Re: panic in wqinput_input

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

On Thu, May 4, 2017 at 6:31 AM, Thomas Klausner <tk%giga.or.at@localhost> wrote:
> On Wed, May 03, 2017 at 05:11:12PM +0900, Ryota Ozaki wrote:
>> On Wed, May 3, 2017 at 4:16 PM, Thomas Klausner <tk%giga.or.at@localhost> wrote:
>> > Hi!
>> >
>> > Last night my 7.99.67/amd64 rebooted after this panic:
>> >
>> > fatal page fault in supervisor mode
>> > trap type 6 code 0x2 rip 0xffffffff80a815b6 cs 0x8 rflags 0x10286 cr2 0 ilevel 0x4 rsp 0xfffffe813a414dc0
>> > curlwp 0xfffffe882df26420 pid 0.3 lowest kstack 0xfffffe813a4112c0
>> > panic: trap
>> > cpu0: Begin traceback...
>> > vpanic() at netbsd:vpanic+0x140
>> > snprintf() at netbsd:snprintf
>> > trap() at netbsd:trap+0xc6b
>> > --- trap (number 6) ---
>> > wqinput_input() at netbsd:wqinput_input+0x43
>> > icmp6_input() at netbsd:icmp6_input+0x17
>> > ip6_input() at netbsd:ip6_input+0x6cb
>> > ip6intr() at netbsd:ip6intr+0x71
>> > softint_dispatch() at netbsd:softint_dispatch+0xd3
>> > DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe813a414ff0
>> > Xsoftintr() at netbsd:Xsoftintr+0x4f
>> > --- interrupt ---
>> > 0:
>> > cpu0: End traceback...
>> >
>> > It probably was under high memory load, so it could be an
>> > out-of-memory situation.
>> >
>> > Crash dump is available.
>> >  Thomas
>>
>> I think the below diff fixes the panic.
>>
>> Could you confirm that the variable "work" was NULL by
>> inspecting the crash dump?
>
> Thank you for your reply and patch.

I'm sorry for not replying this mail.

>
> I'm sorry, it seems something went wrong with the crash dump, it looks
> like this:

Hmm, I'm not sure why the crash dump is broken. Anyway
my patch should be necessary and likely to fix the panic,
so I committed the patch.

If the same panic would happen again, please let me know.

Thanks,
  ozaki-r

>
> (gdb) target kvm netbsd.107.core
> 0xffffffff80219f55 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:674
> 674                     dumpsys();
> (gdb) bt
> #0  0xffffffff80219f55 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:674
> #1  0xffffffff809a867c in vpanic (fmt=fmt@entry=0xffffffff810d5762 "trap", ap=ap@entry=0xfffffe813b390888) at /usr/src/sys/kern/subr_prf.c:342
> #2  0xffffffff809a8730 in panic (fmt=fmt@entry=0xffffffff810d5762 "trap") at /usr/src/sys/kern/subr_prf.c:258
> #3  0xffffffff8021bb86 in trap (frame=0xfffffe813b3909c0) at /usr/src/sys/arch/amd64/amd64/trap.c:297
> #4  0xffffffff8020113e in alltraps ()
> #5  0xffffffff8021ba0f in trap (frame=0xfffffe813b390b90) at /usr/src/sys/arch/amd64/amd64/trap.c:345
> #6  0xffffffff8020113e in alltraps ()
> #7  0xffffffff81dc7033 in ?? ()
> #8  0xfffffe810000046a in ?? ()
> #9  0xfffffe8700000023 in ?? ()
> #10 0xfffffe813b390cf0 in ?? ()
> #11 0xffffffff80445829 in usbd_fill_deviceinfo (dev=0xfffffe839b9bdab0, di=0xfffffe86c3e7b020, usedev=0) at /usr/src/sys/dev/usb/usb_subr.c:1507
> Backtrace stopped: frame did not save the PC
> (gdb)
>
> "thread apply all bt" makes gdb crash, as does "thread 2.1", so I
> don't know how to find backtraces for other active threads.
>
> (gdb) thread apply all bt
>
> Thread 2.1 (<kvm>):
> /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/gdbarch.c:4884: internal-error: gdbarch_addressable_memory_unit_size: Assertion `gdbarch != NULL' failed.
> A problem internal to GDB has been detected,
> further debugging may prove unreliable.
> Quit this debugging session? (y or n) y
>
> This is a bug, please report it.  For instructions, see:
> <http://www.gnu.org/software/gdb/bugs/>.
>
> /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/gdbarch.c:4884: internal-error: gdbarch_addressable_memory_unit_size: Assertion `gdbarch != NULL' failed.
> A problem internal to GDB has been detected,
> further debugging may prove unreliable.
> Create a core file of GDB? (y or n) y
> Abort (core dumped)
>
> (gdb) thread 2.1
> [Switching to thread 2.1 (<kvm>)]
> /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/gdbarch.c:4884: internal-error: gdbarch_addressable_memory_unit_size: Assertion `gdbarch != NULL' failed.
> A problem internal to GDB has been detected,
> further debugging may prove unreliable.
> Quit this debugging session? (y or n)
> ...
>
>
> gdb backtrace for the first case:
>
> (gdb) bt
> #0  0x00007f61c731cd8a in _lwp_kill () from /usr/lib/libc.so.12
> #1  0x00007f61c731c445 in abort () at /usr/src/lib/libc/stdlib/abort.c:74
> #2  0x00000001a2143703 in dump_core () at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/utils.c:561
> #3  0x00000001a214592d in internal_vproblem (problem=problem@entry=0x1a282f160 <internal_error_problem>, file=<optimized out>, line=<optimized out>, fmt=<optimized out>,
>     ap=ap@entry=0x7f7ffff00658) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/utils.c:772
> #4  0x00000001a21459ed in internal_verror (file=<optimized out>, line=<optimized out>, fmt=<optimized out>, ap=ap@entry=0x7f7ffff00658)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/utils.c:798
> #5  0x00000001a211b3be in internal_error (file=file@entry=0x1a240d548 "/usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/gdbarch.c", line=line@entry=4884,
>     fmt=<optimized out>) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/common/errors.c:55
> #6  0x00000001a21e1a80 in gdbarch_addressable_memory_unit_size (gdbarch=<optimized out>) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/gdbarch.c:4884
> #7  0x00000001a21c6d5f in target_read (ops=0x1a28514e0 <bsd_kvm_ops>, object=object@entry=TARGET_OBJECT_MEMORY, annex=annex@entry=0x0, buf=buf@entry=0x7f7ffff007df "",
>     offset=offset@entry=18446744071564271445, len=len@entry=1) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/target.c:1651
> #8  0x00000001a21c6db0 in target_read_memory (memaddr=memaddr@entry=18446744071564271445, myaddr=myaddr@entry=0x7f7ffff007df "", len=len@entry=1)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/target.c:1447
> #9  0x00000001a2240ba1 in amd64_stack_frame_destroyed_p (gdbarch=<optimized out>, pc=18446744071564271445)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/amd64-tdep.c:2796
> #10 amd64_epilogue_frame_sniffer (self=<optimized out>, this_frame=0x7f61c7d0d0e0, this_prologue_cache=<optimized out>)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/amd64-tdep.c:2811
> #11 0x00000001a213d26f in frame_unwind_try_unwinder (this_frame=this_frame@entry=0x7f61c7d0d0e0, this_cache=this_cache@entry=0x7f61c7d0d0f8,
>     unwinder=0x1a27540a0 <amd64_epilogue_frame_unwind>) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame-unwind.c:107
> #12 0x00000001a213d5c5 in frame_unwind_find_by_frame (this_frame=this_frame@entry=0x7f61c7d0d0e0, this_cache=this_cache@entry=0x7f61c7d0d0f8)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame-unwind.c:163
