[Bug 220358] panic in tcp_lro_flush_all

Fri Jun 30 15:46:43 UTC 2017

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220358

oleg.nauman at gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |oleg.nauman at gmail.com

--- Comment #8 from oleg.nauman at gmail.com ---
I'm observing crashes too ( CURRENT/i386 r320466 ), for example crash due to
incoming SSH connection attempt:

__curthread () at ./machine/pcpu.h:225
225             __asm("movl %%fs:%1,%0" : "=r" (td)
(kgdb) #0  __curthread () at ./machine/pcpu.h:225
#1  doadump (textdump=-968634112) at ../../../kern/kern_shutdown.c:318
#2  0xc06e8954 in kern_reboot (howto=<optimized out>)
    at ../../../kern/kern_shutdown.c:386
#3  0xc06e8ceb in vpanic (fmt=<optimized out>,
    ap=0xea5c56ec "K\336\235\300H\325\065\306\001")
    at ../../../kern/kern_shutdown.c:779
#4  0xc06e8bab in panic (fmt=0xc092e2de "%s")
    at ../../../kern/kern_shutdown.c:710
#5  0xc08eee71 in trap_fatal (frame=0xea5c584c, eva=<optimized out>)
    at ../../../i386/i386/trap.c:978
#6  0xc08eefbb in trap_pfault (frame=0xea5c584c, usermode=0,
    eva=<optimized out>) at ../../../i386/i386/trap.c:890
#7  0xc08ee5de in trap (frame=<optimized out>)
    at ../../../i386/i386/trap.c:512
#8  <signal handler called>
#9  0xc6be0a1b in ?? ()
#10 0xc082ef73 in tcp_do_segment (m=<optimized out>, th=<optimized out>,
    so=<optimized out>, tp=<optimized out>, drop_hdrlen=<optimized out>,
    tlen=<optimized out>, iptos=<optimized out>,
    ti_locked=<error reading variable: Cannot access memory at address 0x1>)
    at ../../../netinet/tcp_input.c:2444
#11 0xc082c3a1 in tcp_input (mp=<optimized out>, offp=<optimized out>,
    proto=<optimized out>) at ../../../netinet/tcp_input.c:1191
#12 0xc0820a98 in ip_input (m=0x0) at ../../../netinet/ip_input.c:823
#13 0xc07d57db in netisr_dispatch_src (proto=<optimized out>,
    source=<optimized out>, m=0xc6be0a18) at ../../../net/netisr.c:1120
#14 0xc07d5aa0 in netisr_dispatch (proto=1, m=0xc6c01800)
    at ../../../net/netisr.c:1211
#15 0xc07c74b2 in ether_demux (ifp=0xc634e800, m=0x0)
    at ../../../net/if_ethersubr.c:848
#16 0xc07c8140 in ether_input_internal (ifp=0xc634e800, m=0xc6be0a18)
    at ../../../net/if_ethersubr.c:637
#17 ether_nh_input (m=<optimized out>) at ../../../net/if_ethersubr.c:667
#18 0xc07d57db in netisr_dispatch_src (proto=<optimized out>,
    source=<optimized out>, m=0xc6be0a18) at ../../../net/netisr.c:1120
#19 0xc07d5aa0 in netisr_dispatch (proto=5, m=0xc6c01800)
    at ../../../net/netisr.c:1211
#20 0xc07c773a in ether_input (ifp=0xc634e800, m=0x0)
    at ../../../net/if_ethersubr.c:757
#21 0xc04f5058 in age_rxeof (sc=<optimized out>, rxrd=<optimized out>)
    at ../../../dev/age/if_age.c:2442
#22 age_rxintr (rr_prod=4, count=<optimized out>, sc=<optimized out>)
    at ../../../dev/age/if_age.c:2488
#23 age_int_task (arg=<optimized out>, pending=1)
    at ../../../dev/age/if_age.c:2167
#24 0xc0735bfc in taskqueue_run_locked (queue=0xc631a300)
    at ../../../kern/subr_taskqueue.c:454
#25 0xc0736ae7 in taskqueue_thread_loop (arg=0xc6344a6c)
    at ../../../kern/subr_taskqueue.c:746
#26 0xc06b8b06 in fork_exit (callout=0xc0736a40 <taskqueue_thread_loop>,
    arg=<optimized out>, frame=<optimized out>)
    at ../../../kern/kern_fork.c:1038
#27 <signal handler called>
(kgdb)

machdep.hyperthreading_allowed is set to 0

My system also reproducible panics on named reconfigure/flush/shutdown events
with ( partially ) similar backtrace , as well as panics caused by IPC ; for
example:

__curthread () at ./machine/pcpu.h:225
225             __asm("movl %%fs:%1,%0" : "=r" (td)
(kgdb) #0  __curthread () at ./machine/pcpu.h:225
#1  doadump (textdump=-968633856) at ../../../kern/kern_shutdown.c:318
#2  0xc06e88c4 in kern_reboot (howto=<optimized out>)
    at ../../../kern/kern_shutdown.c:386
#3  0xc06e8c5b in vpanic (fmt=<optimized out>,
    ap=0xefd5c73c "\340\334\235\300\310\370\266\306\001")
    at ../../../kern/kern_shutdown.c:779
#4  0xc06e8b1b in panic (fmt=0xc092e18e "%s")
    at ../../../kern/kern_shutdown.c:710
#5  0xc08eed21 in trap_fatal (frame=0xefd5c878, eva=<optimized out>)
    at ../../../i386/i386/trap.c:978
#6  0xc08eea38 in trap (frame=<optimized out>)
    at ../../../i386/i386/trap.c:704
#7  <signal handler called>
#8  0xc6bcda1b in ?? ()
#9  0xc0770281 in unp_connect2 (so=<optimized out>, so2=<optimized out>,
    req=<optimized out>) at ../../../kern/uipc_usrreq.c:1497
#10 0xc076ff17 in unp_connectat (fd=<optimized out>, so=<optimized out>,
    nam=<optimized out>, td=<optimized out>)
    at ../../../kern/uipc_usrreq.c:1446
#11 0xc076d510 in unp_connect (so=0xc71c9400, nam=0xc662d500,
    td=<optimized out>) at ../../../kern/uipc_usrreq.c:1310
#12 uipc_connect (so=0xc71c9400, nam=0xc662d500, td=<optimized out>)
    at ../../../kern/uipc_usrreq.c:587
#13 0xc076a042 in kern_connectat (td=<optimized out>, dirfd=-100,
    fd=<optimized out>, sa=0xc662d500) at ../../../kern/uipc_syscalls.c:505
#14 0xc0769f49 in sys_connect (td=0xc6bcda18, uap=0xc6b6f988)
    at ../../../kern/uipc_syscalls.c:470
#15 0xc08ef679 in syscallenter (td=<optimized out>)
    at ../../../i386/i386/../../kern/subr_syscall.c:132
#16 syscall (frame=<optimized out>) at ../../../i386/i386/trap.c:1103
#17 <signal handler called>
#18 0x283a4747 in ?? ()
Backtrace stopped: Cannot access memory at address 0xbfbfe794
(kgdb)

-- 
You are receiving this mail because:
You are the assignee for the bug.