NULL pointer crash in iflib_rxd_pkt_get with vmxnet3

From: Andriy Gapon <avg_at_FreeBSD.org>
Date: Mon, 18 Oct 2021 10:48:18 UTC
This happened on FreeBSD 12.2 running as an ESXi guest with vmxnet3 network 
interface.

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff809d4bad
stack pointer           = 0x28:0xfffffe00c85cba40
frame pointer           = 0x28:0xfffffe00c85cba40
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (if_io_tqg_0)
trap number             = 12
panic: page fault

(kgdb) bt
#0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1  doadump (textdump=-933448896) at /usr/src/sys/kern/kern_shutdown.c:447
#2  0xffffffff8038f1cc in db_fncall_generic (addr=<optimized out>, nargs=0, 
args=<optimized out>, rv=<optimized out>) at /usr/src/sys/ddb/db_command.c:622
#3  db_fncall (dummy1=<optimized out>, dummy2=<optimized out>, dummy3=<optimized 
out>, dummy4=<optimized out>) at /usr/src/sys/ddb/db_command.c:670
#4  0xffffffff8038eaf6 in db_command (last_cmdp=<optimized out>, 
cmd_table=<optimized out>, dopager=0) at /usr/src/sys/ddb/db_command.c:494
#5  0xffffffff80393a68 in db_script_exec (scriptname=<optimized out>, 
warnifnotfound=<optimized out>) at /usr/src/sys/ddb/db_script.c:304
#6  0xffffffff80393892 in db_script_kdbenter (eventname=<optimized out>) at 
/usr/src/sys/ddb/db_script.c:326
#7  0xffffffff80391ac3 in db_trap (type=<optimized out>, code=<optimized out>) 
at /usr/src/sys/ddb/db_main.c:251
#8  0xffffffff807821e2 in kdb_trap (type=3, code=0, tf=0xfffffe00c85cb630) at 
/usr/src/sys/kern/subr_kdb.c:700
#9  0xffffffff809d870e in trap (frame=0xfffffe00c85cb630) at 
/usr/src/sys/amd64/amd64/trap.c:583
#10 <signal handler called>
#11 kdb_enter (why=0xffffffff80b17af9 "panic", msg=0xffffffff80b17af9 "panic") 
at /usr/src/sys/kern/subr_kdb.c:486
#12 0xffffffff8073ddce in vpanic (fmt=<optimized out>, ap=<optimized out>) at 
/usr/src/sys/kern/kern_shutdown.c:975
#13 0xffffffff8073dc23 in panic (fmt=0xffffffff81178120 <cnputs_mtx+24> "") at 
/usr/src/sys/kern/kern_shutdown.c:909
#14 0xffffffff809d8b31 in trap_fatal (frame=0xfffffe00c85cb980, eva=0) at 
/usr/src/sys/amd64/amd64/trap.c:921
#15 0xffffffff809d8b8f in trap_pfault (frame=0xfffffe00c85cb980, 
usermode=<optimized out>, signo=<optimized out>, ucode=<optimized out>) at 
/usr/src/sys/amd64/amd64/trap.c:739
#16 0xffffffff809d8256 in trap (frame=0xfffffe00c85cb980) at 
/usr/src/sys/amd64/amd64/trap.c:405
#17 <signal handler called>
#18 memcpy_erms () at /usr/src/sys/amd64/amd64/support.S:577
#19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000, 
ri=<optimized out>) at /usr/src/sys/net/iflib.c:2737
#20 iflib_rxeof (rxq=<optimized out>, budget=<optimized out>) at 
/usr/src/sys/net/iflib.c:2879
#21 _task_fn_rx (context=<optimized out>) at /usr/src/sys/net/iflib.c:3868
#22 0xffffffff807808bd in gtaskqueue_run_locked (queue=0xfffff800020c7200) at 
/usr/src/sys/kern/subr_gtaskqueue.c:362
#23 0xffffffff8078068e in gtaskqueue_thread_loop (arg=<optimized out>) at 
/usr/src/sys/kern/subr_gtaskqueue.c:537
#24 0xffffffff8070792d in fork_exit (callout=0xffffffff80780610 
<gtaskqueue_thread_loop>, arg=0xfffffe00007f8008, frame=0xfffffe00c85cbc00) at 
/usr/src/sys/kern/kern_fork.c:1088
#25 <signal handler called>

(kgdb) fr 19
#19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000, 
ri=<optimized out>) at /usr/src/sys/net/iflib.c:2737
2737    /usr/src/sys/net/iflib.c: No such file or directory.
(kgdb) i loc
sd = {ifsd_cl = 0xfffff80002d61a38, ifsd_m = 0xfffff80002d62a38, ifsd_fl = 
0xfffff80002d93400}
m = 0xfffff80123211c00

(kgdb) p m->m_data
$1 = (caddr_t) 0xfffff80123211c58 ""
(kgdb) p sd.ifsd_cl
$2 = (caddr_t *) 0xfffff80002d61a38
(kgdb) p *sd.ifsd_cl
$3 = (caddr_t) 0x0

Is this a known issue?
Is there a chance that this has already been fixed?

Thank you.

-- 
Andriy Gapon