Re: kern/51828: Panic after configuring vlan on nonexistent phys interface

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

On Thu, Jan 12, 2017 at 12:45 AM, Hauke Fath <hf%spg.tu-darmstadt.de@localhost> wrote:
>>Number:         51828
>>Category:       kern
>>Synopsis:       Panic after configuring vlan on nonexistent phys interface
>>Confidential:   no
>>Severity:       critical
>>Priority:       medium
>>Responsible:    kern-bug-people
>>State:          open
>>Class:          sw-bug
>>Submitter-Id:   net
>>Arrival-Date:   Wed Jan 11 15:45:00 +0000 2017
>>Originator:     Hauke Fath
>>Release:        NetBSD 7.99.57
>>Organization:
> Technische Universitaet Darmstadt
>>Environment:
>
>
> System: NetBSD 7.99.57 (FIFI-$Revision$) #0: Tue Jan 10 15:12:17 CET
> 2017
>
> hf@Hochstuhl:/var/obj/netbsd-builds/developer/amd64/sys/arch/amd64/compile/FIFI
> Architecture: x86_64
> Machine: amd64
>>Description:
>
>         For testing purposes, I brought a NetBSD 7 pf / pfsync / carp
>         setup to a different machine. Some of its physical interfaces
>         are disconnected.
>
>         The netbsd-7 kernel complained, and moved on.
>
>         A netbsd-current DIAGNOSTIC / DEBUG kernel panics:
>
> [...]
> IPv6 mode: host
> Configuring network interfaces: wm0 wm1wm1: link state DOWN (was
> UNKNOWN)
>  wm3wm3: link state DOWN (was UNKNOWN)
>  vlan2 vlan3 vlan7 vlan8 vlan9 vlan10 vlan11 vlan12 carp0ifconfig:
> SIOCAIFADDR_IN6: Can'tfatal page fault in supervisor mode
> trap type 6 code 0 rip ffffffff804655c6 cs 8 rflags 10207 cr2 d56
> ilevel 5 rsp fffffe8040093db0
> curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
> panic: trap
> cpu4: Begin traceback...
> vpanic() at netbsd:vpanic+0x140
> snprintf() at netbsd:snprintf
> trap() at netbsd:trap+0xb86
> --- trap (number 6) ---
> psref_acquire() at netbsd:psref_acquire+0x65
> in6ifa_ifpforlinklocal_psref() at
> netbsd:in6ifa_ifpforlinklocal_psref+0x3a
> mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
> mld_start_listening() at netbsd:mld_start_listening+0x89
> mld_timeo() at netbsd:mld_timeo+0x6f
> callout_softclock() at netbsd:callout_softclock+0x201
> softint_dispatch() at netbsd:softint_dispatch+0xd9
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> cpu4: End traceback...
>
> dumping to dev 18,1 (offset=3903183, size=1048102):
> dump  assign requested address
> fatal page fault in supervisor mode
> trap type 6 code 0 rip ffffffff80118d2a cs 8 rflags 10246 cr2 38 ilevel
> 8 rsp fffffe8040093ac0
> curlwp 0xfffffe81074caa40 pid 0.38 lowest kstack 0xfffffe80400902c0
> Skipping crash dump on recursive panic
> panic: trap
> cpu4: Begin traceback...
> vpanic() at netbsd:vpanic+0x140
> snprintf() at netbsd:snprintf
> trap() at netbsd:trap+0xb86
> --- trap (number 6) ---
> sparse_dump_mark() at netbsd:sparse_dump_mark+0x10c
> dump_seg_prep() at netbsd:dump_seg_prep+0x22
> dodumpsys() at netbsd:dodumpsys+0xbe
> dumpsys() at netbsd:dumpsys+0x1d
> vpanic() at netbsd:vpanic+0x149
> snprintf() at netbsd:snprintf
> trap() at netbsd:trap+0xb86
> --- trap (number 6) ---
> psref_acquire() at netbsd:psref_acquire+0x65
> in6ifa_ifpforlinklocal_psref() at
> netbsd:in6ifa_ifpforlinklocal_psref+0x3a
> mld_sendpkt.isra.4() at netbsd:mld_sendpkt.isra.4+0x66
> mld_start_listening() at netbsd:mld_start_listening+0x89
> mld_timeo() at netbsd:mld_timeo+0x6f
> callout_softclock() at netbsd:callout_softclock+0x201
> softint_dispatch() at netbsd:softint_dispatch+0xd9
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040093ff0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> cpu4: End traceback...
> rebooting...
>
>
>
>>How-To-Repeat:
>
>         Run a DEBUG/DIAGNOSTIC -current kernel with multiple network
> interfaces, some with conflicting setup.

Does the panic happen without DEBUG?

It seems that a DEBUG code in psref causes the panic. I don't have any
ideas why it happens for now though...

Thanks,
  ozaki-r