kern/48789: Sudden reboot; apparent crash in pf

[jan.m.danielsson%gmail.com@localhost]

>Number:         48789
>Category:       kern
>Synopsis:       Sudden reboot; apparent crash in pf
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 07 05:40:01 +0000 2014
>Originator:     Jan Danielsson
>Release:        netbsd-6
>Organization:
La Cosa Nostra
>Environment:
NetBSD aria.lan 6.1_STABLE NetBSD 6.1_STABLE (ARIA) #0: Mon Sep 30 11:17:43 
CEST 2013  
jan%aria.lan@localhost:/home/jan/sysbuild/obj.amd64/usr/src/sys/arch/amd64/compile/ARIA
 amd64
>Description:
My router had a sudden reboot one night; /var/log/messages contained:

----------------------------
Dec  3 03:15:46 aria syslogd[188]: restart
Dec  3 03:15:46 aria /netbsd: uvm_fault(0xffffffff8071b4d8, 0x0, 1) -> e
Dec  3 03:15:46 aria /netbsd: fatal page fault in supervisor mode
Dec  3 03:15:46 aria /netbsd: trap type 6 code 0 rip ffffffff8031162f cs
8 rflags 10283 cr2  60 cpl 4 rsp fffffe8004cf9b98
Dec  3 03:15:46 aria /netbsd: panic: trap
Dec  3 03:15:46 aria /netbsd: cpu1: Begin traceback...
----------------------------

aria$ nm -n /netbsd | grep ffffffff80311  
ffffffff80311070 T pf_state_tree_lan_ext_RB_INSERT
ffffffff80311110 t pf_state_compare_lan_ext
ffffffff80311230 T pf_state_tree_lan_ext_RB_FIND
ffffffff80311270 T pf_state_tree_lan_ext_RB_NFIND
ffffffff803112d0 T pf_state_tree_lan_ext_RB_NEXT
ffffffff80311330 T pf_state_tree_lan_ext_RB_PREV
ffffffff80311390 T pf_state_tree_lan_ext_RB_MINMAX
ffffffff803113c0 T pf_state_tree_ext_gwy_RB_INSERT_COLOR
ffffffff803115c0 T pf_state_tree_ext_gwy_RB_REMOVE_COLOR
ffffffff803118e0 T pf_state_tree_ext_gwy_RB_REMOVE
ffffffff80311a20 T pf_state_tree_ext_gwy_RB_INSERT
ffffffff80311ac0 t pf_state_compare_ext_gwy
ffffffff80311bf0 T pf_state_tree_ext_gwy_RB_FIND
ffffffff80311c30 T pf_state_tree_ext_gwy_RB_NFIND
ffffffff80311c90 T pf_state_tree_ext_gwy_RB_NEXT
ffffffff80311cf0 T pf_state_tree_ext_gwy_RB_PREV
ffffffff80311d50 T pf_state_tree_ext_gwy_RB_MINMAX
ffffffff80311d80 T pf_state_tree_id_RB_INSERT_COLOR
ffffffff80311f80 T pf_state_tree_id_RB_REMOVE_COLOR
[---]

aria$ gdb /netbsd
(gdb) disas 0xffffffff8031162f
Dump of assembler code for function pf_state_tree_ext_gwy_RB_REMOVE_COLOR:
   0xffffffff803115c0 <+0>:     jmpq   0xffffffff8031167a 
<pf_state_tree_ext_gwy_RB_REMOVE_COLOR+186>
   0xffffffff803115c5 <+5>:     data32 nopw %cs:0x0(%rax,%rax,1)
   0xffffffff803115d0 <+16>:    cmpl   $0x1,0x78(%rax)
   0xffffffff803115d4 <+20>:    jne    0xffffffff8031162f 
<pf_state_tree_ext_gwy_RB_REMOVE_COLOR+111>
   0xffffffff803115d6 <+22>:    movl   $0x0,0x78(%rax)
   0xffffffff803115dd <+29>:    movl   $0x1,0x78(%rsi)
   0xffffffff803115e4 <+36>:    mov    0x60(%rsi),%rax
   0xffffffff803115e8 <+40>:    mov    0x68(%rax),%rcx
   0xffffffff803115ec <+44>:    mov    %rcx,0x60(%rsi)
   0xffffffff803115f0 <+48>:    test   %rcx,%rcx
   0xffffffff803115f3 <+51>:    je     0xffffffff803115fd 
<pf_state_tree_ext_gwy_RB_REMOVE_COLOR+61>
[---]

>How-To-Repeat:
Unknown; it has only happened once.
>Fix:
Unknown.