Panic during ci test run

[Matthew Macy]

This isn't reproducing it for me. I'll need more specifics on your
configuration.
-M

On Sat, Aug 11, 2018 at 2:04 AM Kristof Provost <kp at freebsd.org> wrote:

> The fibs_test:subnet_route_with_multiple_fibs_on_same_subnet test
> (/usr/tests/sys/netinet/) consistently provokes a panic.
>
> Note that this requires:
>
>    - test_suites.FreeBSD.fibs = '1 2' in /usr/local/etc/kyua/kyua.conf
>    - net.fibs=3 in /boot/loader.conf
>    - sysctl net.add_addr_allfibs=0
>
> Then:
>
>    - cd /usr/tests/sys/netinet/
>    - sudo kyua test
>
> This results in:
>
> Fatal trap 9: general protection fault while in kernel mode
> cpuid = 2; apic id = 02
> instruction pointer     = 0x20:0xffffffff80ded4c3
> stack pointer           = 0x28:0xfffffe0000427860
> frame pointer           = 0x28:0xfffffe00004278a0
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, long 1, def32 0, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 0 (softirq_2)
> [ thread pid 0 tid 100021 ]
> Stopped at      inp_gcmoptions+0xe3:    movq    ll+0x33f(%rax),%r9
> db> bt
> Tracing pid 0 tid 100021 td 0xfffff80004605000
> inp_gcmoptions() at inp_gcmoptions+0xe3/frame 0xfffffe00004278a0
> epoch_call_task() at epoch_call_task+0x21a/frame 0xfffffe00004278f0
> gtaskqueue_run_locked() at gtaskqueue_run_locked+0x139/frame 0xfffffe0000427940
> gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0x88/frame 0xfffffe0000427970
> fork_exit() at fork_exit+0x84/frame 0xfffffe00004279b0
> fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00004279b0
> --- trap 0, rip = 0, rsp = 0, rbp = 0 ---
>
> kgdb decodes that to:
>
> #0  __curthread () at ./machine/pcpu.h:230
> #1  doadump (textdump=0) at /usr/src/sys/kern/kern_shutdown.c:366
> #2  0xffffffff8043dd4b in db_dump (dummy=<optimized out>, dummy2=<unavailable>, dummy3=<unavailable>, dummy4=<unavailable>) at /usr/src/sys/ddb/db_command.c:574
> #3  0xffffffff8043db19 in db_command (last_cmdp=<optimized out>, cmd_table=<optimized out>, dopager=<optimized out>) at /usr/src/sys/ddb/db_command.c:481
> #4  0xffffffff8043d894 in db_command_loop () at /usr/src/sys/ddb/db_command.c:534
> #5  0xffffffff80440abf in db_trap (type=<optimized out>, code=<optimized out>) at /usr/src/sys/ddb/db_main.c:252
> #6  0xffffffff80bdef43 in kdb_trap (type=9, code=0, tf=<optimized out>) at /usr/src/sys/kern/subr_kdb.c:693
> #7  0xffffffff8107aee1 in trap_fatal (frame=0xfffffe00004277a0, eva=0) at /usr/src/sys/amd64/amd64/trap.c:906
> #8  0xffffffff8107a3bd in trap (frame=0xfffffe00004277a0) at /usr/src/sys/amd64/amd64/trap.c:203
> #9  <signal handler called>
> #10 inp_gcmoptions (ctx=0xfffff800142da5e0) at /usr/src/sys/netinet6/in6_mcast.c:1650
> #11 0xffffffff80bd9c7a in epoch_call_task (arg=<optimized out>) at /usr/src/sys/kern/subr_epoch.c:507
> #12 0xffffffff80bdd069 in gtaskqueue_run_locked (queue=0xfffff800040ceb00) at /usr/src/sys/kern/subr_gtaskqueue.c:332
> #13 0xffffffff80bdcde8 in gtaskqueue_thread_loop (arg=<optimized out>) at /usr/src/sys/kern/subr_gtaskqueue.c:507
> #14 0xffffffff80b53084 in fork_exit (callout=0xffffffff80bdcd60 <gtaskqueue_thread_loop>, arg=0xfffffe0087e40038, frame=0xfffffe00004279c0) at /usr/src/sys/kern/kern_fork.c:1057
> #15 <signal handler called>
>
> It looks like the inm has been freed at that point, so we try to
> dereference a freed pointer, and that doesn’t go well for us:
>
> (kgdb) fr 10
> #10 inp_gcmoptions (ctx=0xfffff800142da5e0) at /usr/src/sys/netinet6/in6_mcast.c:1650
> 1650                            CURVNET_SET(ifp->if_vnet);
> (kgdb) p ifp
> $1 = (struct ifnet *) 0xdeadc0dedeadc0de
> (kgdb)
> (kgdb) l
> 1645                    if (imf)
> 1646                            im6f_leave(imf);
> 1647                    inm = imo->im6o_membership[idx];
> 1648                    ifp = inm->in6m_ifp;
> 1649                    if (ifp != NULL) {
> 1650                            CURVNET_SET(ifp->if_vnet);
> 1651                            (void)in6_leavegroup(inm, imf);
> 1652                            CURVNET_RESTORE();
> 1653                    } else {
> 1654                            (void)in6_leavegroup(inm, imf);
> (kgdb) p inm
> $2 = (struct in6_multi *) 0xfffff8001435b200
> (kgdb) p *inm
> $3 = {in6m_addr = {__u6_addr = {__u6_addr8 = "\336\300\255\336\336\300\255\336\336\300\255\336\336\300\255", <incomplete sequence \336>, __u6_addr16 = {49374, 57005, 49374,
>         57005, 49374, 57005, 49374, 57005}, __u6_addr32 = {3735929054, 3735929054, 3735929054, 3735929054}}}, in6m_ifp = 0xdeadc0dedeadc0de, in6m_ifma = 0xdeadc0dedeadc0de,
>   in6m_refcount = 3735929054, in6m_state = 3735929054, in6m_timer = 3735929054, in6m_mli = 0xdeadc0dedeadc0de, in6m_nrele = {sle_next = 0xdeadc0dedeadc0de}, in6m_srcs = {
>     rbh_root = 0xdeadc0dedeadc0de}, in6m_nsrc = 16045693110842147038, in6m_scq = {mq_head = {stqh_first = 0xdeadc0dedeadc0de, stqh_last = 0xdeadc0dedeadc0de},
>     mq_len = -559038242, mq_maxlen = -559038242}, in6m_lastgsrtv = {tv_sec = -2401050962867404578, tv_usec = -2401050962867404578}, in6m_sctimer = 49374, in6m_scrv = 57005,
>   in6m_st = {{iss_fmode = 49374, iss_asm = 57005, iss_ex = 49374, iss_in = 57005, iss_rec = 49374}, {iss_fmode = 57005, iss_asm = 49374, iss_ex = 57005, iss_in = 49374,
>       iss_rec = 57005}}}
> (kgdb)
> (kgdb) p nmships
> $4 = 1
> (kgdb) p *imf
> $6 = {im6f_sources = {rbh_root = 0x0}, im6f_nsrc = 0, im6f_st = "\002\001"}
> (kgdb)
>
> Regards,
> Kristof
>