kern/50809: pf panics while purging state

[Hauke Fath <hf%spg.tu-darmstadt.de@localhost>]

>Number:         50809
>Category:       kern
>Synopsis:       pf panics while purging state
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 15 15:25:00 +0000 2016
>Originator:     Hauke Fath <hf%spg.tu-darmstadt.de@localhost>
>Release:        NetBSD 7.0_STABLE
>Organization:
Technische Universitaet Darmstadt
>Environment:
	
	
System: NetBSD Vertatscha 7.0_STABLE NetBSD 7.0_STABLE (FIFI-$Revision: 1.85 $) #0: Mon Feb 8 12:13:12 CET 2016 hf@Hochstuhl:/var/obj/netbsd-builds/7/amd64/sys/arch/amd64/compile/FIFI amd64
Architecture: x86_64
Machine: amd64
>Description:

	On a busy router machine, we have seen at least two kernel
	panics with the stack trace

uvm_fault(0xffffffff806ce920, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff802c5eef cs 8 rflags 10246 cr2 48 ilevel 4 rsp ff
curlwp 0xfffffe810f0855c0 pid 0.62 lowest kstack 0xfffffe810f1452c0
panic: trap
cpu3: Begin traceback...
vpanic() at netbsd:vpanic+0x13c
snprintf() at netbsd:snprintf
startlwp() at netbsd:startlwp
alltraps() at netbsd:alltraps+0x96
pf_state_tree_id_RB_REMOVE() at netbsd:pf_state_tree_id_RB_REMOVE+0xd6
pf_unlink_state() at netbsd:pf_unlink_state+0x21
pf_purge_expired_states() at netbsd:pf_purge_expired_states+0x79
pf_purge_thread() at netbsd:pf_purge_thread+0x69
cpu3: End traceback...
rebooting...

	After the reboot, pflogd(8) 100% hogs a cpu core. When I
	manually restart it, cpu load is back to normal.

	
>How-To-Repeat:

	Run netbsd-7 on a busy router till it crashes.

	
>Fix:

	If only I knew how to.

	

>Unformatted: