Re: kern/51522

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

On Thu, Oct 27, 2016 at 11:15 PM, Tom Ivar Helbekkmo
<tih%hamartun.priv.no@localhost> wrote:
> The following reply was made to PR kern/51522; it has been noted by GNATS.
>
> From: Tom Ivar Helbekkmo <tih%hamartun.priv.no@localhost>
> To: gnats-bugs%netbsd.org@localhost
> Cc:
> Subject: Re: kern/51522
> Date: Thu, 27 Oct 2016 16:10:51 +0200
>
>  After more than a week, I finally had another crash, but this is
>  probably something different...?

I guess so...

BTW if you revert the change for mbuf debugging, the panic
due to a double free happens again? I worry that
the debugging code may hide the issue.

  ozaki-r

>
>  dmesg:
>
>  uvm_fault(0xffffffff81303840, 0x0, 1) -> e
>  fatal page fault in supervisor mode
>  trap type 6 code 0 rip ffffffff806401c3 cs 8 rflags 10246 cr2 78 ilevel 4 rsp fffffe8100514e68
>  curlwp 0xfffffe8100602220 pid 0.67 lowest kstack 0xfffffe81005112c0
>  panic: trap
>  cpu2: Begin traceback...
>  vpanic() at netbsd:vpanic+0x140
>  snprintf() at netbsd:snprintf
>  trap() at netbsd:trap+0xc4b
>  --- trap (number 6) ---
>  pf_state_tree_ext_gwy_RB_REMOVE_COLOR() at netbsd:pf_state_tree_ext_gwy_RB_REMOVE_COLOR+0xcf
>  pf_state_tree_ext_gwy_RB_REMOVE() at netbsd:pf_state_tree_ext_gwy_RB_REMOVE+0xca
>  pf_detach_state() at netbsd:pf_detach_state+0x8b
>  pf_purge_expired_states() at netbsd:pf_purge_expired_states+0x73
>  pf_purge_thread() at netbsd:pf_purge_thread+0x69
>  cpu2: End traceback...
>
>  backtrace:
>
>  0xffffffff80119ab5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
>      at /usr/src/sys/arch/amd64/amd64/machdep.c:676
>  676                     dumpsys();
>  (gdb) bt
>  #0  0xffffffff80119ab5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
>      at /usr/src/sys/arch/amd64/amd64/machdep.c:676
>  #1  0xffffffff808ad97c in vpanic (fmt=fmt@entry=0xffffffff80ed4fdb "trap", ap=ap@entry=0xfffffe8100514c38)
>      at /usr/src/sys/kern/subr_prf.c:342
>  #2  0xffffffff808ada30 in panic (fmt=fmt@entry=0xffffffff80ed4fdb "trap") at /usr/src/sys/kern/subr_prf.c:258
>  #3  0xffffffff8011b736 in trap (frame=0xfffffe8100514d70) at /usr/src/sys/arch/amd64/amd64/trap.c:298
>  #4  0xffffffff8010115e in alltraps ()
>  #5  0xffffffff806401c3 in pf_state_tree_ext_gwy_RB_REMOVE_COLOR (head=0xffffffff8128cea0 <pf_statetbl_ext_gwy>,
>      parent=0xfffffe81129c1160, elm=0x0) at /usr/src/sys/dist/pf/net/pf.c:337
>  #6  0xffffffff8064051e in pf_state_tree_ext_gwy_RB_REMOVE (head=head@entry=0xffffffff8128cea0 <pf_statetbl_ext_gwy>,
>      elm=<optimized out>, elm@entry=0xfffffe81129c1d40) at /usr/src/sys/dist/pf/net/pf.c:337
>  #7  0xffffffff806456b6 in pf_detach_state (s=<optimized out>, flags=flags@entry=0)
>      at /usr/src/sys/dist/pf/net/pf.c:3042
>  #8  0xffffffff806459d8 in pf_unlink_state (cur=<optimized out>) at /usr/src/sys/dist/pf/net/pf.c:1086
>  #9  0xffffffff80645ae7 in pf_purge_expired_states (maxcheck=18) at /usr/src/sys/dist/pf/net/pf.c:1148
>  #10 0xffffffff80645baa in pf_purge_thread (v=<optimized out>) at /usr/src/sys/dist/pf/net/pf.c:950
>  #11 0xffffffff801008d7 in lwp_trampoline ()
>  #12 0x0000000000000000 in ?? ()
>