New and exciting panic, possibly re(4)

[Sean Bruno]

On Wed, 2014-05-07 at 12:24 -0700, Sean Bruno wrote:
> While screwing around with comcast, I can trivially get this panic out
> of my desktop machine, and am very confused.  It seems to happen on link
> change up/down events.  I'm running 11.0-CURRENT FreeBSD 11.0-CURRENT #5
> r265280M.  I don't have any direct evidence that this is re(4), just a
> hunch from some discussions in clusteradm@ 
> 
> This can happen when reconnecting my modem or simply issues a netif
> restart.
> 
> Fatal trap 9: general protection fault while in kernel mode
> cpuid = 5; apic id = 15
> instruction pointer     = 0x20:0xffffffff80a4429e
> stack pointer           = 0x28:0xfffffe046a7f5530
> frame pointer           = 0x28:0xfffffe046a7f55d0
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, long 1, def32 0, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 1306 (ifconfig)
> trap number             = 9
> panic: general protection fault
> cpuid = 5
> KDB: stack backtrace:
> #0 0xffffffff80998510 at kdb_backtrace+0x60
> #1 0xffffffff80959d05 at panic+0x155
> #2 0xffffffff80d9f2ff at trap_fatal+0x38f
> #3 0xffffffff80d9ef5d at trap+0x74d
> #4 0xffffffff80d82282 at calltrap+0x8
> #5 0xffffffff80aa0aa1 at in_ifadownkill+0xd1
> #6 0xffffffff80a412f0 at rn_walktree+0x80
> #7 0xffffffff80aa0942 at in_ifadown+0xc2
> #8 0xffffffff80a95591 at in_difaddr_ioctl+0x3a1
> #9 0xffffffff80a94763 at in_control+0x463
> #10 0xffffffff80a3010c at ifioctl+0x145c
> #11 0xffffffff809b1a5d at kern_ioctl+0x3cd
> #12 0xffffffff809b163c at sys_ioctl+0x13c
> #13 0xffffffff80d9fd1b at amd64_syscall+0x3fb
> #14 0xffffffff80d8256b at Xfast_syscall+0xfb
> Uptime: 10m12s
> Reading symbols from /boot/kernel/zfs.ko.symbols...done.
> Loaded symbols for /boot/kernel/zfs.ko.symbols
> Reading symbols from /boot/kernel/opensolaris.ko.symbols...done.
> Loaded symbols for /boot/kernel/opensolaris.ko.symbols
> Reading symbols from /boot/modules/nvidia.ko...done.
> Loaded symbols for /boot/modules/nvidia.ko
> Reading symbols from /boot/kernel/linux.ko.symbols...done.
> Loaded symbols for /boot/kernel/linux.ko.symbols
> Reading symbols from /boot/modules/vboxdrv.ko...done.
> Loaded symbols for /boot/modules/vboxdrv.ko
> Reading symbols from /boot/kernel/linprocfs.ko.symbols...done.
> Loaded symbols for /boot/kernel/linprocfs.ko.symbols
> Reading symbols from /boot/kernel/fdescfs.ko.symbols...done.
> Loaded symbols for /boot/kernel/fdescfs.ko.symbols
> Reading symbols from /boot/modules/vboxguest.ko...done.
> Loaded symbols for /boot/modules/vboxguest.ko
> Reading symbols from /boot/modules/vboxvideo.ko...done.
> Loaded symbols for /boot/modules/vboxvideo.ko
> Reading symbols from /boot/kernel/drm.ko.symbols...done.
> Loaded symbols for /boot/kernel/drm.ko.symbols
> Reading symbols from /boot/kernel/ums.ko.symbols...done.
> Loaded symbols for /boot/kernel/ums.ko.symbols
> Reading symbols from /boot/kernel/uhid.ko.symbols...done.
> Loaded symbols for /boot/kernel/uhid.ko.symbols
> #0  doadump (textdump=<value optimized out>) at pcpu.h:219
> 219     pcpu.h: No such file or directory.
>         in pcpu.h
> (kgdb) #0  doadump (textdump=<value optimized out>) at pcpu.h:219
> #1  0xffffffff80959888 in kern_reboot (howto=260)
>     at /usr/src/sys/kern/kern_shutdown.c:449
> #2  0xffffffff80959d44 in panic (fmt=<value optimized out>)
>     at /usr/src/sys/kern/kern_shutdown.c:756
> #3  0xffffffff80d9f2ff in trap_fatal (frame=<value optimized out>, 
>     eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:882
> #4  0xffffffff80d9ef5d in trap (frame=<value optimized out>)
>     at /usr/src/sys/amd64/amd64/trap.c:224
> #5  0xffffffff80d82282 in calltrap ()
>     at /usr/src/sys/amd64/amd64/exception.S:231
> #6  0xffffffff80a4429e in rt_expunge (rnh=0x7f00000000000210, 
>     rt=0xfffff800148e10c8) at /usr/src/sys/net/route.c:930
> #7  0xffffffff80aa0aa1 in in_ifadownkill (rn=0xfffff800148e10c8, 
>     xap=0xfffffe046a7f5660) at /usr/src/sys/netinet/in_rmx.c:414
> #8  0xffffffff80a412f0 in rn_walktree (h=<value optimized out>, 
>     f=0xffffffff80aa09d0 <in_ifadownkill>, w=0xfffffe046a7f5660)
>     at /usr/src/sys/net/radix.c:1097
> #9  0xffffffff80aa0942 in in_ifadown (ifa=0xfffff8000d542300, delete=1)
>     at /usr/src/sys/netinet/in_rmx.c:447
> #10 0xffffffff80a95591 in in_difaddr_ioctl (data=<value optimized out>, 
>     ifp=0xfffff8000d249000, td=<value optimized out>)
>     at /usr/src/sys/netinet/in.c:580
> #11 0xffffffff80a94763 in in_control (so=<value optimized out>, 
>     cmd=<value optimized out>, data=0xfffff80126c642c0 "lo0", 
>     ifp=0xfffff8000d249000, td=0xfffff80108ad6000)
>     at /usr/src/sys/netinet/in.c:219
> #12 0xffffffff80a3010c in ifioctl (so=0xfffff80014839700,
> cmd=2149607705, 
>     data=0xfffff80126c642c0 "lo0", td=0xfffff80108ad6000)
>     at /usr/src/sys/net/if.c:2638
> #13 0xffffffff809b1a5d in kern_ioctl (td=0xfffff80108ad6000, 
>     fd=<value optimized out>, com=0) at file.h:323
> #14 0xffffffff809b163c in sys_ioctl (td=0xfffff80108ad6000, 
>     uap=0xfffffe046a7f59c0) at /usr/src/sys/kern/sys_generic.c:702
> #15 0xffffffff80d9fd1b in amd64_syscall (td=0xfffff80108ad6000,
> traced=0)
>     at subr_syscall.c:133
> #16 0xffffffff80d8256b in Xfast_syscall ()
>     at /usr/src/sys/amd64/amd64/exception.S:390
> #17 0x0000000800fb26fa in ?? ()
> Previous frame inner to this frame (corrupt stack?)
> Current language:  auto; currently minimal
> (kgdb) 
> 
> 

Huh, this seems to happen pretty agressively on a link down/up
transition.  I'm using this:

re0 at pci0:3:0:0:	class=0x020000 card=0x84321043 chip=0x816810ec rev=0x06
hdr=0x00
    vendor     = 'Realtek Semiconductor Co., Ltd.'
    device     = 'RTL8111/8168B PCI Express Gigabit Ethernet controller'
    class      = network
    subclass   = ethernet