misc/172963: Kernel panic in udp_input()

[Vincent Miller]

>Number:         172963
>Category:       misc
>Synopsis:       Kernel panic in udp_input()
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Oct 22 17:40:00 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator:     Vincent Miller
>Release:        8.3-RELEASE-p4
>Organization:
>Environment:
FreeBSD flumpe15-qa2 8.3-RELEASE-p4 FreeBSD 8.3-RELEASE-p4 #0: Wed Sep  5 09:11:22 UTC 2012     root at bsdr620:/usr/obj/usr/src/sys/GENERIC  amd64
>Description:
There appears to be a panic/freezing condition in FreeBSD 8.3-RELEASE-p4 in udp_input().  Please reference the panic trace below.  The condition is very similar to the issues discussed in a mail thread at http://lists.freebsd.org/pipermail/freebsd-net/2011-November/030408.html.  We have been unable to get reliable crash dumps from this panic.

Fatal trap 12: page fault while in kernel mode
cpuid = 4; apic id = 08
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff807a08a2
stack pointer           = 0x28:0xffffffa40c2689b0
frame pointer           = 0x28:0xffffffa40c268a80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (swi1: netisr 0)
trap number             = 12
panic: page fault
cpuid = 4
KDB: stack backtrace:
#0 0xffffffff80642b3e at kdb_backtrace+0x5e
#1 0xffffffff8060fd57 at panic+0x187
#2 0xffffffff80905990 at trap_fatal+0x290
#3 0xffffffff80905ce1 at trap_pfault+0x201
kernel trap 12 with interrupts disabled
#4 0xffffffff8090619f at trap+0x3df


#5 0xffffffff808ed674 at calltrap+0x8


#6 0xffffffff8072000c at ip_input+0xac
Fatal trap 12: page fault while in kernel mode
cpuid = 5; apic id = 0a
#7 0xffffffff806cba29 at swi_net+0x149
fault virtual address   = 0xc
#8 0xffffffff805e7794 at intr_event_execute_handlers+0x104
fault code              = supervisor read data, page not present
#9 0xffffffff805e8e25 at ithread_loop+0x95
instruction pointer     = 0x20:0xffffffff8064f795
#10 0xffffffff805e49af at fork_exit+0x11f
stack pointer           = 0x28:0xffffffa41cd969a0
#11 0xffffffff808edbbe at fork_trampoline+0xe
frame pointer           = 0x28:0xffffffa41cd969d0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = resume, IOPL = 0
current process         = 8 (pagedaemon)
trap number             = 12
>How-To-Repeat:
We have been able to produce roughly 1 panic per day applying load to 16 hosts.  It is reproducible under heavy UDP load against systems running a UDP service.
>Fix:
N/A

>Release-Note:
>Audit-Trail:
>Unformatted: