Potential re(4) / netbsd-4 / i386 problem?

[Brad du Plessis <bradd%cat.co.za@localhost>]

Hi all,

I've been seeing panics on a netbsd-4/i386 machine which appears to be 
related to the reception of oversized frames:

re0: discarding oversize frame (len=8813)
re0: discarding oversize frame (len=2191)
re0: discarding oversize frame (len=10478)
uvm_fault(0xc0a44aa0, 0xe4ff7000, 1) -> 0xe
kernel: supervisor trap page fault, code=0
Stopped in pid 592.1 (cat_nw) at        netbsd:m_tag_delete_chain+0x20: 
movl    0
(%ebx),%eax
db{1}> bt
m_tag_delete_chain(c2686d00,0,881cad0,5,f2946af0) at 
netbsd:m_tag_delete_chain+0
x20
sbdrop(c1cb84c4,d1c,d108aba4,0,0) at netbsd:sbdrop+0x25e
sbflush(c1cb84c4,c1cb84f4,c1cb84c4,d1c,c22dd94c) at netbsd:sbflush+0x2f
tcp_disconnect(c22dd94c,0,0,c1cc0800,0) at netbsd:tcp_disconnect+0x43
tcp_usrreq(c1cb8444,6,0,0,0) at netbsd:tcp_usrreq+0x285
sodisconnect(c1cb8444,1,0,0,d1c) at netbsd:sodisconnect+0xb0
soclose(c1cb8444,0,d108ac2c,c043fd1c,d1210d04) at netbsd:soclose+0x1e0
soo_close(d1210d04,d0f7adec,d108ac04,d0deb480,62) at netbsd:soo_close+0x1b
closef(d1210d04,d0f7adec,d108ac68,d0f789fc,c1cc0800) at netbsd:closef+0x14c
syscall_plain() at netbsd:syscall_plain+0xa4
--- syscall (number 6) ---
0xbaff932b:
db{1}>


I can get the panic quite regularly (will crash after a few hours) when 
loading the network. I've seen a few different back traces from the 
panics but the "discarding oversize frame" message always leads up to 
the panic (and I only see these messages before a panic, not when its 
running fine).

I removed the "ppsratecheck" in if_ethersubr.c so I could see every 
oversized frame instance, and I took it upon myself to put a few 
printouts in rtl8169.c to figure out what was going on. What I found was 
that the panic always follows the arrival of 2 oversized frames in the 
handling of a read interrupt. (i.e. I put a printout before and after 
the loop in rtl8169.c:re_rxeof and found the crash happening after 2 
"discarding oversize frame" instances in 1 loop)

The netbsd-4 source is from about 2 days ago and I haven't tried to 
reproduce this on netbsd-5.

Can anyone help me?

Thanks,
 Brad


dmesg:

Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 4.0_STABLE (GENERIC.MP) #10: Tue Mar  2 11:55:34 SAST 2010
        root@A4_1_201:/usr/src/sys/arch/i386/compile/GENERIC.MP
total memory = 1014 MB
rbus: rbus_min_start set to 0x40000000
avail memory = 986 MB
timecounter: Timecounters tick every 10.000 msec
timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
BIOS32 rev. 0 found at 0xfb4f0
mainbus0 (root)
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel Core 2 (Merom) (686-class), 2194.91 MHz, id 0x6fd
cpu0: "Intel(R) Celeron(R) CPU        E1500  @ 2.20GHz"
cpu0: enabling thermal monitor 1 ... enabled.
cpu0: calibrating local timer
cpu0: apic clock running at 199 MHz
cpu1 at mainbus0: apid 1 (application processor)
cpu1: starting
cpu1: Intel Core 2 (Merom) (686-class), 2194.75 MHz, id 0x6fd
cpu1: "Intel(R) Celeron(R) CPU        E1500  @ 2.20GHz"
cpu1: using thermal monitor 1
ioapic0 at mainbus0 apid 4 (I/O APIC)
ioapic0: pa 0xfec00000, version 20, 24 pins
ioapic0: misconfigured as apic 0
ioapic0: remapped to apic 4
acpi0 at mainbus0: Advanced Configuration and Power Interface
acpi0: fixed-feature power button present
timecounter: Timecounter "ACPI-Fast" frequency 3579545 Hz quality 1000
ACPI-Fast 24-bit timer
ACPI Object Type 'Processor' (0x0c) at acpi0 not configured
ACPI Object Type 'Processor' (0x0c) at acpi0 not configured
ACPI Object Type 'Processor' (0x0c) at acpi0 not configured
ACPI Object Type 'Processor' (0x0c) at acpi0 not configured
acpibut0 at acpi0 (PNP0C0C): ACPI Power Button
PNP0A08 [PCI Express/PCI-X Mode-2 Host Bridge] at acpi0 not configured
PNP0C02 [Plug and Play motherboard register resources] at acpi0 not 
configured
PNP0000 [AT Interrupt Controller] at acpi0 not configured
PNP0200 [AT DMA Controller] at acpi0 not configured
attimer1 at acpi0 (PNP0100): AT Timer
attimer1: io 0x40-0x43 irq 0
PNP0B00 [AT Real-Time Clock] at acpi0 not configured
pcppi1 at acpi0 (PNP0800)
pcppi1: io 0x61
pcppi1: children must have an explicit unit
midi0 at pcppi1: PC speaker (CPU-intensive output)
spkr0 at pcppi1
sysbeep0 at pcppi1
npx1 at acpi0 (PNP0C04)
npx1: io 0xf0-0xff irq 13
PNP0700 [PC standard floppy disk controller] at acpi0 not configured
PNP0501 [16550A-compatible COM port] at acpi0 not configured
PNP0501 [16550A-compatible COM port] at acpi0 not configured
lpt3 at acpi0 (PNP0400)
lpt3: io 0x378-0x37f,0x778-0x77b irq 7
pckbc1 at acpi0 (PNP0F13): aux port
pckbc1: irq 12
pckbc2 at acpi0 (PNP0303): kbd port
pckbc2: io 0x60,0x64 irq 1
PNP0C02 [Plug and Play motherboard register resources] at acpi0 not 
configured
INT0800 [Intel FWH Random Number Generator] at acpi0 not configured
PNP0C0F [PCI interrupt link device] at acpi0 not configured
PNP0C0F [PCI interrupt link device] at acpi0 not configured
PNP0C0F [PCI interrupt link device] at acpi0 not configured
PNP0C0F [PCI interrupt link device] at acpi0 not configured
PNP0C0F [PCI interrupt link device] at acpi0 not configured
PNP0C02 [Plug and Play motherboard register resources] at acpi0 not 
configured
PNP0C01 [System Board] at acpi0 not configured
PNP0C0B [ACPI Fan] at acpi0 not configured
acpitz0 at acpi0: ACPI Thermal Zone
acpitz0: active cooling level 0: 120.0C
acpitz0: critical 125.0C passive 40.0C
pcppi1: attached to attimer1
pckbd0 at pckbc2 (kbd slot)
pckbc2: using irq 1 for kbd slot
wskbd0 at pckbd0 mux 1
pms0 at pckbc2 (aux slot)
pckbc2: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
pchb0 at pci0 dev 0 function 0
pchb0: Intel 82945G/P Memory Controller Hub (rev. 0x02)
agp0 at pchb0: detected 7932k stolen memory
agp0: aperture at 0xfdf00000, size 0x10000000
vga1 at pci0 dev 2 function 0: Intel 82945G/P Integrated Graphics Device 
(rev. 0x02)
wsdisplay0 at vga1 kbdmux 1
wsmux1: connecting to wsdisplay0
wskbd0: connecting to wsdisplay0
azalia0 at pci0 dev 27 function 0: Generic High Definition Audio Controller
azalia0: interrupting at ioapic0 pin 16 (irq 10)
azalia0: host: Intel 82801GB/GR High Definition Audio Controller (rev. 1)
azalia0: host: High Definition Audio rev. 1.0
ppb0 at pci0 dev 28 function 0: Intel 82801GB/GR PCI Express Port #1 
(rev. 0x01)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled, rd/line, wr/inv ok