> #13 0x00000001a213ea28 in compute_frame_id (fi=0x7f61c7d0d0e0) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame.c:490
> #14 get_prev_frame_if_no_cycle (this_frame=this_frame@entry=0x7f61c7d0d010) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame.c:1822
> #15 0x00000001a2140b3e in get_prev_frame_always_1 (this_frame=0x7f61c7d0d010) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame.c:1996
> #16 get_prev_frame_always (this_frame=this_frame@entry=0x7f61c7d0d010) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame.c:2012
> #17 0x00000001a2141247 in get_prev_frame (this_frame=this_frame@entry=0x7f61c7d0d010) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame.c:2254
> #18 0x00000001a21414c4 in unwind_to_current_frame (ui_out=<optimized out>, args=args@entry=0x7f61c7d0d010)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame.c:1498
> #19 0x00000001a2104a16 in catch_exceptions_with_msg (func_uiout=0x7f61c9127b80, func=func@entry=0x1a21414b8 <unwind_to_current_frame>, func_args=func_args@entry=0x7f61c7d0d010,
>     gdberrmsg=gdberrmsg@entry=0x0, mask=mask@entry=RETURN_MASK_ERROR) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/exceptions.c:183
> #20 0x00000001a2104b7b in catch_exceptions (uiout=<optimized out>, func=func@entry=0x1a21414b8 <unwind_to_current_frame>, func_args=func_args@entry=0x7f61c7d0d010,
>     mask=mask@entry=RETURN_MASK_ERROR) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/exceptions.c:163
> #21 0x00000001a213eb3d in get_current_frame () at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/frame.c:1530
> #22 0x00000001a208f8d3 in backtrace_command_1 (from_tty=1, no_filters=0, show_locals=0, count_exp=0x0)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/stack.c:1761
> #23 backtrace_command (arg=0x0, from_tty=1) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/stack.c:1953
> #24 0x00000001a2115fca in cmd_func (cmd=0x7f61c91fe120, args=0x0, from_tty=1) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/cli/cli-decode.c:1913
> #25 0x00000001a2147a82 in execute_command (p=<optimized out>, from_tty=from_tty@entry=1) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/top.c:674
> #26 0x00000001a21f45ea in thread_apply_all_command (cmd=0x7f61c7d020d1 "bt", from_tty=1) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/thread.c:1810
> #27 0x00000001a2115fca in cmd_func (cmd=0x7f61c8d113a0, args=0x7f61c7d020d1 "bt", from_tty=1)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/cli/cli-decode.c:1913
> #28 0x00000001a2147a82 in execute_command (p=<optimized out>, p@entry=0x7f61c7d020c0 "thread apply all bt", from_tty=1)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/top.c:674
> #29 0x00000001a21e6873 in command_handler (command=0x7f61c7d020c0 "thread apply all bt") at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-top.c:628
> #30 0x00000001a21e6b1b in command_line_handler (rl=<optimized out>) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-top.c:820
> #31 0x00000001a21e5f1f in gdb_rl_callback_handler (rl=0x7f61c7d02080 "\240 \320\307a\177")
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-top.c:200
> #32 0x00000001a235acfc in rl_callback_read_char () at /usr/src/external/gpl3/gdb/dist/readline/callback.c:220
> #33 0x00000001a21e5e4e in gdb_rl_callback_read_char_wrapper (client_data=<optimized out>) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-top.c:173
> #34 0x00000001a21e6359 in stdin_event_handler (error=<optimized out>, client_data=0x7f61c9123090)
>     at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-top.c:555
> #35 0x00000001a2103d20 in gdb_wait_for_event (block=block@entry=1) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-loop.c:859
> #36 0x00000001a2103e52 in gdb_do_one_event () at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-loop.c:347
> #37 0x00000001a2103fbb in gdb_do_one_event () at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-loop.c:304
> #38 start_event_loop () at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/event-loop.c:371
> #39 0x00000001a2088415 in captured_command_loop (data=data@entry=0x0) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/main.c:324
> #40 0x00000001a2104bf5 in catch_errors (func=func@entry=0x1a20883ea <captured_command_loop>, func_args=func_args@entry=0x0, errstring=errstring@entry=0x1a23b5d4e "",
>     mask=mask@entry=RETURN_MASK_ALL) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/exceptions.c:236
> #41 0x00000001a20895bb in captured_main (data=0x7f7ffff01080) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/main.c:1149
> #42 gdb_main (args=0x7f7ffff01080) at /usr/src/external/gpl3/gdb/lib/libgdb/../../dist/gdb/main.c:1159
> #43 0x00000001a23941ea in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/external/gpl3/gdb/bin/gdb/../../dist/gdb/gdb.c:32
>
>  Thomas