kern/55634: if_wg test failures with mbuf pool corruption

[martin%NetBSD.org@localhost]

>Number:         55634
>Category:       kern
>Synopsis:       if_wg test failures with mbuf pool corruption
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Sep 01 14:00:00 +0000 2020
>Originator:     Martin Husemann
>Release:        NetBSD 9.99.72
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD thirdstage.duskware.de 9.99.72 NetBSD 9.99.72 (MODULAR) #373: Tue Sep 1 09:54:58 CEST 2020 martin%thirdstage.duskware.de@localhost:/usr/src/sys/arch/sparc64/compile/MODULAR sparc64
Architecture: sparc64
Machine: sparc64
>Description:

Many of the net/if_wg tests fail with rump kernel crashes on sparc64.
Example from t_basic::wg_payload_sizes_ipv6_over_ipv4:

[   1.3700050] shmif0: Ethernet address b2:a0:0e:c5:c7:78
[   3.8300050] panic: pool_redzone_check: [mbpl] 0x00 != 0x33
Core was generated by `rump_server'.
Program terminated with signal SIGABRT, Aborted.
#0  abort () at /usr/src/lib/libc/stdlib/abort.c:80
80		(void)signal(SIGABRT, SIG_DFL);
[Current thread is 1 (process 17080)]
#0  abort () at /usr/src/lib/libc/stdlib/abort.c:80
#1  0x0000000040e0a47c in rumpuser_exit (rv=<optimized out>)
    at /usr/src/lib/librumpuser/rumpuser.c:236
#2  0x00000000407ee22c in cpu_reboot (howto=<optimized out>, bootstr=0x0)
    at /usr/src/lib/librump/../../sys/rump/librump/rumpkern/emul.c:429
#3  0x00000000407c23ec in kern_reboot (howto=<optimized out>, bootstr=0x0)
    at /usr/src/lib/librump/../../sys/rump/../kern/kern_reboot.c:73
#4  0x00000000407979d4 in vpanic (fmt=0x407fcd08 "%s: [%s] 0x%02x != 0x%02x", 
    ap=0x474af0e8)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_prf.c:290
#5  0x0000000040797aac in panic (fmt=0x407fcd08 "%s: [%s] 0x%02x != 0x%02x")
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_prf.c:209
#6  0x0000000040799808 in pool_redzone_check (pp=0x409d5800, p=0x40da2480)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_pool.c:3141
#7  0x000000004079e550 in pool_redzone_check (p=0x40da2480, pp=0x409d5800)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_pool.c:3166
#8  pool_cache_redzone_check (p=0x40da2480, pc=0x409d5800)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_pool.c:3166
#9  pool_cache_put_paddr (pc=0x409d5800, object=0x40da2480, 
    pa=18446744073709551615)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_pool.c:2765
#10 0x0000000041e1d9c8 in m_free (m=<optimized out>)
    at /usr/src/lib/librumpnet/../../sys/rump/../kern/uipc_mbuf.c:1989
#11 m_free (m=<optimized out>)
    at /usr/src/lib/librumpnet/../../sys/rump/../kern/uipc_mbuf.c:1969
#12 0x0000000041e1e9f4 in m_freem (m=<optimized out>)
    at /usr/src/lib/librumpnet/../../sys/rump/../kern/uipc_mbuf.c:2001
#13 m_freem (m=0x40da2590)
    at /usr/src/lib/librumpnet/../../sys/rump/../kern/uipc_mbuf.c:1996
#14 0x0000000042403be0 in shmif_snd (m0=<optimized out>, ifp=0x42320f40)
    at /usr/src/sys/rump/net/lib/libshmif/if_shmem.c:632
#15 shmif_start (ifp=0x42320f40)
    at /usr/src/sys/rump/net/lib/libshmif/if_shmem.c:570
#16 0x00000000420babbc in if_start_lock (ifp=0x42320f40)
    at /usr/src/sys/rump/net/lib/libnet/../../../../net/if.h:511
#17 if_start_lock (ifp=0x42320f40)
    at /usr/src/sys/rump/net/lib/libnet/../../../../net/if.h:504
#18 if_transmit (ifp=0x42320f40, m=0x40da2590)
    at /usr/src/sys/rump/net/lib/libnet/../../../../net/if.c:3624
#19 0x00000000420c2374 in if_transmit_lock (ifp=0x42320f40, m=0x40da2590)
    at /usr/src/sys/rump/net/lib/libnet/../../../../net/if.c:3649
#20 0x00000000420acbfc in ether_output (ifp0=0x42320f40, m0=<optimized out>, 
    dst=0x474af794, rt=<optimized out>)
    at /usr/src/sys/rump/net/lib/libnet/../../../../net/if_ethersubr.c:456
#21 0x000000004203793c in if_output_lock (rt=<optimized out>, 
    dst=<optimized out>, m=<optimized out>, ifp=<optimized out>, 
    cifp=<optimized out>)
    at /usr/src/sys/rump/net/lib/libnet/../../../../net/if.h:497
#22 if_output_lock (rt=<optimized out>, dst=<optimized out>, 
    m=<optimized out>, ifp=<optimized out>, cifp=<optimized out>)
    at /usr/src/sys/rump/net/lib/libnet/../../../../net/if.h:487
#23 ip6_if_output (origifp=<optimized out>, rt=<optimized out>, 
    dst=<optimized out>, m=<optimized out>, ifp=<optimized out>)
    at /usr/src/sys/rump/net/lib/libnet/../../../../netinet6/ip6_output.c:177
#24 ip6_if_output (ifp=0x42320f40, origifp=0x42320f40, m=0x40da2590, 
    dst=0x474af794, rt=0x0)
    at /usr/src/sys/rump/net/lib/libnet/../../../../netinet6/ip6_output.c:159
#25 0x0000000042033d1c in nd6_llinfo_release_pkts (ln=0x4297e040, 
    ifp=0x42320f40)
    at /usr/src/sys/rump/net/lib/libnet/../../../../netinet6/nd6.c:1432
#26 0x000000004202f604 in nd6_na_input (m=0x40da2370, off=<optimized out>, 
    icmp6len=<optimized out>)
    at /usr/src/sys/rump/net/lib/libnet/../../../../netinet6/nd6_nbr.c:850
#27 0x0000000042051a68 in _icmp6_input (m=0x40da2040, off=<optimized out>, 
    proto=<optimized out>)
    at /usr/src/sys/rump/net/lib/libnet/../../../../netinet6/icmp6.c:869
#28 0x0000000041e0b60c in wqinput_work (wk=0x40d87b20, arg=0x40b2d000)
    at /usr/src/lib/librumpnet/../../sys/rump/../netinet/wqinput.c:244
#29 0x000000004078d9c4 in workqueue_runlist (wq=0x41164580, wq=0x41164580, 
    list=0x411645e8)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_workqueue.c:106
#30 workqueue_worker (cookie=0x41164580)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_workqueue.c:136
#31 0x00000000407e8e10 in threadbouncer (arg=0x40d87980)
    at /usr/src/lib/librump/../../sys/rump/librump/rumpkern/threads.c:90
#32 0x000000004100f328 in pthread__create_tramp (cookie=0x41160800)
    at /usr/src/lib/libpthread/pthread.c:560


>How-To-Repeat:

on a sparc64 machine: cd /usr/tests/net/if_wg && atf-run t_basic

>Fix:
n/a