank you. -- Andriy Gapon