[Bug 246951] carp(4): Active CARP member crashes: panic, trap_pfault, ip_input || ip_output when using ipSec, AES-NI (on Intel I350)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=246951

--- Comment #10 from Mark Johnston <markj at FreeBSD.org> ---
(In reply to freebsd-bugzilla from comment #9)
So from the panic sites it looks like a linked ifaddr structure has been freed.
 (Or zeroed, but I cannot see any code which does that.)  One possible cause
that we can try to rule out is a refcount overflow.  You said that the uptime
between panics is at least several days - is that consistently the case?  In
other words, have you ever seen back-to-back crashes in a short timeframe?

I'm not sure if pfsense enables DTrace, but if so we can try to probe
ifa_ref(), which is helpfully not inlined.  Please try this command (you might
need to kldload dtraceall first):

# dtrace -n 'fbt::ifa_ref:entry {@[args[0]->ifa_refcnt] = count();} tick-300s
{exit(0);}'

It will sleep for 300s and dump a table of reference counts.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.