amd64/131310: 7.1 panics with mpd netgraph interface changes

[Vitaly Dodonov]

>Number:         131310
>Category:       amd64
>Synopsis:       7.1 panics with mpd netgraph interface changes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-amd64
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Feb 02 21:20:00 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Vitaly Dodonov
>Release:        7.1
>Organization:
>Environment:
FreeBSD d2s.local 7.1-RELEASE-p2 FreeBSD 7.1-RELEASE-p2 #15: Mon Feb  2 20:28:17 MSK 2009     d2 at d2s.local:/usr/obj/usr/src/sys/D2S  amd64

>Description:
One week after upgrade to 7.1 system begin panic on pptp/pppoe client connections

outgoing connections on fxp, incoming on lagg with re and msk in it

i don't have any special options in make.conf
kernel is 7.1 generic with netgraph pf altq options

kgdb kernel.debug /var/crash/vmcore.4
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:


Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x8:0xffffffff801999f5
stack pointer           = 0x10:0xffffffffdba588c0
frame pointer           = 0x10:0x0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 3275 (mpd5)
trap number             = 9
panic: general protection fault
cpuid = 0
Uptime: 2h55m3s
Physical memory: 4083 MB
Dumping 1235 MB: 1220 1204 1188 1172 1156 1140 1124 1108 1092 1076 1060 1044 1028 1012 996 980 964 948 932 916 900 884 868 852 836 820 804 788 772 756 740 724 708 692 676 660 644 628 612 596 580 564 548 532 516 500 484 468 452 436 420 404 388 372 356 340 324 308 292 276 260 244 228 212 196 180 164 148 132 116 100 84 68 52 36 20 4

Reading symbols from /boot/kernel/zfs.ko...Reading symbols from /boot/kernel/zfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/zfs.ko
Reading symbols from /boot/kernel/opensolaris.ko...Reading symbols from /boot/kernel/opensolaris.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/opensolaris.ko
Reading symbols from /boot/kernel/geom_journal.ko...Reading symbols from /boot/kernel/geom_journal.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/geom_journal.ko
Reading symbols from /boot/kernel/if_lagg.ko...Reading symbols from /boot/kernel/if_lagg.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/if_lagg.ko
Reading symbols from /boot/kernel/if_vlan.ko...Reading symbols from /boot/kernel/if_vlan.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/if_vlan.ko
Reading symbols from /boot/kernel/ng_tcpmss.ko...Reading symbols from /boot/kernel/ng_tcpmss.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ng_tcpmss.ko
#0  doadump () at pcpu.h:195
195             __asm __volatile("movq %%gs:0,%0" : "=r" (td));
(kgdb) backtrace
#0  doadump () at pcpu.h:195
#1  0x0000000000000004 in ?? ()
#2  0xffffffff802c7cd9 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#3  0xffffffff802c80e2 in panic (fmt=0x104 <Address 0x104 out of bounds>) at /usr/src/sys/kern/kern_shutdown.c:574
#4  0xffffffff80462de3 in trap_fatal (frame=0xffffff0011317000, eva=Variable "eva" is not available.) at /usr/src/sys/amd64/amd64/trap.c:764
#5  0xffffffff80463935 in trap (frame=0xffffffffdba58810) at /usr/src/sys/amd64/amd64/trap.c:565
#6  0xffffffff804492ee in calltrap () at /usr/src/sys/amd64/amd64/exception.S:209
#7  0xffffffff801999f5 in pfi_instance_add (ifp=0xffffff00064ef800, net=128, flags=0) at /usr/src/sys/contrib/pf/net/pf_if.c:578
#8  0xffffffff80199cde in pfi_table_update (kt=0xffffff0006819510, kif=Variable "kif" is not available.) at /usr/src/sys/contrib/pf/net/pf_if.c:561
#9  0xffffffff80199f27 in pfi_dynaddr_update (dyn=0xffffff000684dd20) at /usr/src/sys/contrib/pf/net/pf_if.c:543
#10 0xffffffff80199f7d in pfi_kif_update (kif=0xffffff0006002a00) at /usr/src/sys/contrib/pf/net/pf_if.c:520
#11 0xffffffff80199fac in pfi_kif_update (kif=0xffffff00065e9c00) at /usr/src/sys/contrib/pf/net/pf_if.c:525
#12 0xffffffff8019a568 in pfi_ifaddr_event (arg=0xffffff00064ef800, ifp=dwarf2_read_address: Corrupted DWARF expression.) at /usr/src/sys/contrib/pf/net/pf_if.c:942
#13 0xffffffff8039de7c in in_control (so=Variable "so" is not available.) at /usr/src/sys/netinet/in.c:476
#14 0xffffffff8036449f in ifioctl (so=0xffffff00069cc870, cmd=2149607705, data=0xffffff0006234080 "ng3", td=0xffffff0011317000) at /usr/src/sys/net/if.c:1952
#15 0xffffffff803009e4 in kern_ioctl (td=0xffffff0011317000, fd=27, com=2149607705, data=0xffffff0006234080 "ng3") at file.h:268
#16 0xffffffff80300cea in ioctl (td=0xffffff0011317000, uap=0xffffffffdba58bf0) at /usr/src/sys/kern/sys_generic.c:570
#17 0xffffffff80463437 in syscall (frame=0xffffffffdba58c80) at /usr/src/sys/amd64/amd64/trap.c:907
#18 0xffffffff804494fb in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:330
#19 0x000000080188137c in ?? ()
Previous frame inner to this frame (corrupt stack?)
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: