Bug #5473
closed
pf_test_state_tcp() crash
0%
Description
From ticket: MQC-14288
db:0:kdb.enter.default> bt
Tracing pid 12 tid 100070 td 0xfffff8000377b920
pf_test_state_tcp() at pf_test_state_tcp+0x1b7b/frame 0xfffffe0000287340
pf_test() at pf_test+0x1c96/frame 0xfffffe0000287670
pf_check_in() at pf_check_in+0x1d/frame 0xfffffe0000287690
pfil_run_hooks() at pfil_run_hooks+0x8d/frame 0xfffffe0000287720
ip_input() at ip_input+0x3d3/frame 0xfffffe0000287770
netisr_dispatch_src() at netisr_dispatch_src+0x62/frame 0xfffffe00002877e0
ether_demux() at ether_demux+0x149/frame 0xfffffe0000287810
ether_nh_input() at ether_nh_input+0x347/frame 0xfffffe0000287870
netisr_dispatch_src() at netisr_dispatch_src+0x62/frame 0xfffffe00002878e0
igb_rxeof() at igb_rxeof+0x698/frame 0xfffffe0000287990
igb_msix_que() at igb_msix_que+0x16d/frame 0xfffffe00002879e0
intr_event_execute_handlers() at intr_event_execute_handlers+0xab/frame 0xfffffe0000287a20
ithread_loop() at ithread_loop+0x96/frame 0xfffffe0000287a70
fork_exit() at fork_exit+0x9a/frame 0xfffffe0000287ab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0000287ab0
--- trap 0, rip = 0, rsp = 0xfffffe0000287b70, rbp = 0 ---
db:0:kdb.enter.default> ps
Fatal trap 12: page fault while in kernel mode
cpuid = 3; apic id = 03
fault virtual address = 0x0
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80d11f1b
stack pointer = 0x28:0xfffffe0000287170
frame pointer = 0x28:0xfffffe0000287340
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (irq276: igb1:que 3)
version.txt06000027512622372611 7621 ustarrootwheelFreeBSD 10.1-RELEASE-p23 #0 8151147(releng/10.1)-dirty: Fri Oct 30 05:16:16 CDT 2015
root@pfs22-amd64-builder:/usr/obj.RELENG_2_2.amd64/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10
Updated by Chris Buechler almost 10 years ago
- Category set to Operating System
- Affected Version changed from 2.2.5 to 2.2.x
Updated by Steve Wheeler over 9 years ago
Still a problem in 2.2.6 though the backtrace is slightly different:
db:0:kdb.enter.default> bt
Tracing pid 12 tid 100074 td 0xfffff80003780490
turnstile_broadcast() at turnstile_broadcast+0x8c/frame 0xfffffe000029b310
__mtx_unlock_sleep() at __mtx_unlock_sleep+0x60/frame 0xfffffe000029b340
pf_test() at pf_test+0x1501/frame 0xfffffe000029b670
pf_check_in() at pf_check_in+0x1d/frame 0xfffffe000029b690
pfil_run_hooks() at pfil_run_hooks+0x8d/frame 0xfffffe000029b720
ip_input() at ip_input+0x3d3/frame 0xfffffe000029b770
netisr_dispatch_src() at netisr_dispatch_src+0x62/frame 0xfffffe000029b7e0
ether_demux() at ether_demux+0x149/frame 0xfffffe000029b810
ether_nh_input() at ether_nh_input+0x347/frame 0xfffffe000029b870
netisr_dispatch_src() at netisr_dispatch_src+0x62/frame 0xfffffe000029b8e0
igb_rxeof() at igb_rxeof+0x698/frame 0xfffffe000029b990
igb_msix_que() at igb_msix_que+0x16d/frame 0xfffffe000029b9e0
intr_event_execute_handlers() at intr_event_execute_handlers+0xab/frame 0xfffffe000029ba20
ithread_loop() at ithread_loop+0x96/frame 0xfffffe000029ba70
fork_exit() at fork_exit+0x9a/frame 0xfffffe000029bab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe000029bab0
--- trap 0, rip = 0, rsp = 0xfffffe000029bb70, rbp = 0 ---
db:0:kdb.enter.default> ps
Fatal trap 12: page fault while in kernel mode
cpuid = 5; apic id = 05
fault virtual address = 0x20
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80b0e4ac
stack pointer = 0x28:0xfffffe000029b2e0
frame pointer = 0x28:0xfffffe000029b310
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = resume, IOPL = 0
current process = 12 (irq278: igb1:que 5)
version.txt06000027512643634106 7624 ustarrootwheelFreeBSD 10.1-RELEASE-p25 #0 c39b63e(releng/10.1)-dirty: Mon Dec 21 15:20:13 CST 2015
root@pfs22-amd64-builder:/usr/obj.RELENG_2_2.amd64/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10
Updated by
Updated by Luiz Souza over 7 years ago
- Status changed from New to Resolved
I'm closing this bug because I believe it was fixed already.
It was caused by a bug in interface queue use, which only affects the kernels built with ALTQ.