w1R7DKmg+NRTOCnVUo1cZJd7JcW+X1f/WPy6o 8QeFOZuEye55ZvuH7n2ZBsO7ZSBhrtBs7b4yCI0+M/W0myBtuPDhvSPBPtl+wg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1775593604; a=rsa-sha256; cv=none; b=bKnAKFJaORppkESS9qXJgYCfC8UGR5TeO57FWsCd4HB2FA8mVPa8xNcng2XS+Cwgo/0KHx kq8wMMrK/m+R/LMO07RM5aEwFT2Lj2qJ7/Urzaw/1YPJuhw/p1mRviENjcH9ic+SKyMy84 ewEfA8uko2mAxqcT5Nrce1fSPuKbPKO4aBysv1jFK0KY6xHVi8iIDqB1Zxttz0NWgUUHTL eJmgm/1Cdgkt5bqBwWRw87r0zcY1OkRyQbOI5UR/pWkdDCvPvpCd55EBZzljUFeTKH0tWV E4nAjoCRa0CboJJDG8Ugk4bGMGOS6PCmFjJlRutAlWtvmjPRAlSHoUADazvegw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1775593604; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+U1Ys26JXoXJOag2Oscy4z7y1zP+xJfSa4W0Zffhg88=; b=iXT+mWsISp2pZ2sXBGWcITH7BapFIt5ONDlYrPOlhs9AOr4T++g3/ZxqSIWkKazV3nOLhk d9eOPKa6KhXSzkWPW4obVr4kUsJhbAt91g3NYND4AlHLUOsXu2t1pFRbio2cEDLNPu4pkJ LjHGOZ3kGiCQDLtSbAeomKEXjLM6hE/Oid7Bgdns0pHJ5N92iKTVSPGYgOB+0AgiC9ybih 9B61b3KG4g4OZ3FfxaWroSXoFEc4k9hfdDlvso26fcbQdwZvqkPyRzRXeFsLMyMuuqChZ5 154S9d9o+DRVY8R9goJmnndhWhC8TwMEGkglUyUbw3m+R3cAy5unWsqcoPQ4qg== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4fqyQq6K0zzvML for ; Tue, 07 Apr 2026 20:26:43 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 637KQh15007692 for ; Tue, 7 Apr 2026 20:26:43 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 637KQhnj007691 for bugs@FreeBSD.org; Tue, 7 Apr 2026 20:26:43 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 294312] Page fault with vmx0 interface (devctl disable / enable) Date: Tue, 07 Apr 2026 20:26:44 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 14.3-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: mibelanger@qnx.com X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294312 Bug ID: 294312 Summary: Page fault with vmx0 interface (devctl disable / enable) Product: Base System Version: 14.3-RELEASE Hardware: amd64 OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: mibelanger@qnx.com Created attachment 269469 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D269469&action= =3Dedit Screen shot of crash Running in vmware. Use a vmxnet3 device. FreeBSD will create an vmx0 interface. A page fault can be reproduced by disabling and enabling the device. i.e. # devctl disable vmx0 # devctl enable vmx0 The problem is that the admin status handler is being invoked by netlink. When the interface first comes up, there are no listeners so rtnl_handle_ifevent does not do very much. I believe a listener will be added by invoking ifconfig, or maybe it gets invoked when devctl disable is called. When the devctl enable runs, the code in rtnl_handle_ifevent will make it p= ast the test for listeners and calls dump_iface. This eventually gets to vmxnet3_update_admin_status and will crash as sc->vmx_ds is NULL: static void vmxnet3_update_admin_status(if_ctx_t ctx) { struct vmxnet3_softc *sc; sc =3D iflib_get_softc(ctx); if (sc->vmx_ds->event !=3D 0)<<<<