From owner-freebsd-virtualization@FreeBSD.ORG Mon Jul 22 15:43:26 2013 Return-Path: Delivered-To: freebsd-virtualization@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id B829F855 for ; Mon, 22 Jul 2013 15:43:26 +0000 (UTC) (envelope-from nvass@gmx.com) Received: from mout.gmx.net (mout.gmx.net [74.208.4.201]) by mx1.freebsd.org (Postfix) with ESMTP id 7B2D12544 for ; Mon, 22 Jul 2013 15:43:26 +0000 (UTC) Received: from moby.local ([178.128.212.170]) by mail.gmx.com (mrgmxus001) with ESMTPSA (Nemesis) id 0M2cpH-1U9C9825a9-00sOM2 for ; Mon, 22 Jul 2013 17:43:25 +0200 Message-ID: <51ED5308.3020008@gmx.com> Date: Mon, 22 Jul 2013 18:43:04 +0300 From: Nikos Vassiliadis User-Agent: Mozilla/5.0 (X11; FreeBSD i386; rv:17.0) Gecko/20130714 Thunderbird/17.0.7 MIME-Version: 1.0 To: Craig Rodrigues Subject: Re: VIMAGE + PF crash in mbuf destructor References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:Towu0V675AegJkBZy+Yoggo6Qmispslt/Um1vETNiRxXdss3F3a IfbTa4eZo8hbwV31LEvL6jbj2KLyGJuGtuaz4OyoutXnfjnvyB4eOaW5fwJnSnoQDz3GrUj qDvdnuirAB/YPQWUW6n/5S+ni6Jq46cHYSYA0U+0Vbud6D+R7ZTlyxT/Kuv/PRaN6LAhitD ApuNf5js6zYCl3WNTBWZw== Cc: Adrian Chadd , "freebsd-virtualization@freebsd.org" , freebsd-pf@freebsd.org X-BeenThere: freebsd-virtualization@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Discussion of various virtualization techniques FreeBSD supports." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2013 15:43:26 -0000 On 07/22/13 09:32, Craig Rodrigues wrote: > Hi, > > I used a kernel config with the following lines: > > include GENERIC > options VIMAGE > > and compiled a CURRENT kernel from svn://svn.freebsd.org/base/head@253346 . > > I also have PF enabled on my system. > > Once in a while I have been getting kernel panics like these: > > > ==================================================================== > (kgdb) #0 doadump (textdump=1) at pcpu.h:236 > #1 0xffffffff808bc617 in kern_reboot (howto=260) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_shutdown.c:447 > #2 0xffffffff808bcb25 in vpanic (fmt=, > ap=) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_shutdown.c:754 > #3 0xffffffff808bcb73 in panic (fmt=) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_shutdown.c:683 > #4 0xffffffff8033dff7 in db_panic (addr=, > have_addr=, count=, > modif=) > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_command.c:482 > #5 0xffffffff8033dbcd in db_command (cmd_table=) > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_command.c:449 > #6 0xffffffff8033d944 in db_command_loop () > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_command.c:502 > #7 0xffffffff803402f0 in db_trap (type=, code=0) > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_main.c:231 > #8 0xffffffff808f3623 in kdb_trap (type=12, code=0, tf= out>) > at /usr/home/rodrigc/freebsd/head/sys/kern/subr_kdb.c:654 > #9 0xffffffff80cda43a in trap_fatal (frame=0xffffff811dbab6b0, > eva=) > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/trap.c:868 > #10 0xffffffff80cda6f4 in trap_pfault (frame=0x0, usermode=0) > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/trap.c:699 > #11 0xffffffff80cd9ef0 in trap (frame=0xffffff811dbab6b0) > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/trap.c:463 > #12 0xffffffff80cc31a2 in calltrap () > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/exception.S:232 > #13 0xffffffff8208f7b7 in pf_mtag_free (t=0xfffffe00a8797870) > at > /usr/home/rodrigc/freebsd/head/sys/modules/pf/../../netpfil/pf/pf.c:830 > #14 0xffffffff808a51c9 in mb_dtor_mbuf (mem=0xfffffe000d0bc500, size=256, > arg=0x0) at /usr/home/rodrigc/freebsd/head/sys/kern/kern_mbuf.c:499 > #15 0xffffffff80b55d4d in uma_zfree_arg (zone=0xfffffe000b4ab900, > item=0xfffffe000d0bc500, udata=0x0) > at /usr/home/rodrigc/freebsd/head/sys/vm/uma_core.c:2560 > #16 0xffffffff8092d1f5 in m_freem (mb=) at uma.h:364 > #17 0xffffffff8058ba72 in iwn_tx_done (sc=0xffffff8000974000, > desc=, ackfailcnt=16, status=131 '\203') > at /usr/home/rodrigc/freebsd/head/sys/dev/iwn/if_iwn.c:2817 > #18 0xffffffff80583e60 in iwn_notif_intr (sc=0xffffff8000974000) > at /usr/home/rodrigc/freebsd/head/sys/dev/iwn/if_iwn.c:3015 > #19 0xffffffff80583684 in iwn_intr (arg=0xffffff8000974000) > at /usr/home/rodrigc/freebsd/head/sys/dev/iwn/if_iwn.c:3306 > #20 0xffffffff8088daf3 in intr_event_execute_handlers ( > p=, ie=0xfffffe000b696600) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_intr.c:1263 > #21 0xffffffff8088e4c6 in ithread_loop (arg=0xfffffe000b31b040) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_intr.c:1276 > #22 0xffffffff8088b3f4 in fork_exit ( > callout=0xffffffff8088e420 , arg=0xfffffe000b31b040, > frame=0xffffff811dbabac0) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_fork.c:991 > #23 0xffffffff80cc36de in fork_trampoline () > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/exception.S:606 > #24 0x0000000000000000 in ?? () > Current language: auto; currently minimal > (kgdb) > ==================================================================== > > > It turns out that in this file: src/sys/netpfil/pf/pf.c > > 826 static void > 827 pf_mtag_free(struct m_tag *t) > 828 { > 829 > 830 uma_zfree(V_pf_mtag_z, t); > 831 } > > when line 830 is hit, it turns out that curthread->td_vnet is NULL. > > Does anyone have an idea as to the best place > to put CURVNET_SET() to avoid this problem? > > I am a little less famiiar with mbuf and pf. Hi, I think this comes from the eventhandlers pf installs to handle ifnet events. It seems like a wifi event causes this code to run and the context is not set. Does the panic happen only when you use vnet jails? Could you try putting all evenhandlers in an 'if (IS_DEFAULT_VNET(curvnet))' block? It's here: http://fxr.watson.org/fxr/source/netpfil/pf/pf_if.c#L127 the pfi_*_cookie = ... lines. I am not sure if this would be enough though since it might panic in other places. HTH, Nikos