[Bug 201879] panic: boot time panic with a scrub rule on "exclusive sleep mutex pf fragments"...

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=201879

            Bug ID: 201879
           Summary: panic: boot time panic with a scrub rule on "exclusive
                    sleep mutex pf fragments"...
           Product: Base System
           Version: 11.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: jason.unovitch at gmail.com

Created attachment 159222
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=159222&action=edit
Full boot dmesg

The last CURRENT that has been really solid for me has been from the first week
of June.  After resolving another issue, I was running into an intermittent
issue on a custom kernel with nooptions DDB and nooptions GDB.  In an attempt
to dig into this I compiled a GENERIC kernel since that has the IPSEC now,
which I use, along with having all the debugging on by default.

Here is what I saw intermittently before getting all the debug options.

Fatal double fault:
eip = 0xc0551912
esp = 0xeb594fec
ebp = 0xeb595148
cpuid = 0; apic id = 00
panic: double fault
cpuid = 0
KDB: stack backtrace:
#0 0xc0cfb64f at kdb_backtrace+0x4f
#1 0xc0cb0017 at vpanic+0x117
#2 0xc0cafefb at panic+0x1b

Here is what I see on the kernel with all the debug options. This was
consistently reproduced 4 times in a row at boot and on several attempt to see
just what pf.conf can trigger it.  The minimum case for reproduction for me is
"scrub on em3" in my pf.conf.  If I comment out the scrub rules I do not see
this panic at boot.

Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex pf fragments (pf fragments) r = 0 (0xc9fe7320) locked @
/usr/src/head/sys/modules/pf/../../netpfil/pf/pf_norm.c:237
KDB: stack backtrace:
db_trace_self_wrapper(c1538ae5,702f6670,6f6e5f66,632e6d72,3733323a,...) at
db_trace_self_wrapper+0x2a/frame 0xeb77d9a0
kdb_backtrace(c153ce71,0,c9fe7320,c9fe4bac,ed,...) at kdb_backtrace+0x2d/frame
0xeb77da08
witness_warn(5,0,c16ffb12,2,eb77dad8,...) at witness_warn+0x40f/frame
0xeb77da58
trap_pfault(deadc0de,c,c19607ac,eb77db04,c0c36f1e,...) at
trap_pfault+0x58/frame 0xeb77dad0
trap(eb77dc1c) at trap+0x6c1/frame 0xeb77dc10
calltrap() at calltrap+0x6/frame 0xeb77dc10
--- trap 0xc, eip = 0xc9fd504f, esp = 0xeb77dc5c, ebp = 0xeb77dc74 ---
pf_purge_expired_fragments(c9fe6f68,c9fe3a2a,5b8,c9fe3c60,1999997c,...) at
pf_purge_expired_fragments+0x4f/frame 0xeb77dc74
pf_purge_thread(0,eb77dce8,c152c5cd,3e6,0,...) at pf_purge_thread+0x15/frame
0xeb77dcac
fork_exit(c9fb7210,0,eb77dce8) at fork_exit+0x7e/frame 0xeb77dcd4
fork_trampoline() at fork_trampoline+0x8/frame 0xeb77dcd4
--- trap 0, eip = 0, esp = 0xeb77dd20, ebp = 0 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address    = 0xdeadc0de
fault code        = supervisor read, page not present
instruction pointer    = 0x20:0xc9fd504f
stack pointer            = 0x28:0xeb77dc5c
frame pointer            = 0x28:0xeb77dc74
code segment        = base 0x0, limit 0xfffff, type 0x1b
            = DPL 0, pres 1, def32 1, gran 1
processor eflags    = interrupt enabled, resume, IOPL = 0
current process        = 5319 (pf purge)
[ thread pid 5319 tid 100111 ]
Stopped at      pf_purge_expired_fragments+0x4f:        movl    0(%eax),%esi
db> bt
Tracing pid 5319 tid 100111 td 0xc7e66330
pf_purge_expired_fragments(c9fe6f68,c9fe3a2a,5b8,c9fe3c60,1999997c,...) at
pf_purge_expired_fragments+0x4f/frame 0xeb77dc74
pf_purge_thread(0,eb77dce8,c152c5cd,3e6,0,...) at pf_purge_thread+0x15/frame
0xeb77dcac
fork_exit(c9fb7210,0,eb77dce8) at fork_exit+0x7e/frame 0xeb77dcd4
fork_trampoline() at fork_trampoline+0x8/frame 0xeb77dcd4
--- trap 0, eip = 0, esp = 0xeb77dd20, ebp = 0 ---
>

-- 
You are receiving this mail because:
You are the assignee for the bug.