NULL pointer crash in iflib_rxd_pkt_get with vmxnet3
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 18 Oct 2021 10:48:18 UTC
This happened on FreeBSD 12.2 running as an ESXi guest with vmxnet3 network
interface.
Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff809d4bad
stack pointer = 0x28:0xfffffe00c85cba40
frame pointer = 0x28:0xfffffe00c85cba40
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 0 (if_io_tqg_0)
trap number = 12
panic: page fault
(kgdb) bt
#0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1 doadump (textdump=-933448896) at /usr/src/sys/kern/kern_shutdown.c:447
#2 0xffffffff8038f1cc in db_fncall_generic (addr=<optimized out>, nargs=0,
args=<optimized out>, rv=<optimized out>) at /usr/src/sys/ddb/db_command.c:622
#3 db_fncall (dummy1=<optimized out>, dummy2=<optimized out>, dummy3=<optimized
out>, dummy4=<optimized out>) at /usr/src/sys/ddb/db_command.c:670
#4 0xffffffff8038eaf6 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=0) at /usr/src/sys/ddb/db_command.c:494
#5 0xffffffff80393a68 in db_script_exec (scriptname=<optimized out>,
warnifnotfound=<optimized out>) at /usr/src/sys/ddb/db_script.c:304
#6 0xffffffff80393892 in db_script_kdbenter (eventname=<optimized out>) at
/usr/src/sys/ddb/db_script.c:326
#7 0xffffffff80391ac3 in db_trap (type=<optimized out>, code=<optimized out>)
at /usr/src/sys/ddb/db_main.c:251
#8 0xffffffff807821e2 in kdb_trap (type=3, code=0, tf=0xfffffe00c85cb630) at
/usr/src/sys/kern/subr_kdb.c:700
#9 0xffffffff809d870e in trap (frame=0xfffffe00c85cb630) at
/usr/src/sys/amd64/amd64/trap.c:583
#10 <signal handler called>
#11 kdb_enter (why=0xffffffff80b17af9 "panic", msg=0xffffffff80b17af9 "panic")
at /usr/src/sys/kern/subr_kdb.c:486
#12 0xffffffff8073ddce in vpanic (fmt=<optimized out>, ap=<optimized out>) at
/usr/src/sys/kern/kern_shutdown.c:975
#13 0xffffffff8073dc23 in panic (fmt=0xffffffff81178120 <cnputs_mtx+24> "") at
/usr/src/sys/kern/kern_shutdown.c:909
#14 0xffffffff809d8b31 in trap_fatal (frame=0xfffffe00c85cb980, eva=0) at
/usr/src/sys/amd64/amd64/trap.c:921
#15 0xffffffff809d8b8f in trap_pfault (frame=0xfffffe00c85cb980,
usermode=<optimized out>, signo=<optimized out>, ucode=<optimized out>) at
/usr/src/sys/amd64/amd64/trap.c:739
#16 0xffffffff809d8256 in trap (frame=0xfffffe00c85cb980) at
/usr/src/sys/amd64/amd64/trap.c:405
#17 <signal handler called>
#18 memcpy_erms () at /usr/src/sys/amd64/amd64/support.S:577
#19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000,
ri=<optimized out>) at /usr/src/sys/net/iflib.c:2737
#20 iflib_rxeof (rxq=<optimized out>, budget=<optimized out>) at
/usr/src/sys/net/iflib.c:2879
#21 _task_fn_rx (context=<optimized out>) at /usr/src/sys/net/iflib.c:3868
#22 0xffffffff807808bd in gtaskqueue_run_locked (queue=0xfffff800020c7200) at
/usr/src/sys/kern/subr_gtaskqueue.c:362
#23 0xffffffff8078068e in gtaskqueue_thread_loop (arg=<optimized out>) at
/usr/src/sys/kern/subr_gtaskqueue.c:537
#24 0xffffffff8070792d in fork_exit (callout=0xffffffff80780610
<gtaskqueue_thread_loop>, arg=0xfffffe00007f8008, frame=0xfffffe00c85cbc00) at
/usr/src/sys/kern/kern_fork.c:1088
#25 <signal handler called>
(kgdb) fr 19
#19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000,
ri=<optimized out>) at /usr/src/sys/net/iflib.c:2737
2737 /usr/src/sys/net/iflib.c: No such file or directory.
(kgdb) i loc
sd = {ifsd_cl = 0xfffff80002d61a38, ifsd_m = 0xfffff80002d62a38, ifsd_fl =
0xfffff80002d93400}
m = 0xfffff80123211c00
(kgdb) p m->m_data
$1 = (caddr_t) 0xfffff80123211c58 ""
(kgdb) p sd.ifsd_cl
$2 = (caddr_t *) 0xfffff80002d61a38
(kgdb) p *sd.ifsd_cl
$3 = (caddr_t) 0x0
Is this a known issue?
Is there a chance that this has already been fixed?
Thank you.
--
Andriy Gapon