Re: panic in arptimer

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

Hi,

I've reproduced the panic on my machine and I'm investing
the problem.

Thank you for the report,
  ozaki-r

On Mon, Oct 19, 2015 at 4:10 PM, Takahiro Hayashi <t.hash425%gmail.com@localhost> wrote:
> Hello,
>
> Kernel panics in arptimer after detaching network interface.
> See dmesg below please.
> It happened on NetBSD/amd64 on GENERIC.201510182130Z from nyftp.
> I think this problem looks like kern/50186.
>
> How-To-Repeat:
> 1. Boot kernel into single user mode with "boot netbsd -s".
> 2. sysctl -w net.inet6.ip6.auto_linklocal=0
> 3. ifconfig interface <ipv4 address>.
> 4. Send one ping to other host.
> 5. Detach the interface with "drvctl -d".
> 6. Wait about 1200 seconds (actually 1200 sec after ping is sent).
>
>
> I saw following panic after detaching "re0".
>
> fatal page fault in supervisor mode
> trap type 6 code 0 rip ffffffff808cbf2f cs 8 rflags 10246 cr2
> ffff8000073c7368 ilevel 2 rsp fffffe80dabd1f08
> curlwp 0xfffffe81071a30c0 pid 0.22 lowest kstack 0xfffffe80dabce2c0
> kernel: page fault trap, code=0
> Stopped in pid 0.22 (system) at netbsd:arptimer+0xc4:   movq
> 360(%r15),%rdi
> db{1}> bt
> arptimer() at netbsd:arptimer+0xc4
> callout_softclock() at netbsd:callout_softclock+0x1d0
> softint_dispatch() at netbsd:softint_dispatch+0xd3
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe80dabd1ff0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> db{1}> show reg
> ds          1ee8
> es          4040
> fs          600
> gs          3d5e
> rdi         fffffe81078c8a00
> rsi         f8000000
> rbp         fffffe80dabd1f38
> rbx         fffffe81078c8908
> rdx         0
> rcx         7
> rax         fffffe81071a30c4
> r8          fffffe8107184040
> r9          7d
> r10         fffffe811eb244f4
> r11         246
> r12         fffffe81078c8a00
> r13         fffffe81078c89b0
> r14         0
> r15         ffff8000073c7008
> rip         ffffffff808cbf2f    arptimer+0xc4
> cs          8
> rflags      10246
> rsp         fffffe80dabd1f08
> ss          10
> netbsd:arptimer+0xc4:   movq    360(%r15),%rdi
> db{1}>
>
>
> I met folloging panic after "drvctl -d axe0".
>
> fatal page fault in supervisor mode
> trap type 6 code 2 rip ffffffff8011bcdd cs 8 rflags 10282 cr2 0 ilevel 2 rsp
> fffffe80dabd1f00
> curlwp 0xfffffe81071a30c0 pid 0.22 lowest kstack 0xfffffe80dabce2c0
> kernel: page fault trap, code=0
> Stopped in pid 0.22 (system) at netbsd:rw_enter+0x2d:   lock cmpxchgq
> %rcx,0(%
> rdi)
> db{1}> bt
> rw_enter() at netbsd:rw_enter+0x2d
> callout_softclock() at netbsd:callout_softclock+0x1d0
> softint_dispatch() at netbsd:softint_dispatch+0xd3
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe80dabd1ff0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> db{1}> show reg
> ds          1ee8
> es          0
> fs          fc00
> gs          3d5e
> rdi         0
> rsi         1
> rbp         fffffe80dabd1f38
> rbx         fffffe811dbc8188
> rdx         0
> rcx         fffffe81071a30c4
> rax         0
> r8          fffffe8107184040
> r9          7d
> r10         fffffe811eb244f4
> r11         246
> r12         fffffe811dbc8280
> r13         fffffe811dbc8230
> r14         0
> r15         fffffe811de0b010
> rip         ffffffff8011bcdd    rw_enter+0x2d
> cs          8
> rflags      10282
> rsp         fffffe80dabd1f00
> ss          10
> netbsd:rw_enter+0x2d:   lock cmpxchgq   %rcx,0(%rdi)
> db{1}>
>
>
> --
> t-hash