From owner-freebsd-current@freebsd.org Tue Dec 8 15:39:19 2020 Return-Path: Delivered-To: freebsd-current@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 51DE34A35CF for ; Tue, 8 Dec 2020 15:39:19 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org [IPv6:2610:1c1:1:606c::50:13]) by mx1.freebsd.org (Postfix) with ESMTP id 4Cr49M1njgz4TrF for ; Tue, 8 Dec 2020 15:39:19 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id 3D70C4A35CE; Tue, 8 Dec 2020 15:39:19 +0000 (UTC) Delivered-To: current@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 3D3AE4A3675 for ; Tue, 8 Dec 2020 15:39:19 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Cr49M1GzJz4V7N; Tue, 8 Dec 2020 15:39:19 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) (Authenticated sender: kevans) by smtp.freebsd.org (Postfix) with ESMTPSA id 194322056A; Tue, 8 Dec 2020 15:39:19 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: by mail-ua1-f49.google.com with SMTP id g3so5736103uae.7; Tue, 08 Dec 2020 07:39:19 -0800 (PST) X-Gm-Message-State: AOAM532NNGRLcWipHoZnavhBZ5e/1lyWhNtb9eRqRmW5ulaqzKOn+zRn zzHuQJFZ8s/hek9KIxa5RIPUvIGWP88q6rVI/T8= X-Google-Smtp-Source: ABdhPJweUDEQAIj37lHpaY/pKaElQ4llEVq7B+sU9d/GYD8fpBAxLyQ0ySCaPiVOTvXJmReXvY06rfX8fKU+x6GHcps= X-Received: by 2002:ab0:3899:: with SMTP id z25mr9243634uav.139.1607441958349; Tue, 08 Dec 2020 07:39:18 -0800 (PST) MIME-Version: 1.0 References: <20201208114718.GA33199@x8.osted.lan> In-Reply-To: From: Kyle Evans Date: Tue, 8 Dec 2020 09:39:05 -0600 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: panic: general protection fault from uipc_sockaddr+0x4c To: Mark Johnston Cc: Peter Holm , current Content-Type: text/plain; charset="UTF-8" X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 15:39:19 -0000 On Tue, Dec 8, 2020 at 9:30 AM Mark Johnston wrote: > > On Tue, Dec 08, 2020 at 12:47:18PM +0100, Peter Holm wrote: > > I just got this panic: > > > > Fatal trap 9: general protection fault while in kernel mode > > cpuid = 9; apic id = 09 > > instruction pointer = 0x20:0xffffffff80bc6e22 > > stack pointer = 0x28:0xfffffe0698887630 > > frame pointer = 0x28:0xfffffe06988876b0 > > code segment = base 0x0, limit 0xfffff, type 0x1b > > = DPL 0, pres 1, long 1, def32 0, gran 1 > > processor eflags = interrupt enabled, resume, IOPL = 0 > > current process = 45966 (fstat) > > trap number = 9 > > panic: general protection fault > > cpuid = 9 > > time = 1607416693 > > KDB: stack backtrace: > > db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0698887340 > > vpanic() at vpanic+0x181/frame 0xfffffe0698887390 > > panic() at panic+0x43/frame 0xfffffe06988873f0 > > trap_fatal() at trap_fatal+0x387/frame 0xfffffe0698887450 > > trap() at trap+0xa4/frame 0xfffffe0698887560 > > calltrap() at calltrap+0x8/frame 0xfffffe0698887560 > > --- trap 0x9, rip = 0xffffffff80bc6e22, rsp = 0xfffffe0698887630, rbp = 0xfffffe06988876b0 --- > > __mtx_lock_sleep() at __mtx_lock_sleep+0xd2/frame 0xfffffe06988876b0 > > __mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe0698887700 > > uipc_sockaddr() at uipc_sockaddr+0x4c/frame 0xfffffe0698887730 > > soo_fill_kinfo() at soo_fill_kinfo+0x11e/frame 0xfffffe0698887770 > > kern_proc_filedesc_out() at kern_proc_filedesc_out+0xb57/frame 0xfffffe0698887810 > > sysctl_kern_proc_filedesc() at sysctl_kern_proc_filedesc+0x7d/frame 0xfffffe0698887890 > > sysctl_root_handler_locked() at sysctl_root_handler_locked+0x9c/frame 0xfffffe06988878e0 > > sysctl_root() at sysctl_root+0x20d/frame 0xfffffe0698887960 > > userland_sysctl() at userland_sysctl+0x180/frame 0xfffffe0698887a10 > > sys___sysctl() at sys___sysctl+0x5f/frame 0xfffffe0698887ac0 > > amd64_syscall() at amd64_syscall+0x147/frame 0xfffffe0698887bf0 > > fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0698887bf0 > > --- syscall (202, FreeBSD ELF64, sys___sysctl), rip = 0x8003948ea, rsp = 0x7fffffffc138, rbp = 0x7fffffffc170 --- > > > > https://people.freebsd.org/~pho/stress/log/log0004.txt > > So here the unpcb is freed, and indeed the file itself has been closed: > > $3 = {f_flag = 0x3, f_count = 0x0, f_data = 0x0, f_ops = 0xffffffff81901f50 , > f_vnode = 0x0, f_cred = 0xfffff80248beb600, f_type = 0x2, f_vnread_flags = 0x0, > {f_seqcount = {0x0, 0x0}, f_pipegen = 0x0}, f_nextoff = {0x0, 0x0}, > f_vnun = {fvn_cdevpriv = 0x0, fvn_advice = 0x0}, f_offset = 0x0} > > However, it must have happened very recently because soo_fill_kinfo() > dereferences fp->f_data and yet we did not panic due to a null > dereference. > > kern_proc_filedesc_out() holds the fdtable shared lock thoughout all of > this, which is supposed to prevent the table entry from being freed > since that requires the exclusive lock. > export_file_to_sb drops the lock without it or kern_proc_filedesc_out holding the file it's about to look at, though.