[Bug 272966] armv7 Kernel page fault with non-sleepable locks held panic during in6ifa_ifwithaddr for kyua's sys/netpfil/pf/killstate:v6; more tests too
Date: Sun, 06 Aug 2023 06:37:13 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=272966
Mark Millard <marklmi26-fbsd@yahoo.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|armv7 Kernel page fault |armv7 Kernel page fault
|with non-sleepable locks |with non-sleepable locks
|held panic during |held panic during
|in6ifa_ifwithaddr for |in6ifa_ifwithaddr for
|kyua's |kyua's
|sys/netpfil/pf/killstate:v6 |sys/netpfil/pf/killstate:v6
| |; more tests too
--- Comment #1 from Mark Millard <marklmi26-fbsd@yahoo.com> ---
Another test that gets such:
# /usr/bin/kyua test -k /usr/tests/Kyuafile sys/netpfil/pf/modulate:modulate_v6
sys/netpfil/pf/modulate:modulate_v6 -> Aug 6 06:34:37 generic kernel:
nd6_dad_timer: called with non-tentative address
fe80:3::91:a4ff:fef4:460a(epair0a)
Kernel page fault with the following non-sleepable locks held:
shared rm in6_ifaddr_lock (in6_ifaddr_lock) r = 0 (0xc0b5acd0) locked @
/usr/src/sys/netinet6/in6.c:1620
stack backtrace:
#0 0xc035e060 at witness_debugger+0x74
#1 0xc035f2ec at witness_warn+0x41c
#2 0xc0610b58 at abort_handler+0x1d8
#3 0xc05ef6ac at exception_exit+0
#4 0xc04986b4 at in6ifa_ifwithaddr+0x40
#5 0xc04aa060 at ip6_input+0xd38
#6 0xc04235bc at netisr_dispatch_src+0x100
#7 0xc041a384 at ether_demux+0x1bc
#8 0xc041bb68 at ether_nh_input+0x3dc
#9 0xc04235bc at netisr_dispatch_src+0x100
#10 0xc041a808 at ether_input+0xec
#11 0xe173810c at $a.10+0xbc
#12 0xc03504dc at taskqueue_run_locked+0xb8
#13 0xc0351560 at taskqueue_thread_loop+0x108
#14 0xc02a384c at fork_exit+0xa0
#15 0xc05ef640 at swi_exit+0
Fatal kernel mode data abort: 'Alignment Fault' on read
trapframe: 0xe108aae8
FSR=00000001, FAR=e0311576, spsr=00000013
r0 =e0722000, r1 =00000001, r2 =ffffffff, r3 =c0b285d8
r4 =00000000, r5 =00000000, r6 =e0311576, r7 =e0311566
r8 =c0918b04, r9 =00000000, r10=db785000, r11=e108aba8
r12=00000000, ssp=e108ab78, slr=c02e1790, pc =c04986b4
panic: Fatal abort
cpuid = 2
time = 1691303689
KDB: stack backtrace:
db_trace_self() at db_trace_self
pc = 0xc05ecde4 lr = 0xc0079c70 (db_trace_self_wrapper+0x30)
sp = 0xe108a8c0 fp = 0xe108a9d8
db_trace_self_wrapper() at db_trace_self_wrapper+0x30
pc = 0xc0079c70 lr = 0xc02e99a0 (vpanic+0x140)
sp = 0xe108a9e0 fp = 0xe108aa00
r4 = 0x00000100 r5 = 0x00000000
r6 = 0xc07597e2 r7 = 0xc0aeaec8
vpanic() at vpanic+0x140
pc = 0xc02e99a0 lr = 0xc02e9780 (doadump)
sp = 0xe108aa08 fp = 0xe108aa0c
r4 = 0xe108aae8 r5 = 0x00000013
r6 = 0xe0311576 r7 = 0x00000001
r8 = 0x00000001 r9 = 0xe0722000
r10 = 0xe0311576
doadump() at doadump
pc = 0xc02e9780 lr = 0xc0611184 (abort_align)
sp = 0xe108aa14 fp = 0xe108aa40
r4 = 0xe0311576 r5 = 0xe108aa0c
r6 = 0xc02e9780 r10 = 0xe108aa14
abort_align() at abort_align
pc = 0xc0611184 lr = 0xc0610c9c (abort_handler+0x31c)
sp = 0xe108aa48 fp = 0xe108aae0
r4 = 0x00000013 r10 = 0xe0311576
abort_handler() at abort_handler+0x31c
pc = 0xc0610c9c lr = 0xc05ef6ac (exception_exit)
sp = 0xe108aae8 fp = 0xe108aba8
r4 = 0x00000000 r5 = 0x00000000
r6 = 0xe0311576 r7 = 0xe0311566
r8 = 0xc0918b04 r9 = 0x00000000
r10 = 0xdb785000
exception_exit() at exception_exit
pc = 0xc05ef6ac lr = 0xc02e1790 (_rm_rlock_debug+0x190)
sp = 0xe108ab78 fp = 0xe108aba8
r0 = 0xe0722000 r1 = 0x00000001
r2 = 0xffffffff r3 = 0xc0b285d8
r4 = 0x00000000 r5 = 0x00000000
r6 = 0xe0311576 r7 = 0xe0311566
r8 = 0xc0918b04 r9 = 0x00000000
r10 = 0xdb785000 r12 = 0x00000000
in6ifa_ifwithaddr() at in6ifa_ifwithaddr+0x40
pc = 0xc04986b4 lr = 0xc04aa060 (ip6_input+0xd38)
sp = 0xe108abb0 fp = 0xe108ac70
r4 = 0xe0311576 r5 = 0xe031155e
r6 = 0x00000000 r7 = 0xe0311566
ip6_input() at ip6_input+0xd38
pc = 0xc04aa060 lr = 0xc04235bc (netisr_dispatch_src+0x100)
sp = 0xe108ac78 fp = 0xe108aca0
r4 = 0x0000001a r5 = 0xe0311500
r6 = 0x00000000 r7 = 0xc0b5a398
r8 = 0x000000dd r9 = 0xc57f7a40
r10 = 0x00000086
netisr_dispatch_src() at netisr_dispatch_src+0x100
pc = 0xc04235bc lr = 0xc041a384 (ether_demux+0x1bc)
sp = 0xe108aca8 fp = 0xe108acc0
r4 = 0xe0311500 r5 = 0x00000006
r6 = 0xdb785000 r7 = 0x5e4a6f28
r8 = 0x000000dd r9 = 0xc57f7a40
r10 = 0x00000086
ether_demux() at ether_demux+0x1bc
pc = 0xc041a384 lr = 0xc041bb68 (ether_nh_input+0x3dc)
sp = 0xe108acc8 fp = 0xe108acf0
r4 = 0xdb785000 r5 = 0xe0311500
r6 = 0xe0311550 r10 = 0x00000086
ether_nh_input() at ether_nh_input+0x3dc
pc = 0xc041bb68 lr = 0xc04235bc (netisr_dispatch_src+0x100)
sp = 0xe108acf8 fp = 0xe108ad20
r4 = 0x00000048 r5 = 0xe0311500
r6 = 0x00000000 r7 = 0xc0b5a378
r8 = 0x5e4a6f28 r9 = 0xc57f7a40
r10 = 0x00000000
netisr_dispatch_src() at netisr_dispatch_src+0x100
pc = 0xc04235bc lr = 0xc041a808 (ether_input+0xec)
sp = 0xe108ad28 fp = 0xe108ad60
r4 = 0xdb785000 r5 = 0x00000000
r6 = 0xe0311500 r7 = 0x00000000
r8 = 0x5e4a6f28 r9 = 0xc57f7a40
r10 = 0x00000000
ether_input() at ether_input+0xec
pc = 0xc041a808 lr = 0xe173810c ($a.10+0xbc)
sp = 0xe108ad68 fp = 0xe108ad90
r4 = 0xdb785000 r5 = 0xe02dc040
r6 = 0x00000000 r7 = 0xe0311500
r8 = 0xe17274d3 r9 = 0xe02dc050
r10 = 0x00000000
$a.10() at $a.10+0xbc
pc = 0xe173810c lr = 0xc03504dc (taskqueue_run_locked+0xb8)
sp = 0xe108ad98 fp = 0xe108ade0
r4 = 0xe02dfc00 r5 = 0xe02dfc50
r6 = 0xe02dc06c r7 = 0x00000001
r8 = 0x00000001 r9 = 0xc0768ff7
r10 = 0x00000000
taskqueue_run_locked() at taskqueue_run_locked+0xb8
pc = 0xc03504dc lr = 0xc0351560 (taskqueue_thread_loop+0x108)
sp = 0xe108ade8 fp = 0xe108ae18
r4 = 0x00000000 r5 = 0xe02dfc00
r6 = 0xe02dfc40 r7 = 0xc073cb53
r8 = 0xe02dfc50 r9 = 0x00000100
r10 = 0xc0afde44
taskqueue_thread_loop() at taskqueue_thread_loop+0x108
pc = 0xc0351560 lr = 0xc02a384c (fork_exit+0xa0)
sp = 0xe108ae20 fp = 0xe108ae38
r4 = 0xe0722000 r5 = 0xc0ada560
r6 = 0xc0351458 r7 = 0xe1748f94
r8 = 0xe108ae40 r9 = 0xc0afab7c
fork_exit() at fork_exit+0xa0
pc = 0xc02a384c lr = 0xc05ef640 (swi_exit)
sp = 0xe108ae40 fp = 0x00000000
r4 = 0xc0351458 r5 = 0xe1748f94
r6 = 0xc0942429 r7 = 0xc72f21d0
r8 = 0xc0ada900 r10 = 0xc0afde44
swi_exit() at swi_exit
pc = 0xc05ef640 lr = 0xc05ef640 (swi_exit)
sp = 0xe108ae40 fp = 0x00000000
KDB: enter: panic
[ thread pid 0 tid 100261 ]
--
You are receiving this mail because:
You are the assignee for the bug.