Re: panic in wqinput_input

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

On Wed, May 3, 2017 at 4:16 PM, Thomas Klausner <tk%giga.or.at@localhost> wrote:
> Hi!
>
> Last night my 7.99.67/amd64 rebooted after this panic:
>
> fatal page fault in supervisor mode
> trap type 6 code 0x2 rip 0xffffffff80a815b6 cs 0x8 rflags 0x10286 cr2 0 ilevel 0x4 rsp 0xfffffe813a414dc0
> curlwp 0xfffffe882df26420 pid 0.3 lowest kstack 0xfffffe813a4112c0
> panic: trap
> cpu0: Begin traceback...
> vpanic() at netbsd:vpanic+0x140
> snprintf() at netbsd:snprintf
> trap() at netbsd:trap+0xc6b
> --- trap (number 6) ---
> wqinput_input() at netbsd:wqinput_input+0x43
> icmp6_input() at netbsd:icmp6_input+0x17
> ip6_input() at netbsd:ip6_input+0x6cb
> ip6intr() at netbsd:ip6intr+0x71
> softint_dispatch() at netbsd:softint_dispatch+0xd3
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe813a414ff0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> cpu0: End traceback...
>
> It probably was under high memory load, so it could be an
> out-of-memory situation.
>
> Crash dump is available.
>  Thomas

I think the below diff fixes the panic.

Could you confirm that the variable "work" was NULL by
inspecting the crash dump?

Thanks,
  ozaki-r

diff --git a/sys/netinet/wqinput.c b/sys/netinet/wqinput.c
index 08cd3c64f17..770317a9917 100644
--- a/sys/netinet/wqinput.c
+++ b/sys/netinet/wqinput.c
@@ -249,6 +249,11 @@ wqinput_input(struct wqinput *wqi, struct mbuf
*m, int off, int proto)
        }

        work = pool_get(&wqi->wqi_work_pool, PR_NOWAIT);
+       if (work == NULL) {
+               wwl->wwl_dropped++;
+               m_freem(m);
+               goto out;
+       }
        work->ww_mbuf = m;
        work->ww_off = off;
        work->ww_proto = proto;