[Bug 197286] Panic in IPv6 stack - 0xc0d0b1fc is in ip6_input (/usr/src/sys/netinet6/ip6_input.c:702)

Tue Feb 3 02:27:04 UTC 2015

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197286

            Bug ID: 197286
           Summary: Panic in IPv6 stack - 0xc0d0b1fc is in ip6_input
                    (/usr/src/sys/netinet6/ip6_input.c:702)
           Product: Base System
           Version: 10.1-STABLE
          Hardware: i386
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: tdb at FreeBSD.org

Kernel panic (triggered by receiving an IPv6 ping!). Running stable/10 r277643.
System has a tun0 device controlled by ppp and a gif device tunnelled over that
connection for IPv6.

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0d0b1fc
stack pointer           = 0x28:0xdb570738
frame pointer           = 0x28:0xdb5708e0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 742 (ppp)
trap number             = 12
panic: page fault
cpuid = 0
KDB: stack backtrace:
#0 0xc0b5f3c2 at kdb_backtrace+0x52
#1 0xc0b20fcf at panic+0x11f
#2 0xc1027574 at trap_fatal+0x324
#3 0xc10278d5 at trap_pfault+0x355
#4 0xc1026f94 at trap+0x674
#5 0xc1011b8c at calltrap+0x6
#6 0xc0bf828b at netisr_dispatch_src+0x8b
#7 0xc0bf8600 at netisr_dispatch+0x20
#8 0xc0bf071e at gif_input+0x35e
#9 0xc0c4f781 at in_gif_input+0x51
#10 0xc0c4f5bf at in_gif_input10+0x2f
#11 0xc0c58420 at encap4_input+0x210
#12 0xc0c5c432 at ip_input+0x152
#13 0xc0bf828b at netisr_dispatch_src+0x8b
#14 0xc0bf8600 at netisr_dispatch+0x20
#15 0xc0bf4904 at tunwrite+0x254
#16 0xc09fe644 at devfs_write_f+0xb4
#17 0xc0b77776 at dofilewrite+0x86
Uptime: 37s
Physical memory: 491 MB
Dumping 65 MB: 50 34 18 2

Reading symbols from /boot/kernel/pf.ko.symbols...done.
Loaded symbols for /boot/kernel/pf.ko.symbols
Reading symbols from /boot/kernel/pflog.ko.symbols...done.
Loaded symbols for /boot/kernel/pflog.ko.symbols
Reading symbols from /boot/kernel/netgraph.ko.symbols...done.
Loaded symbols for /boot/kernel/netgraph.ko.symbols
Reading symbols from /boot/kernel/ng_ether.ko.symbols...done.
Loaded symbols for /boot/kernel/ng_ether.ko.symbols
Reading symbols from /boot/kernel/ng_pppoe.ko.symbols...done.
Loaded symbols for /boot/kernel/ng_pppoe.ko.symbols
Reading symbols from /boot/kernel/ng_socket.ko.symbols...done.
Loaded symbols for /boot/kernel/ng_socket.ko.symbols
#0  doadump (textdump=-999684992) at pcpu.h:233
233     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) list *0xc0d0b1fc
0xc0d0b1fc is in ip6_input (/usr/src/sys/netinet6/ip6_input.c:702).
697                     bad = 1;
698     #define sa_equal(a1, a2)                                               
\
699             (bcmp((a1), (a2), ((a1))->sin6_len) == 0)
700                     IF_ADDR_RLOCK(ifp);
701                     TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
702                             if (ifa->ifa_addr->sa_family !=
dst6.sin6_family)
703                                     continue;
704                             if (sa_equal(&dst6, ifa->ifa_addr))
705                                     break;
706                     }
Current language:  auto; currently minimal
(kgdb) backtrace
#0  doadump (textdump=-999684992) at pcpu.h:233
#1  0xc0b20c3d in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:452
#2  0xc0b2100d in panic (fmt=<value optimized out>) at
/usr/src/sys/kern/kern_shutdown.c:759
#3  0xc1027574 in trap_fatal (frame=<value optimized out>, eva=<value optimized
out>) at /usr/src/sys/i386/i386/trap.c:1023
#4  0xc10278d5 in trap_pfault (frame=0x0, usermode=<value optimized out>,
eva=0) at /usr/src/sys/i386/i386/trap.c:835
#5  0xc1026f94 in trap (frame=0xdb5706f8) at /usr/src/sys/i386/i386/trap.c:532
#6  0xc1011b8c in calltrap () at /usr/src/sys/i386/i386/exception.s:170
#7  0xc0d0b1fc in ip6_input (m=0xc4571830) at
/usr/src/sys/netinet6/ip6_input.c:702
#8  0xc0bf828b in netisr_dispatch_src (proto=<value optimized out>,
source=<value optimized out>, m=0x0) at /usr/src/sys/net/netisr.c:972
#9  0xc0bf8600 in netisr_dispatch (proto=10, m=0xc4ae3a00) at
/usr/src/sys/net/netisr.c:1063
#10 0xc0bf071e in gif_input (m=0xc4ae3a00, ifp=0xc52d2800, proto=<value
optimized out>, ecn=12 '\f') at /usr/src/sys/net/if_gif.c:693
#11 0xc0c4f781 in in_gif_input (mp=0xdb5709ac, offp=<value optimized out>) at
/usr/src/sys/netinet/in_gif.c:166
#12 0xc0c4f5bf in in_gif_input10 (m=0xc4ae3a00, off=20) at
/usr/src/sys/netinet/in_gif.c:143
#13 0xc0c58420 in encap4_input (m=0xc4ae3a00) at
/usr/src/sys/netinet/ip_encap.c:191
#14 0xc0c5c432 in ip_input (m=0xc4ae3a00) at
/usr/src/sys/netinet/ip_input.c:734
#15 0xc0bf828b in netisr_dispatch_src (proto=<value optimized out>,
source=<value optimized out>, m=0x0) at /usr/src/sys/net/netisr.c:972
#16 0xc0bf8600 in netisr_dispatch (proto=1, m=0xc4ae3a00) at
/usr/src/sys/net/netisr.c:1063
#17 0xc0bf4904 in tunwrite (dev=0xc4b5e700, uio=<value optimized out>, flag=0)
at /usr/src/sys/net/if_tun.c:926
#18 0xc09fe644 in devfs_write_f (fp=<value optimized out>, uio=0xdb570be8,
flags=<value optimized out>, td=<value optimized out>) at
/usr/src/sys/fs/devfs/devfs_vnops.c:1678
#19 0xc0b77776 in dofilewrite (td=0xc52cc930, fd=6, fp=0xc4be9498,
auio=0xdb570be8, offset=-1, flags=0) at file.h:304
#20 0xc0b77476 in kern_writev (td=0xc52cc930, fd=6, auio=<value optimized out>)
at /usr/src/sys/kern/sys_generic.c:481
#21 0xc0b773cc in sys_write (td=<value optimized out>, uap=<value optimized
out>) at /usr/src/sys/kern/sys_generic.c:396
#22 0xc1028036 in syscall (frame=<value optimized out>) at subr_syscall.c:134
#23 0xc1011c21 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:270
#24 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb)

Bug is reproducible and I have the kernel dump available.

-- 
You are receiving this mail because:
You are the assignee for the bug.