[Bug 209682] [panic] [netinet] arptimer race

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209682

Dave Baukus <daveb at spectralogic.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |daveb at spectralogic.com

--- Comment #4 from Dave Baukus <daveb at spectralogic.com> ---
I have hit this 2x in the last 4 days on stable 11.1:
I'm still looking for a reliable way to recreate.


#7  0xffffffff807835de in trap (frame=0xfffffe000038a7b0) at pcpu.h:222
#8  0xffffffff80767781 in calltrap () at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/amd64/amd64/exception.S:236
#9  0xffffffff804ba395 in _rw_wlock_cookie (c=0xdeadc0dedeadc2de,
file=0xffffffff808839e0
"/usr/home/daveb/p4work/SpectraBSD_stable/sys/netinet/if_ether.c", line=287) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/kern/kern_rwlock.c:272
#10 0xffffffff805d348f in arptimer (arg=0xfffff8014c37a200) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/netinet/if_ether.c:287
#11 0xffffffff804d5fb8 in softclock_call_cc (c=0xfffff8014c37a2b8, cc=<value
optimized out>, direct=<value optimized out>) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/kern/kern_timeout.c:729
#12 0xffffffff804d639c in softclock (arg=0xffffffff80ed1100) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/kern/kern_timeout.c:867
#13 0xffffffff80483fc9 in intr_event_execute_handlers (p=<value optimized out>,
ie=0xfffff8011f130000) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/kern/kern_intr.c:1262
#14 0xffffffff80484666 in ithread_loop (arg=0xfffff8011f0fd5c0) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/kern/kern_intr.c:1275
#15 0xffffffff804816b4 in fork_exit (callout=0xffffffff804845b0 <ithread_loop>,
arg=0xfffff8011f0fd5c0, frame=0xfffffe000038aac0) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/kern/kern_fork.c:1042
#16 0xffffffff80767cbe in fork_trampoline () at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/amd64/amd64/exception.S:611
#17 0x0000000000000000 in ?? ()
(kgdb) frame 10
#10 0xffffffff805d348f in arptimer (arg=0xfffff8014c37a200) at
/usr/home/daveb/p4work/SpectraBSD_stable/sys/netinet/if_ether.c:287
287             IF_AFDATA_LOCK(ifp);


(kgdb) set $lle = (struct llentry *)arg
(kgdb) p $lle
$6 = (struct llentry *) 0xfffff8014c37a200
(kgdb) p *$lle
$7 = {
  lle_next = {
    le_next = 0x0, 
    le_prev = 0xfffff80c29487a00
  }, 
  r_l3addr = {
    addr4 = {
      s_addr = 0
    }, 
    addr6 = {
      __u6_addr = {
        __u6_addr8 = 0xfffff8014c37a210 "", 
        __u6_addr16 = 0xfffff8014c37a210, 
        __u6_addr32 = 0xfffff8014c37a210
      }
    }
  }, 
  r_linkdata = 0xfffff8014c37a220 "$\001�#\234�", 
  r_hdrlen = 14 '\016', 
  spare0 = 0xfffff8014c37a239 "", 
  r_flags = 1, 
  r_skip_req = 1, 
  lle_tbl = 0xfffff80c6a454d00, 
  lle_head = 0xfffff80c29487a00, 
  lle_free = 0xffffffff805db670 <in_lltable_destroy_lle>, 
  la_hold = 0x0, 
  la_numheld = 0, 
  la_expire = 11654, 
  la_flags = 1, 
  la_asked = 0, 
  la_preempt = 5, 
  ln_state = 2, 
  ln_router = 0, 
  ln_ntick = 0, 
  lle_remtime = 0, 
  lle_hittime = 0, 
  lle_refcnt = 1, 
  ll_addr = 0xfffff8014c37a220 "$\001�#\234�", 
  lle_chain = {
    le_next = 0x0, 
    le_prev = 0x0
  }, 
  lle_timer = {
    c_links = {
      le = {
        le_next = 0x0, 
        le_prev = 0xffffffff80ed1218
      }, 
      sle = {
        sle_next = 0x0
      }, 
      tqe = {
        tqe_next = 0x0, 
        tqe_prev = 0xffffffff80ed1218
      }
    }, 
    c_time = 50057632637741, 
    c_precision = 268435437, 
    c_arg = 0xfffff8014c37a200, 
    c_func = 0xffffffff805d31f0 <arptimer>, 
    c_lock = 0x0, 
    c_flags = 0, 
    c_iflags = 144, 
    c_cpu = 0
  }, 
  lle_lock = {
    lock_object = {
      lo_name = 0xffffffff8087f95e "lle", 
      lo_flags = 90374144, 
      lo_data = 0, 
      lo_witness = 0xfffffe00009fe180
    }, 
    rw_lock = 1
  }, 
  req_mtx = {
    lock_object = {
      lo_name = 0xffffffff808848ce "lle req", 
      lo_flags = 16973824, 
      lo_data = 0, 
      lo_witness = 0xfffffe00009fe200
    }, 
    mtx_lock = 4
  }
}
(kgdb) p *$lle->lle_tbl
$9 = {
  llt_link = {
    sle_next = 0xdeadc0dedeadc0de
  }, 
  llt_af = -559038242, 
  llt_hsize = -559038242, 
  lle_head = 0xdeadc0dedeadc0de, 
  llt_ifp = 0xdeadc0dedeadc0de, 
  llt_lookup = 0xdeadc0dedeadc0de, 
  llt_alloc_entry = 0xdeadc0dedeadc0de, 
  llt_delete_entry = 0xdeadc0dedeadc0de, 
  llt_prefix_free = 0xdeadc0dedeadc0de, 
  llt_dump_entry = 0xdeadc0dedeadc0de, 
  llt_hash = 0xdeadc0dedeadc0de, 
  llt_match_prefix = 0xdeadc0dedeadc0de, 
  llt_free_entry = 0xdeadc0dedeadc0de, 
  llt_foreach_entry = 0xdeadc0dedeadc0de, 
  llt_link_entry = 0xdeadc0dedeadc0de, 
  llt_unlink_entry = 0xdeadc0dedeadc0de, 
  llt_fill_sa_entry = 0xdeadc0dedeadc0de, 
  llt_free_tbl = 0xdeadc0dedeadc0de
}
(kgdb)

-- 
You are receiving this mail because:
You are the assignee for the bug.