[Bug 208339] Early failure in ixl_attach causes kernel panic

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=208339

            Bug ID: 208339
           Summary: Early failure in ixl_attach causes kernel panic
           Product: Base System
           Version: 10.2-STABLE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: hibler at gmail.com
                CC: freebsd-amd64 at FreeBSD.org
                CC: freebsd-amd64 at FreeBSD.org

FreeBSD 10 Stable kernel with FreeBSD current dev/ixl driver gives:
----

ixl0: <Intel(R) Ethernet Connection XL710 Driver, Version - 1.4.3> mem
0x93000000-0x93ffffff,0x94018000-0x9401ffff irq 42 at device 0.0 on pci6
ixl0: Using MSIX interrupts with 9 vectors
ixl0: PF reset failure fffffff1


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x42
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff805be550
stack pointer           = 0x28:0xffffffff8424c0c0
frame pointer           = 0x28:0xffffffff8424c110
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (swapper)
trap number             = 12
panic: page fault
cpuid = 0
KDB: stack backtrace:
#0 0xffffffff809aa470 at kdb_backtrace+0x60
#1 0xffffffff8096d1c6 at vpanic+0x126
#2 0xffffffff8096d093 at panic+0x43
#3 0xffffffff80d71fcb at trap_fatal+0x36b
#4 0xffffffff80d722cd at trap_pfault+0x2ed
#5 0xffffffff80d7194a at trap+0x47a
#6 0xffffffff80d579a2 at calltrap+0x8
#7 0xffffffff805bf850 at ixl_attach+0xf00
#8 0xffffffff809a069d at device_attach+0x43d
#9 0xffffffff809a17dd at bus_generic_attach+0x2d
#10 0xffffffff80381c8c at acpi_pci_attach+0x15c
#11 0xffffffff809a069d at device_attach+0x43d
#12 0xffffffff809a17dd at bus_generic_attach+0x2d
#13 0xffffffff80383dbc at acpi_pcib_attach+0x22c
#14 0xffffffff8038501f at acpi_pcib_pci_attach+0x9f
#15 0xffffffff809a069d at device_attach+0x43d
#16 0xffffffff809a17dd at bus_generic_attach+0x2d
#17 0xffffffff80381c8c at acpi_pci_attach+0x15c
Uptime: 1s

----
The panic is actually in ixl_free_vsi because vsi->queues has not been
initialized.
Note that ANY early error prior to:
----

        /* Set up VSI and queues */
        if (ixl_setup_stations(pf) != 0) {
                device_printf(dev, "setup stations failed!\n");
                error = ENOMEM;
                goto err_mac_hmc;
        }

        /* Initialize mac filter list for VSI */
        SLIST_INIT(&vsi->ftl);

----
is going to cause this panic. I am aware of base r295946 but that does not fix
the problem.

The hack fix is:
----

*** if_ixl.c.orig       Sun Mar 27 12:17:28 2016
--- if_ixl.c    Sun Mar 27 11:41:43 2016
***************
*** 731,737 ****
        i40e_shutdown_adminq(hw);
  err_out:
        ixl_free_pci_resources(pf);
!       ixl_free_vsi(vsi);
        IXL_PF_LOCK_DESTROY(pf);
        return (error);
  }
--- 731,738 ----
        i40e_shutdown_adminq(hw);
  err_out:
        ixl_free_pci_resources(pf);
!       if (vsi->queues != NULL)
!               ixl_free_vsi(vsi);
        IXL_PF_LOCK_DESTROY(pf);
        return (error);
  }

-- 
You are receiving this mail because:
You are the assignee for the bug.