Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 7 Apr 2017 13:40:46 +0200
From:      Peter Blok <pblok@bsd4all.org>
To:        freebsd-stable@freebsd.org
Subject:   panic in pfcioctl
Message-ID:  <86468517-69FF-4398-8FA9-0D7045CDD32B@bsd4all.org>

next in thread | raw e-mail | index | archive | help
Hi,

I=E2=80=99m running 11-STABLE rev 316522.

I recently had a panic while doing a pfctl -f /etc/pf.conf


The panic happens on LIST_REMOVE in keg_fetch_slab

static uma_slab_t
keg_fetch_slab(uma_keg_t keg, uma_zone_t zone, int flags)
{
        uma_slab_t slab;
        int reserve;

        mtx_assert(&keg->uk_lock, MA_OWNED);
        slab =3D NULL;
        reserve =3D 0;
        if ((flags & M_USE_RESERVE) =3D=3D 0)
                reserve =3D keg->uk_reserve;

        for (;;) {
                /*
                 * Find a slab with some space.  Prefer slabs that are =
partially
                 * used over those that are totally full.  This helps to =
reduce
                 * fragmentation.
                 */
                if (keg->uk_free > reserve) {
                        if (!LIST_EMPTY(&keg->uk_part_slab)) {
                                slab =3D LIST_FIRST(&keg->uk_part_slab);
                        } else {
                                slab =3D LIST_FIRST(&keg->uk_free_slab);
                                LIST_REMOVE(slab, us_link);
                                LIST_INSERT_HEAD(&keg->uk_part_slab, =
slab,
                                    us_link);
                        }
                        MPASS(slab->us_keg =3D=3D keg);
                        return (slab);
                }

KDB: stack backtrace:
#0 0xffffffff805df0e7 at kdb_backtrace+0x67
#1 0xffffffff8059d176 at vpanic+0x186
#2 0xffffffff8059cfe3 at panic+0x43
#3 0xffffffff808ebaa2 at trap_fatal+0x322
#4 0xffffffff808ebaf9 at trap_pfault+0x49
#5 0xffffffff808eb336 at trap+0x286
#6 0xffffffff808d1441 at calltrap+0x8
#7 0xffffffff808a871e at zone_fetch_slab+0x6e
#8 0xffffffff808a87cd at zone_import+0x4d
#9 0xffffffff808a4fc9 at uma_zalloc_arg+0x529
#10 0xffffffff80803214 at pfr_ina_define+0x584
#11 0xffffffff807f0734 at pfioctl+0x3364
#12 0xffffffff80469288 at devfs_ioctl_f+0x128
#13 0xffffffff805fa925 at kern_ioctl+0x255
#14 0xffffffff805fa65f at sys_ioctl+0x16f
#15 0xffffffff808ec604 at amd64_syscall+0x6c4
#16 0xffffffff808d172b at Xfast_syscall+0xfb

The panic is not reproducible.

So far the 1st time I stop a jail I get (numbers vary)

kernel: Freed UMA keg (pf table entries) was not empty (32 items).  Lost =
-57 pages of memory.

Any tips on how to debug/avoid this?


Peter=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86468517-69FF-4398-8FA9-0D7045CDD32B>