From nobody Mon Oct 18 10:48:18 2021 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 1FDF217F6C1E for ; Mon, 18 Oct 2021 10:48:22 +0000 (UTC) (envelope-from avg@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HXtrk0StVz3FYl for ; Mon, 18 Oct 2021 10:48:22 +0000 (UTC) (envelope-from avg@FreeBSD.org) Received: from [192.168.0.88] (unknown [195.64.148.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) (Authenticated sender: avg/mail) by smtp.freebsd.org (Postfix) with ESMTPSA id A51A62037D for ; Mon, 18 Oct 2021 10:48:21 +0000 (UTC) (envelope-from avg@FreeBSD.org) To: "net@FreeBSD.org" From: Andriy Gapon Subject: NULL pointer crash in iflib_rxd_pkt_get with vmxnet3 Message-ID: <8ff3f608-b66d-698d-027c-1965b366794a@FreeBSD.org> Date: Mon, 18 Oct 2021 13:48:18 +0300 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:78.0) Gecko/20100101 Firefox/78.0 Thunderbird/78.14.0 List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-ThisMailContainsUnwantedMimeParts: N This happened on FreeBSD 12.2 running as an ESXi guest with vmxnet3 network interface. Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0x0 fault code = supervisor read data, page not present instruction pointer = 0x20:0xffffffff809d4bad stack pointer = 0x28:0xfffffe00c85cba40 frame pointer = 0x28:0xfffffe00c85cba40 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 0 (if_io_tqg_0) trap number = 12 panic: page fault (kgdb) bt #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55 #1 doadump (textdump=-933448896) at /usr/src/sys/kern/kern_shutdown.c:447 #2 0xffffffff8038f1cc in db_fncall_generic (addr=, nargs=0, args=, rv=) at /usr/src/sys/ddb/db_command.c:622 #3 db_fncall (dummy1=, dummy2=, dummy3=, dummy4=) at /usr/src/sys/ddb/db_command.c:670 #4 0xffffffff8038eaf6 in db_command (last_cmdp=, cmd_table=, dopager=0) at /usr/src/sys/ddb/db_command.c:494 #5 0xffffffff80393a68 in db_script_exec (scriptname=, warnifnotfound=) at /usr/src/sys/ddb/db_script.c:304 #6 0xffffffff80393892 in db_script_kdbenter (eventname=) at /usr/src/sys/ddb/db_script.c:326 #7 0xffffffff80391ac3 in db_trap (type=, code=) at /usr/src/sys/ddb/db_main.c:251 #8 0xffffffff807821e2 in kdb_trap (type=3, code=0, tf=0xfffffe00c85cb630) at /usr/src/sys/kern/subr_kdb.c:700 #9 0xffffffff809d870e in trap (frame=0xfffffe00c85cb630) at /usr/src/sys/amd64/amd64/trap.c:583 #10 #11 kdb_enter (why=0xffffffff80b17af9 "panic", msg=0xffffffff80b17af9 "panic") at /usr/src/sys/kern/subr_kdb.c:486 #12 0xffffffff8073ddce in vpanic (fmt=, ap=) at /usr/src/sys/kern/kern_shutdown.c:975 #13 0xffffffff8073dc23 in panic (fmt=0xffffffff81178120 "") at /usr/src/sys/kern/kern_shutdown.c:909 #14 0xffffffff809d8b31 in trap_fatal (frame=0xfffffe00c85cb980, eva=0) at /usr/src/sys/amd64/amd64/trap.c:921 #15 0xffffffff809d8b8f in trap_pfault (frame=0xfffffe00c85cb980, usermode=, signo=, ucode=) at /usr/src/sys/amd64/amd64/trap.c:739 #16 0xffffffff809d8256 in trap (frame=0xfffffe00c85cb980) at /usr/src/sys/amd64/amd64/trap.c:405 #17 #18 memcpy_erms () at /usr/src/sys/amd64/amd64/support.S:577 #19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000, ri=) at /usr/src/sys/net/iflib.c:2737 #20 iflib_rxeof (rxq=, budget=) at /usr/src/sys/net/iflib.c:2879 #21 _task_fn_rx (context=) at /usr/src/sys/net/iflib.c:3868 #22 0xffffffff807808bd in gtaskqueue_run_locked (queue=0xfffff800020c7200) at /usr/src/sys/kern/subr_gtaskqueue.c:362 #23 0xffffffff8078068e in gtaskqueue_thread_loop (arg=) at /usr/src/sys/kern/subr_gtaskqueue.c:537 #24 0xffffffff8070792d in fork_exit (callout=0xffffffff80780610 , arg=0xfffffe00007f8008, frame=0xfffffe00c85cbc00) at /usr/src/sys/kern/kern_fork.c:1088 #25 (kgdb) fr 19 #19 0xffffffff8084d049 in iflib_rxd_pkt_get (rxq=0xfffffe00ea9f5000, ri=) at /usr/src/sys/net/iflib.c:2737 2737 /usr/src/sys/net/iflib.c: No such file or directory. (kgdb) i loc sd = {ifsd_cl = 0xfffff80002d61a38, ifsd_m = 0xfffff80002d62a38, ifsd_fl = 0xfffff80002d93400} m = 0xfffff80123211c00 (kgdb) p m->m_data $1 = (caddr_t) 0xfffff80123211c58 "" (kgdb) p sd.ifsd_cl $2 = (caddr_t *) 0xfffff80002d61a38 (kgdb) p *sd.ifsd_cl $3 = (caddr_t) 0x0 Is this a known issue? Is there a chance that this has already been fixed? Thank you. -- Andriy Gapon