7.2 Stable Crash - possibly related to if_re

[Pyun YongHyeon]

On Fri, Oct 30, 2009 at 06:23:51PM -0700, Norbert Papke wrote:
> On October 30, 2009, Pyun YongHyeon wrote:
> > On Thu, Oct 29, 2009 at 09:56:19PM -0700, Norbert Papke wrote:
> > > This occurred shortly after "scp"ing from a VirtualBox VM to the host. 
> > > The file transfer got stuck.  The "re" interface stopped working. 
> > > Shortly afterwards, the host crashed.  The "re" interface was used by the
> > > host, the guest was using a different NIC in bridged mode.
> > >
> > >
> > > FreeBSD proven.lan 7.2-STABLE FreeBSD 7.2-STABLE #5 r198666: Thu Oct 29
> > > 18:36:57 PDT 2009
> > >
> > > Fatal trap 12: page fault while in kernel mode
> > > cpuid = 0; apic id = 00
> > > fault virtual address   = 0x18
> >
> > It looks like a NULL pointer dereference, possibly mbuf related
> > one.
> >
> > > fault code              = supervisor write data, page not present
> > > instruction pointer     = 0x8:0xffffffff80d476ee
> > > stack pointer           = 0x10:0xffffff8000078ae0
> > > frame pointer           = 0x10:0xffffff8000078b40
> > > code segment            = base 0x0, limit 0xfffff, type 0x1b
> > >                         = DPL 0, pres 1, long 1, def32 0, gran 1
> > > processor eflags        = interrupt enabled, resume, IOPL = 0
> > > current process         = 18 (swi5: +)
> > > Physical memory: 8177 MB
> > >
> > >
> 
> > > #9  0xffffffff807e710e in calltrap ()
> > > at /usr/public/freebsd/sources/stable/sys/amd64/amd64/exception.S:218
> > > #10 0xffffffff80d476ee in re_rxeof () from /boot/kernel/if_re.ko
> >
> > Hmm, I think there is a missing information here. Not sure where it
> > dereferenced a NULL pointer in re_rxeof(). 
> 
> >> #11 0xffffffff80d4a481 in re_int_task (arg=Variable "arg" is not available.
> >> ) 
> >> 
> at /usr/public/freebsd/sources/stable/sys/modules/re/../../dev/re/if_re.c:2191  
> 
> I am not sure how much I trust frame 10.  The instruction 
> at "0xffffffff80d476ee" is the one after the "retq" from re_rxeof().  Frame 
> 11 seems OK to me.  The "struct rl_softc*", in particular, looks plausible 
> but I don't know enough to say for sure.
> 
> > Because that this is the 
> > first report for NULL pointer dereference in Rx handler I need more
> > information how to reproduce it with minimal configuration. Can you
> > also reproduce the issues without virtual box?
> 
> I am trying but no luck so far.
> 
> > By chance, did you stop the re0 interface with ifconfig when you
> > noticed the file transfer got stuck?
> 
> It is possible.  I had it happen twice.  The first time I definitely tried 
> to "down" re.  I cannot recall what I did the second time.  The crash dump is 
> from the second time.
> 

Ok, then would you try attached patch?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: re.rxeof.patch
Type: text/x-diff
Size: 469 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20091031/00d3e348/re.rxeof.bin