Re: kern/51828: Panic after configuring vlan on nonexistent phys interface

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

The following reply was made to PR kern/51828; it has been noted by GNATS.

From: Ryota Ozaki <ozaki-r%netbsd.org@localhost>
To: Hauke Fath <hf%spg.tu-darmstadt.de@localhost>
Cc: "gnats-bugs%NetBSD.org@localhost" <gnats-bugs%netbsd.org@localhost>, kern-bug-people%netbsd.org@localhost, 
	gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Subject: Re: kern/51828: Panic after configuring vlan on nonexistent phys interface
Date: Thu, 12 Jan 2017 12:38:19 +0900

 On Thu, Jan 12, 2017 at 12:45 AM, Hauke Fath <hf%spg.tu-darmstadt.de@localhost> wrote:
 >>Number:         51828
 >>Category:       kern
 >>Synopsis:       Panic after configuring vlan on nonexistent phys interface
 >>Confidential:   no
 >>Severity:       critical
 >>Priority:       medium
 >>Responsible:    kern-bug-people
 >>State:          open
 >>Class:          sw-bug
 >>Submitter-Id:   net
 >>Arrival-Date:   Wed Jan 11 15:45:00 +0000 2017
 >>Originator:     Hauke Fath
 >>Release:        NetBSD 7.99.57
 >>Organization:
 > Technische Universitaet Darmstadt
 >>Environment:
 >
 >
 > System: NetBSD 7.99.57 (FIFI-$Revision$) #0: Tue Jan 10 15:12:17 CET
 > 2017
 >
 > hf@Hochstuhl:/var/obj/netbsd-builds/developer/amd64/sys/arch/amd64/compile/FIFI
 > Architecture: x86_64
 > Machine: amd64
 >>Description:
 >
 >         For testing purposes, I brought a NetBSD 7 pf / pfsync / carp
 >         setup to a different machine. Some of its physical interfaces
 >         are disconnected.
 >
 >         The netbsd-7 kernel complained, and moved on.
 >
 >         A netbsd-current DIAGNOSTIC / DEBUG kernel panics:
 >
 > [...]
 > IPv6 mode: host
 > Configuring network interfaces: wm0 wm1wm1: link state DOWN (was
 > UNKNOWN)
 >  wm3wm3: link state DOWN (was UNKNOWN)
 >  vlan2 vlan3 vlan7 vlan8 vlan9 vlan10 vlan11 vlan12 carp0ifconfig:
 > SIOCAIFADDR_IN6: Can'tfatal page fault in supervisor mode
 > trap type 6 code 0 rip ffffffff804655c6 cs 8 rflags 10207 cr2 d56
 > ilevel 5 rsp fffffe8040093db0
 > curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
 > panic: trap
 > cpu4: Begin traceback...
 > vpanic() at netbsd:vpanic+0x140
 > snprintf() at netbsd:snprintf
 > trap() at netbsd:trap+0xb86
 > --- trap (number 6) ---
 > psref_acquire() at netbsd:psref_acquire+0x65
 > in6ifa_ifpforlinklocal_psref() at
 > netbsd:in6ifa_ifpforlinklocal_psref+0x3a
 > mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
 > mld_start_listening() at netbsd:mld_start_listening+0x89
 > mld_timeo() at netbsd:mld_timeo+0x6f
 > callout_softclock() at netbsd:callout_softclock+0x201
 > softint_dispatch() at netbsd:softint_dispatch+0xd9
 > DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
 > Xsoftintr() at netbsd:Xsoftintr+0x4f
 > --- interrupt ---
 > 0:
 > cpu4: End traceback...
 >
 > dumping to dev 18,1 (offset=3903183, size=1048102):
 > dump  assign requested address
 > fatal page fault in supervisor mode
 > trap type 6 code 0 rip ffffffff80118d2a cs 8 rflags 10246 cr2 38 ilevel
 > 8 rsp fffffe8040093ac0
 > curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
 > Skipping crash dump on recursive panic
 > panic: trap
 > cpu4: Begin traceback...
 > vpanic() at netbsd:vpanic+0x140
 > snprintf() at netbsd:snprintf
 > trap() at netbsd:trap+0xb86
 > --- trap (number 6) ---
 > sparse_dump_mark() at netbsd:sparse_dump_mark+0x10c
 > dump_seg_prep() at netbsd:dump_seg_prep+0x22
 > dodumpsys() at netbsd:dodumpsys+0xbe
 > dumpsys() at netbsd:dumpsys+0x1d
 > vpanic() at netbsd:vpanic+0x149
 > snprintf() at netbsd:snprintf
 > trap() at netbsd:trap+0xb86
 > --- trap (number 6) ---
 > psref_acquire() at netbsd:psref_acquire+0x65
 > in6ifa_ifpforlinklocal_psref() at
 > netbsd:in6ifa_ifpforlinklocal_psref+0x3a
 > mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
 > mld_start_listening() at netbsd:mld_start_listening+0x89
 > mld_timeo() at netbsd:mld_timeo+0x6f
 > callout_softclock() at netbsd:callout_softclock+0x201
 > softint_dispatch() at netbsd:softint_dispatch+0xd9
 > DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
 > Xsoftintr() at netbsd:Xsoftintr+0x4f
 > --- interrupt ---
 > 0:
 > cpu4: End traceback...
 > rebooting...
 >
 >
 >
 >>How-To-Repeat:
 >
 >         Run a DEBUG/DIAGNOSTIC -current kernel with multiple network
 > interfaces, some with conflicting setup.
 
 Does the panic happen without DEBUG?
 
 It seems that a DEBUG code in psref causes the panic. I don't have any
 ideas why it happens for now though...
 
 Thanks,
   ozaki-r