From owner-freebsd-bugs@FreeBSD.ORG Fri Jan 30 18:28:13 2015 Return-Path: Delivered-To: freebsd-bugs@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2CDCBE05 for ; Fri, 30 Jan 2015 18:28:13 +0000 (UTC) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 0E0AF3D9 for ; Fri, 30 Jan 2015 18:28:13 +0000 (UTC) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t0UISCJT054755 for ; Fri, 30 Jan 2015 18:28:12 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 197203] [VIMAGE] null pointer dereference causing kernel panic Date: Fri, 30 Jan 2015 18:28:13 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 11.0-CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: lme@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jan 2015 18:28:13 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197203 Bug ID: 197203 Summary: [VIMAGE] null pointer dereference causing kernel panic Product: Base System Version: 11.0-CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: lme@FreeBSD.org I'm running 11.0-CURRENT #12 r277858M amd64 with "options VIMAGE" compiled into the kernel. network related stuff in rc.conf: gateway_enable="YES" cloned_interfaces="bridge0 bridge1 tap0 tap1" autobridge_interfaces="bridge0" autobridge_bridge0="tap*" ifconfig_bridge0="inet 192.168.29.1/24" ipv6_activate_all_interfaces="YES" ip6addrctl_enable="YES" ip6addrctl_policy="ipv4_prefer" ipv6_privacy="YES" rtsold_enable="YES" wlans_iwn0="wlan0" ifconfig_wlan0="WPA DHCP country DE" ifconfig_em0="DHCP" ifconfig_em0_ipv6="inet6 accept_rtadv" The machine boots fine, and all interfaces come up. But when I run "service netif restart" from a running system I get a kernel panic: Fatal trap 12: page fault while in kernel mode cpuid = 3; apic id = 03 fault virtual address = 0x28 fault code = supervisor read data, page not present instruction pointer = 0x20:0xffffffff80ac49c7 stack pointer = 0x28:0xfffffe04431d67b0 frame pointer = 0x28:0xfffffe04431d6850 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 0 (thread taskq) Uptime: 3h55m14s Dumping 857 out of 16050 MB:..2%..12%..21%..32%..42%..51%..62%..71%..81%..92% #0 doadump (textdump=Unhandled dwarf expression opcode 0x93 ) at pcpu.h:219 219 pcpu.h: No such file or directory. in pcpu.h (kgdb) #0 doadump (textdump=Unhandled dwarf expression opcode 0x93 ) at pcpu.h:219 #1 0xffffffff809c6c2f in kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:448 #2 0xffffffff809c7170 in panic (fmt=) at /usr/src/sys/kern/kern_shutdown.c:747 #3 0xffffffff803589b7 in db_panic (addr=, have_addr=Unhandled dwarf expression opcode 0x93) at /usr/src/sys/ddb/db_command.c:473 #4 0xffffffff803585cc in db_command (cmd_table=0x0) at /usr/src/sys/ddb/db_command.c:440 #5 0xffffffff80358334 in db_command_loop () at /usr/src/sys/ddb/db_command.c:493 #6 0xffffffff8035aef0 in db_trap (type=, code=Unhandled dwarf expression opcode 0x93) at /usr/src/sys/ddb/db_main.c:251 #7 0xffffffff80a0a40e in kdb_trap (type=Unhandled dwarf expression opcode 0x93) at /usr/src/sys/kern/subr_kdb.c:654 #8 0xffffffff80e3d259 in trap_fatal (frame=0xfffffe04431d6700, eva=) at /usr/src/sys/amd64/amd64/trap.c:856 #9 0xffffffff80e3d5d1 in trap_pfault (frame=0xfffffe04431d6700, usermode=) at /usr/src/sys/amd64/amd64/trap.c:678 #10 0xffffffff80e3cc0e in trap (frame=0xfffffe04431d6700) at /usr/src/sys/amd64/amd64/trap.c:426 #11 0xffffffff80e1e602 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:235 #12 0xffffffff80ac49c7 in rt_newmaddrmsg (cmd=Unhandled dwarf expression opcode 0x93) at /usr/src/sys/net/rtsock.c:1366 #13 0xffffffff80aadf90 in if_addmulti (ifp=0xfffff800065cb000, sa=, retifma=) at /usr/src/sys/net/if.c:3159 #14 0xffffffff80aed63e in ieee80211_ioctl (ifp=, cmd=, data=) at /usr/src/sys/net80211/ieee80211_ioctl.c:3325 #15 0xffffffff80b1f2df in in_leavegroup (inm=0xfffff80205445500, imf=) at /usr/src/sys/netinet/in_mcast.c:1291 #16 0xffffffff80b2351d in inp_gcmoptions (context=, pending=) at /usr/src/sys/netinet/in_mcast.c:1603 #17 0xffffffff80a1b309 in taskqueue_run_locked (queue=0xfffff80006358b00) at /usr/src/sys/kern/subr_taskqueue.c:431 #18 0xffffffff80a1c1c8 in taskqueue_thread_loop (arg=) at /usr/src/sys/kern/subr_taskqueue.c:695 #19 0xffffffff8098627a in fork_exit ( callout=0xffffffff80a1c100 , arg=0xffffffff8189fde0, frame=0xfffffe04431d6ac0) at /usr/src/sys/kern/kern_fork.c:996 #20 0xffffffff80e1eb3e in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:610 #21 0x0000000000000000 in ?? () Current language: auto; currently minimal (kgdb) (kgdb) frame 12 #12 0xffffffff80ac49c7 in rt_newmaddrmsg (cmd=Unhandled dwarf expression opcode 0x93 ) at /usr/src/sys/net/rtsock.c:1366 1366 if (V_route_cb.any_count == 0) (kgdb) p $rip $1 = (void (*)()) 0xffffffff80ac49c7 (kgdb) disas *($rip) Dump of assembler code for function rt_newmaddrmsg: 0xffffffff80ac49a0 : push %rbp 0xffffffff80ac49a1 : mov %rsp,%rbp 0xffffffff80ac49a4 : push %r15 0xffffffff80ac49a6 : push %r14 0xffffffff80ac49a8 : push %rbx 0xffffffff80ac49a9 : sub $0x78,%rsp 0xffffffff80ac49ad : mov %rsi,%rbx 0xffffffff80ac49b0 : mov %edi,%r14d 0xffffffff80ac49b3 : mov 0x20(%rbx),%r15 0xffffffff80ac49b7 : mov %gs:0x0,%rax 0xffffffff80ac49c0 : mov 0x440(%rax),%rax 0xffffffff80ac49c7 : mov 0x28(%rax),%rax 0xffffffff80ac49cb : cmpl $0x0,-0x7e9fdc20(%rax) 0xffffffff80ac49d5 : je 0xffffffff80ac4a52 0xffffffff80ac49d7 : lea -0x88(%rbp),%rdi 0xffffffff80ac49de : mov $0x70,%esi 0xffffffff80ac49e3 : callq 0xffffffff80e3acb0 0xffffffff80ac49e8 : mov 0x10(%rbx),%rax 0xffffffff80ac49ec : mov %rax,-0x58(%rbp) 0xffffffff80ac49f0 : xor %eax,%eax 0xffffffff80ac49f2 : test %r15,%r15 0xffffffff80ac49f5 : je 0xffffffff80ac4a01 0xffffffff80ac49f7 : mov 0x1d8(%r15),%rax 0xffffffff80ac49fe : mov (%rax),%rax 0xffffffff80ac4a01 : mov %rax,-0x60(%rbp) 0xffffffff80ac4a05 : mov 0x18(%rbx),%rax 0xffffffff80ac4a09 : mov %rax,-0x78(%rbp) 0xffffffff80ac4a0d : lea -0x88(%rbp),%rsi 0xffffffff80ac4a14 : mov %r14d,%edi 0xffffffff80ac4a17 : callq 0xffffffff80ac42e0 0xffffffff80ac4a1c : test %rax,%rax 0xffffffff80ac4a1f : je 0xffffffff80ac4a52 0xffffffff80ac4a21 : mov 0x10(%rax),%rcx 0xffffffff80ac4a25 : mov 0x5c(%r15),%dx 0xffffffff80ac4a2a : mov %dx,0xc(%rcx) 0xffffffff80ac4a2e : mov -0x88(%rbp),%edx 0xffffffff80ac4a34 : mov %edx,0x4(%rcx) 0xffffffff80ac4a37 : mov 0x10(%rbx),%rcx 0xffffffff80ac4a3b : test %rcx,%rcx 0xffffffff80ac4a3e : je 0xffffffff80ac4a45 0xffffffff80ac4a40 : mov 0x1(%rcx),%cl 0xffffffff80ac4a43 : jmp 0xffffffff80ac4a47 0xffffffff80ac4a45 : xor %ecx,%ecx 0xffffffff80ac4a47 : movzbl %cl,%esi ---Type to continue, or q to quit--- 0xffffffff80ac4a4a : mov %rax,%rdi 0xffffffff80ac4a4d : callq 0xffffffff80ac44a0 0xffffffff80ac4a52 : add $0x78,%rsp 0xffffffff80ac4a56 : pop %rbx 0xffffffff80ac4a57 : pop %r14 0xffffffff80ac4a59 : pop %r15 0xffffffff80ac4a5b : pop %rbp 0xffffffff80ac4a5c : retq End of assembler dump. -- You are receiving this mail because: You are the assignee for the bug.