Re: panic in arptimer

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

On Mon, Oct 19, 2015 at 6:33 PM, Ryota Ozaki <ozaki-r%netbsd.org@localhost> wrote:
> Hi,
>
> I've reproduced the panic on my machine and I'm investing
> the problem.

A possible fix has been committed. Could you try a latest kernel?
(a kernel binary will be built in several hours.)

tips: by doing sysctl -w net.inet.arp.keep=30, you don't need to
wait for 1200 seconds.

>
> Thank you for the report,
>   ozaki-r
>
> On Mon, Oct 19, 2015 at 4:10 PM, Takahiro Hayashi <t.hash425%gmail.com@localhost> wrote:
>> Hello,
>>
>> Kernel panics in arptimer after detaching network interface.
>> See dmesg below please.
>> It happened on NetBSD/amd64 on GENERIC.201510182130Z from nyftp.
>> I think this problem looks like kern/50186.

BTW I think this problem is different from PR kern/50186.

Regards,
  ozaki-r

>>
>> How-To-Repeat:
>> 1. Boot kernel into single user mode with "boot netbsd -s".
>> 2. sysctl -w net.inet6.ip6.auto_linklocal=0
>> 3. ifconfig interface <ipv4 address>.
>> 4. Send one ping to other host.
>> 5. Detach the interface with "drvctl -d".
>> 6. Wait about 1200 seconds (actually 1200 sec after ping is sent).
>>
>>
>> I saw following panic after detaching "re0".
>>
>> fatal page fault in supervisor mode
>> trap type 6 code 0 rip ffffffff808cbf2f cs 8 rflags 10246 cr2
>> ffff8000073c7368 ilevel 2 rsp fffffe80dabd1f08
>> curlwp 0xfffffe81071a30c0 pid 0.22 lowest kstack 0xfffffe80dabce2c0
>> kernel: page fault trap, code=0
>> Stopped in pid 0.22 (system) at netbsd:arptimer+0xc4:   movq
>> 360(%r15),%rdi
>> db{1}> bt
>> arptimer() at netbsd:arptimer+0xc4
>> callout_softclock() at netbsd:callout_softclock+0x1d0
>> softint_dispatch() at netbsd:softint_dispatch+0xd3
>> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe80dabd1ff0
>> Xsoftintr() at netbsd:Xsoftintr+0x4f
>> --- interrupt ---
>> 0:
>> db{1}> show reg
>> ds          1ee8
>> es          4040
>> fs          600
>> gs          3d5e
>> rdi         fffffe81078c8a00
>> rsi         f8000000
>> rbp         fffffe80dabd1f38
>> rbx         fffffe81078c8908
>> rdx         0
>> rcx         7
>> rax         fffffe81071a30c4
>> r8          fffffe8107184040
>> r9          7d
>> r10         fffffe811eb244f4
>> r11         246
>> r12         fffffe81078c8a00
>> r13         fffffe81078c89b0
>> r14         0
>> r15         ffff8000073c7008
>> rip         ffffffff808cbf2f    arptimer+0xc4
>> cs          8
>> rflags      10246
>> rsp         fffffe80dabd1f08
>> ss          10
>> netbsd:arptimer+0xc4:   movq    360(%r15),%rdi
>> db{1}>
>>
>>
>> I met folloging panic after "drvctl -d axe0".
>>
>> fatal page fault in supervisor mode
>> trap type 6 code 2 rip ffffffff8011bcdd cs 8 rflags 10282 cr2 0 ilevel 2 rsp
>> fffffe80dabd1f00
>> curlwp 0xfffffe81071a30c0 pid 0.22 lowest kstack 0xfffffe80dabce2c0
>> kernel: page fault trap, code=0
>> Stopped in pid 0.22 (system) at netbsd:rw_enter+0x2d:   lock cmpxchgq
>> %rcx,0(%
>> rdi)
>> db{1}> bt
>> rw_enter() at netbsd:rw_enter+0x2d
>> callout_softclock() at netbsd:callout_softclock+0x1d0
>> softint_dispatch() at netbsd:softint_dispatch+0xd3
>> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe80dabd1ff0
>> Xsoftintr() at netbsd:Xsoftintr+0x4f
>> --- interrupt ---
>> 0:
>> db{1}> show reg
>> ds          1ee8
>> es          0
>> fs          fc00
>> gs          3d5e
>> rdi         0
>> rsi         1
>> rbp         fffffe80dabd1f38
>> rbx         fffffe811dbc8188
>> rdx         0
>> rcx         fffffe81071a30c4
>> rax         0
>> r8          fffffe8107184040
>> r9          7d
>> r10         fffffe811eb244f4
>> r11         246
>> r12         fffffe811dbc8280
>> r13         fffffe811dbc8230
>> r14         0
>> r15         fffffe811de0b010
>> rip         ffffffff8011bcdd    rw_enter+0x2d
>> cs          8
>> rflags      10282
>> rsp         fffffe80dabd1f00
>> ss          10
>> netbsd:rw_enter+0x2d:   lock cmpxchgq   %rcx,0(%rdi)
>> db{1}>
>>
>>
>> --
>> t-hash