https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254496
Bug ID: 254496
Summary: kernel panic when destroying interface with ECMP route
Product: Base System
Version: 13.0-STABLE
Hardware: amd64
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: b...@freebsd.org
Reporter: zlei.hu...@gmail.com
Created attachment 223516
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=223516&action=edit
Core text dump
I was trying to reproduce bug #254303 , and found another bug, not sure if it
is related.
Steps to repeat:
1. Fresh install FreeBSD 13.0 RC3
2. Run the following script
<pre><code>
# set up interface and add ECMP route
tap=$( ifconfig tap create inet 10.10.10.1/24 )
route -n add 10.0.0.0 10.10.10.2
route -n add 10.0.0.0 10.10.10.3
# destroy interface to trigger the panic
ifconfig $tap destroy
</code></pre>
Kernel panic core dump text summary:
Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x38
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80d48f38
stack pointer = 0x28:0xfffffe0044dd6a80
frame pointer = 0x28:0xfffffe0044dd6a80
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 0 (softirq_0)
trap number = 12
panic: page fault
cpuid = 0
time = 1616522291
KDB: stack backtrace:
#0 0xffffffff80c570b5 at kdb_backtrace+0x65
#1 0xffffffff80c09cd1 at vpanic+0x181
#2 0xffffffff80c09b43 at panic+0x43
#3 0xffffffff8108a187 at trap_fatal+0x387
#4 0xffffffff8108a1df at trap_pfault+0x4f
#5 0xffffffff8108983d at trap+0x27d
#6 0xffffffff810612c8 at calltrap+0x8
#7 0xffffffff80d4b1de at destroy_rtentry_epoch+0x2e
#8 0xffffffff80c51e2a at epoch_call_task+0x16a
#9 0xffffffff80c55b1d at gtaskqueue_run_locked+0x15d
#10 0xffffffff80c557bc at gtaskqueue_thread_loop+0xac
#11 0xffffffff80bc7c0e at fork_exit+0x7e
#12 0xffffffff8106234e at fork_trampoline+0xe
Uptime: 18s
Dumping 137 out of 472 MB:..12%..24%..36%..47%..59%..71%..82%..94%
__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
55 __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct
pcpu,
(kgdb) #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1 doadump (textdump=<optimized out>)
at /usr/src/sys/kern/kern_shutdown.c:399
#2 0xffffffff80c098c6 in kern_reboot (howto=260)
at /usr/src/sys/kern/kern_shutdown.c:486
#3 0xffffffff80c09d40 in vpanic (fmt=<optimized out>, ap=<optimized out>)
at /usr/src/sys/kern/kern_shutdown.c:919
#4 0xffffffff80c09b43 in panic (fmt=<unavailable>)
at /usr/src/sys/kern/kern_shutdown.c:843
#5 0xffffffff8108a187 in trap_fatal (frame=0xfffffe0044dd69c0, eva=56)
at /usr/src/sys/amd64/amd64/trap.c:915
#6 0xffffffff8108a1df in trap_pfault (frame=frame@entry=0xfffffe0044dd69c0,
usermode=false, signo=<optimized out>, signo@entry=0x0,
ucode=<optimized out>, ucode@entry=0x0)
at /usr/src/sys/amd64/amd64/trap.c:732
#7 0xffffffff8108983d in trap (frame=0xfffffe0044dd69c0)
at /usr/src/sys/amd64/amd64/trap.c:398
#8 <signal handler called>
#9 0xffffffff80d48f38 in nhop_get_vnet (nh=0xfffff8001458b980)
at /usr/src/sys/net/route/nhop_ctl.c:761
#10 0xffffffff80d4b1de in destroy_rtentry (rt=0xfffff80014627840)
at /usr/src/sys/net/route/route_ctl.c:139
#11 destroy_rtentry_epoch (ctx=0xfffff800146278e0)
at /usr/src/sys/net/route/route_ctl.c:159
#12 0xffffffff80c51e2a in epoch_call_task (arg=<optimized out>)
at /usr/src/sys/kern/subr_epoch.c:816
#13 0xffffffff80c55b1d in gtaskqueue_run_locked (
queue=queue@entry=0xfffff8000332b900)
at /usr/src/sys/kern/subr_gtaskqueue.c:371
#14 0xffffffff80c557bc in gtaskqueue_thread_loop (arg=<optimized out>,
arg@entry=0xfffffe0044f09008) at /usr/src/sys/kern/subr_gtaskqueue.c:547
#15 0xffffffff80bc7c0e in fork_exit (
callout=0xffffffff80c55710 <gtaskqueue_thread_loop>,
arg=0xfffffe0044f09008, frame=0xfffffe0044dd6c00)
at /usr/src/sys/kern/kern_fork.c:1069
#16 <signal handler called>
(kgdb)
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
