Re: kern/51522

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

The following reply was made to PR kern/51522; it has been noted by GNATS.

From: Ryota Ozaki <ozaki-r%netbsd.org@localhost>
To: "gnats-bugs%NetBSD.org@localhost" <gnats-bugs%netbsd.org@localhost>
Cc: kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Subject: Re: kern/51522
Date: Sat, 29 Oct 2016 16:24:18 +0900

 On Thu, Oct 27, 2016 at 11:15 PM, Tom Ivar Helbekkmo
 <tih%hamartun.priv.no@localhost> wrote:
 > The following reply was made to PR kern/51522; it has been noted by GNATS.
 >
 > From: Tom Ivar Helbekkmo <tih%hamartun.priv.no@localhost>
 > To: gnats-bugs%netbsd.org@localhost
 > Cc:
 > Subject: Re: kern/51522
 > Date: Thu, 27 Oct 2016 16:10:51 +0200
 >
 >  After more than a week, I finally had another crash, but this is
 >  probably something different...?
 
 I guess so...
 
 BTW if you revert the change for mbuf debugging, the panic
 due to a double free happens again? I worry that
 the debugging code may hide the issue.
 
   ozaki-r
 
 >
 >  dmesg:
 >
 >  uvm_fault(0xffffffff81303840, 0x0, 1) -> e
 >  fatal page fault in supervisor mode
 >  trap type 6 code 0 rip ffffffff806401c3 cs 8 rflags 10246 cr2 78 ilevel 4 rsp fffffe8100514e68
 >  curlwp 0xfffffe8100602220 pid 0.67 lowest kstack 0xfffffe81005112c0
 >  panic: trap
 >  cpu2: Begin traceback...
 >  vpanic() at netbsd:vpanic+0x140
 >  snprintf() at netbsd:snprintf
 >  trap() at netbsd:trap+0xc4b
 >  --- trap (number 6) ---
 >  pf_state_tree_ext_gwy_RB_REMOVE_COLOR() at netbsd:pf_state_tree_ext_gwy_RB_REMOVE_COLOR+0xcf
 >  pf_state_tree_ext_gwy_RB_REMOVE() at netbsd:pf_state_tree_ext_gwy_RB_REMOVE+0xca
 >  pf_detach_state() at netbsd:pf_detach_state+0x8b
 >  pf_purge_expired_states() at netbsd:pf_purge_expired_states+0x73
 >  pf_purge_thread() at netbsd:pf_purge_thread+0x69
 >  cpu2: End traceback...
 >
 >  backtrace:
 >
 >  0xffffffff80119ab5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
 >      at /usr/src/sys/arch/amd64/amd64/machdep.c:676
 >  676                     dumpsys();
 >  (gdb) bt
 >  #0  0xffffffff80119ab5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
 >      at /usr/src/sys/arch/amd64/amd64/machdep.c:676
 >  #1  0xffffffff808ad97c in vpanic (fmt=fmt@entry=0xffffffff80ed4fdb "trap", ap=ap@entry=0xfffffe8100514c38)
 >      at /usr/src/sys/kern/subr_prf.c:342
 >  #2  0xffffffff808ada30 in panic (fmt=fmt@entry=0xffffffff80ed4fdb "trap") at /usr/src/sys/kern/subr_prf.c:258
 >  #3  0xffffffff8011b736 in trap (frame=0xfffffe8100514d70) at /usr/src/sys/arch/amd64/amd64/trap.c:298
 >  #4  0xffffffff8010115e in alltraps ()
 >  #5  0xffffffff806401c3 in pf_state_tree_ext_gwy_RB_REMOVE_COLOR (head=0xffffffff8128cea0 <pf_statetbl_ext_gwy>,
 >      parent=0xfffffe81129c1160, elm=0x0) at /usr/src/sys/dist/pf/net/pf.c:337
 >  #6  0xffffffff8064051e in pf_state_tree_ext_gwy_RB_REMOVE (head=head@entry=0xffffffff8128cea0 <pf_statetbl_ext_gwy>,
 >      elm=<optimized out>, elm@entry=0xfffffe81129c1d40) at /usr/src/sys/dist/pf/net/pf.c:337
 >  #7  0xffffffff806456b6 in pf_detach_state (s=<optimized out>, flags=flags@entry=0)
 >      at /usr/src/sys/dist/pf/net/pf.c:3042
 >  #8  0xffffffff806459d8 in pf_unlink_state (cur=<optimized out>) at /usr/src/sys/dist/pf/net/pf.c:1086
 >  #9  0xffffffff80645ae7 in pf_purge_expired_states (maxcheck=18) at /usr/src/sys/dist/pf/net/pf.c:1148
 >  #10 0xffffffff80645baa in pf_purge_thread (v=<optimized out>) at /usr/src/sys/dist/pf/net/pf.c:950
 >  #11 0xffffffff801008d7 in lwp_trampoline ()
 >  #12 0x0000000000000000 in ?? ()
 >