[Bug 259458] iflib_rxeof NULL pointer crash with vmxnet3 driver

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259458

            Bug ID: 259458
           Summary: iflib_rxeof NULL pointer crash with vmxnet3 driver
           Product: Base System
           Version: 12.2-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: avg@FreeBSD.org

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff809d4bad
stack pointer           = 0x28:0xfffffe00c85cba40
frame pointer           = 0x28:0xfffffe00c85cba40
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (if_io_tqg_0)
trap number             = 12
panic: page fault
cpuid = 0
time = 1634262163
KDB: stack backtrace:
 stack1 db_trace_self_wrapper+0x2b vpanic+0x182 panic+0x43 trap_fatal+0x391
trap_pfault+0x4f trap+0x286 calltrap+0x8
 stack2 memcpy_erms+0x1d _task_fn_rx+0x2b9 gtaskqueue_run_locked+0xed
gtaskqueue_thread_loop+0x7e fork_exit+0x6d fork_trampoline+0xe
KDB: enter: panic


#11 kdb_enter (why=0xffffffff80b17af9 "panic", msg=0xffffffff80b17af9 "panic")
at /usr/src/sys/kern/subr_kdb.c:486
#12 0xffffffff8073ddce in vpanic (fmt=<optimized out>, ap=<optimized out>) at
/usr/src/sys/kern/kern_shutdown.c:975
#13 0xffffffff8073dc23 in panic (fmt=0xffffffff81178120 <cnputs_mtx+24> "") at
/usr/src/sys/kern/kern_shutdown.c:909
#14 0xffffffff809d8b31 in trap_fatal (frame=0xfffffe00c85cb980, eva=0) at
/usr/src/sys/amd64/amd64/trap.c:921
#15 0xffffffff809d8b8f in trap_pfault (frame=0xfffffe00c85cb980,
usermode=<optimized out>, signo=<optimized out>, ucode=<optimized out>) at
/usr/src/sys/amd64/amd64/trap.c:739
#16 0xffffffff809d8256 in trap (frame=0xfffffe00c85cb980) at
/usr/src/sys/amd64/amd64/trap.c:405
#17 <signal handler called>
#18 memcpy_erms () at /usr/src/sys/amd64/amd64/support.S:577
#19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000,
ri=<optimized out>) at /usr/src/sys/net/iflib.c:2737
#20 iflib_rxeof (rxq=<optimized out>, budget=<optimized out>) at
/usr/src/sys/net/iflib.c:2879
#21 _task_fn_rx (context=<optimized out>) at /usr/src/sys/net/iflib.c:3868
#22 0xffffffff807808bd in gtaskqueue_run_locked (queue=0xfffff800020c7200) at
/usr/src/sys/kern/subr_gtaskqueue.c:362
#23 0xffffffff8078068e in gtaskqueue_thread_loop (arg=<optimized out>) at
/usr/src/sys/kern/subr_gtaskqueue.c:537
#24 0xffffffff8070792d in fork_exit (callout=0xffffffff80780610
<gtaskqueue_thread_loop>, arg=0xfffffe00007f8008, frame=0xfffffe00c85cbc00) at
/usr/src/sys/kern/kern_fork.c:108

-- 
You are receiving this mail because:
You are the assignee for the bug.