ppb1 at pci0 dev 28 function 1: Intel 82801GB/GR PCI Express Port #2 
(rev. 0x01)
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled, rd/line, wr/inv ok
re0 at pci2 dev 0 function 0pci_mem_find: void region
: RealTek 8168/8111 PCIe Gigabit Ethernet (rev. 0x02)
re0: interrupting at ioapic0 pin 17 (irq 11)
re0: Ethernet address 00:01:29:00:5f:16
rgephy0 at re0 phy 7: RTL8169S/8110S 1000BASE-T media interface, rev. 2
rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 
1000baseT-FDX, auto
uhci0 at pci0 dev 29 function 0: Intel 82801GB/GR USB UHCI Controller 
(rev. 0x01)
uhci0: interrupting at ioapic0 pin 23 (irq 5)
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1 at pci0 dev 29 function 1: Intel 82801GB/GR USB UHCI Controller 
(rev. 0x01)
uhci1: interrupting at ioapic0 pin 19 (irq 15)
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2 at pci0 dev 29 function 2: Intel 82801GB/GR USB UHCI Controller 
(rev. 0x01)
uhci2: interrupting at ioapic0 pin 18 (irq 9)
usb2 at uhci2: USB revision 1.0
uhub2 at usb2
uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
uhci3 at pci0 dev 29 function 3: Intel 82801GB/GR USB UHCI Controller 
(rev. 0x01)
uhci3: interrupting at ioapic0 pin 16 (irq 10)
usb3 at uhci3: USB revision 1.0
uhub3 at usb3
uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub3: 2 ports with 2 removable, self powered
ehci0 at pci0 dev 29 function 7: Intel 82801GB/GR USB EHCI Controller 
(rev. 0x01)
ehci0: interrupting at ioapic0 pin 23 (irq 5)
ehci0: BIOS has given up ownership
ehci0: EHCI version 1.0
ehci0: companion controllers, 2 ports each: uhci0 uhci1 uhci2 uhci3
usb4 at ehci0: USB revision 2.0
uhub4 at usb4
uhub4: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub4: 8 ports with 8 removable, self powered
ppb2 at pci0 dev 30 function 0: Intel 82801BA Hub-PCI Bridge (rev. 0xe1)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled
pcib0 at pci0 dev 31 function 0
pcib0: Intel 82801GB/GR LPC Interface Bridge (rev. 0x01)
piixide0 at pci0 dev 31 function 1
piixide0: Intel 82801GB/GR IDE Controller (ICH7) (rev. 0x01)
piixide0: bus-master DMA support present
piixide0: primary channel configured to compatibility mode
piixide0: primary channel interrupting at ioapic0 pin 14 (irq 14)
atabus0 at piixide0 channel 0
piixide0: secondary channel configured to compatibility mode
piixide0: secondary channel ignored (disabled)
piixide1 at pci0 dev 31 function 2
piixide1: Intel 82801GB/GR Serial ATA/Raid Controller (ICH7) (rev. 0x01)
piixide1: bus-master DMA support present
piixide1: primary channel configured to native-PCI mode
piixide1: using ioapic0 pin 19 (irq 15) for native-PCI interrupt
atabus1 at piixide1 channel 0
piixide1: secondary channel configured to native-PCI mode
atabus2 at piixide1 channel 1
Intel 82801GB/GR SMBus Controller (SMBus serial bus, revision 0x01) at 
pci0 dev 31 function 3 not configured
isa0 at pcib0
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com0: console
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
isapnp0 at isa0 port 0x279: ISA Plug 'n Play device support
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
isapnp0: no ISA Plug 'n Play devices found
ioapic0: enabling
timecounter: Timecounter "TSC" frequency 2194840010 Hz quality 800
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
azalia0: codec[2]: 0x10ec/0x0662 (rev. 1.1)
azalia0: codec[2]: High Definition Audio rev. 1.0
azalia0: playback: max channels=2, encodings=1<PCM>
azalia0: playback: PCM formats=e0160<24bit,20bit,16bit,96kHz,48kHz,44.1kHz>
azalia0: recording: max channels=2, encodings=1<PCM>
azalia0: recording: PCM formats=60160<20bit,16bit,96kHz,48kHz,44.1kHz>
audio0 at azalia0: full duplex, independent
Kernelized RAIDframe activated
wd0 at atabus1 drive 0: <WDC WD2500AAJS-00B4A0>
wd0: quirks 2<FORCE_LBA48>
wd0: drive supports 16-sector PIO transfers, LBA48 addressing
wd0: 232 GB, 484521 cyl, 16 head, 63 sec, 512 bytes/sect x 488397168 sectors
wd0: 32-bit data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 6 (Ultra/133)
wd0(piixide1:0:0): using PIO mode 4, Ultra-DMA mode 6 (Ultra/133) (using 
DMA)
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
cpu1: CPU 1 running