Date: Sun, 15 Apr 2018 21:20:30 -0700 From: Eitan Adler <lists@eitanadler.com> To: FreeBSD Hackers <freebsd-hackers@freebsd.org> Subject: panic: ip_mroute: empty ef->progtab[i].name Message-ID: <CAF6rxgmHZm1H08DX2nxdq_3pBckEU0MTzba0P1S79d1W6EB_2w@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
How to reproduce:
kldload ip_mroute
Unread portion of the kernel message buffer:
[341188]
[341188]
[341188] Fatal trap 12: page fault while in kernel mode
[341188] cpuid = 17; apic id = 11
[341188] fault virtual address = 0x0
[341188] fault code = supervisor read data, page not present
[341188] instruction pointer = 0x20:0xffffffff80c50cd0
[341188] stack pointer = 0x28:0xfffffe00a741c440
[341188] frame pointer = 0x28:0xfffffe00a741c440
[341188] code segment = base 0x0, limit 0xfffff, type 0x1b
[341188] = DPL 0, pres 1, long 1, def32 0, gran 1
[341188] processor eflags = interrupt enabled, resume, IOPL = 0
[341188] current process = 31597 (kldload)
__curthread () at ./machine/pcpu.h:230
230 __asm("movq %%gs:%1,%0" : "=r" (td)
(kgdb) bt
#0 __curthread () at ./machine/pcpu.h:230
#1 doadump (textdump=0x1) at /usr/src/sys/kern/kern_shutdown.c:361
#2 0xffffffff80434f4c in db_fncall_generic (addr=<optimized out>,
rv=<optimized out>, nargs=<optimized out>, args=<optimized out>) at
/usr/src/sys/ddb/db_command.c:609
#3 db_fncall (dummy1=<optimized out>, dummy2=<optimized out>,
dummy3=<optimized out>, dummy4=<optimized out>) at
/usr/src/sys/ddb/db_command.c:657
#4 0xffffffff80434a99 in db_command (last_cmdp=<optimized out>,
cmd_table=<optimized out>, dopager=<optimized out>) at
/usr/src/sys/ddb/db_command.c:481
#5 0xffffffff80434814 in db_command_loop () at
/usr/src/sys/ddb/db_command.c:534
#6 0xffffffff80437a3f in db_trap (type=<optimized out>,
code=<optimized out>) at /usr/src/sys/ddb/db_main.c:250
#7 0xffffffff80babf53 in kdb_trap (type=0xc, code=0x0, tf=<optimized
out>) at /usr/src/sys/kern/subr_kdb.c:697
#8 0xffffffff81025170 in trap_fatal (frame=0xfffffe00a741c380,
eva=0x0) at /usr/src/sys/amd64/amd64/trap.c:815
#9 0xffffffff81025282 in trap_pfault (frame=0xfffffe00a741c380,
usermode=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:664
#10 0xffffffff81024a72 in trap (frame=0xfffffe00a741c380) at
/usr/src/sys/amd64/amd64/trap.c:413
#11 <signal handler called>
#12 strncmp (s1=0x0, s2=0xffffffff812562ea "set_", n=0x4) at
/usr/src/sys/libkern/strncmp.c:44
#13 0xffffffff8114f214 in link_elf_lookup_set (lf=0xfffff8003930c800,
name=0xffffffff83bacc82 "sdt_providers_set",
startp=0xfffffe00a741c4a0, stopp=0xfffffe00a741c4a8, countp=0x0) at
/usr/src/sys/kern/link_elf_obj.c:1265
#14 0xffffffff83bac5e9 in sdt_kld_unload_try (arg=<optimized out>,
lf=0xfffff8003930cc00, error=0xfffffe00a741c504) at
/usr/src/sys/cddl/dev/sdt/sdt.c:314
#15 0xffffffff80b3712b in linker_file_unload (file=0xfffff8003930c800,
flags=0x1) at /usr/src/sys/kern/kern_linker.c:656
#16 0xffffffff8114d76f in link_elf_load_file (cls=<optimized out>,
filename=<optimized out>, result=<optimized out>) at
/usr/src/sys/kern/link_elf_obj.c:1002
#17 0xffffffff80b36a2c in LINKER_LOAD_FILE (cls=0xffffffff81b7dc80
<link_elf_class>, result=0x0, filename=<optimized out>) at
./linker_if.h:180
#18 linker_load_file (filename=<optimized out>, result=<optimized
out>) at /usr/src/sys/kern/kern_linker.c:447
#19 linker_load_module (kldname=<optimized out>, modname=0x0,
parent=0x0, verinfo=<optimized out>, lfpp=0xfffffe00a741c918) at
/usr/src/sys/kern/kern_linker.c:2092
#20 0xffffffff80b38361 in kern_kldload (td=<optimized out>,
file=<optimized out>, fileid=0xfffffe00a741c964) at
/usr/src/sys/kern/kern_linker.c:1071
#21 0xffffffff80b3848b in sys_kldload (td=0xfffff800461cc560,
uap=<optimized out>) at /usr/src/sys/kern/kern_linker.c:1097
#22 0xffffffff8102606b in syscallenter (td=0xfffff800461cc560) at
/usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:134
#23 amd64_syscall (td=0xfffff800461cc560, traced=0x0) at
/usr/src/sys/amd64/amd64/trap.c:936
#24 <signal handler called>
#25 0x00000008002cfd8a in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffffffd468
(kgdb) frame 12
Stack level 12, frame at 0xfffffe00a741c450:
rip = 0xffffffff80c50cd0 in strncmp
(/usr/src/sys/libkern/strncmp.c:44); saved rip = 0xffffffff8114f214
called by frame at 0xfffffe00a741c4a0, caller of frame at 0xfffffe00a741c440
source language c.
Arglist at 0xfffffe00a741c440, args: s1=0x0, s2=0xffffffff812562ea
"set_", n=0x4
Locals at 0xfffffe00a741c440, Previous frame's sp is 0xfffffe00a741c450
Saved registers:
rbp at 0xfffffe00a741c440, rip at 0xfffffe00a741c448
s1 = 0x0
s2 = 0xffffffff812562ea "set_"
n = 0x4
No locals.
(kgdb) list
1260 void **start, **stop;
1261 int i, count;
1262
1263 /* Relative to section number */
1264 for (i = 0; i < ef->nprogtab; i++) {
1265 if ((strncmp(ef->progtab[i].name, "set_", 4) == 0) &&
1266 strcmp(ef->progtab[i].name + 4, name) == 0) {
1267 start = (void **)ef->progtab[i].addr;
1268 stop = (void **)((char *)ef->progtab[i].addr +
1269 ef->progtab[i].size);
(kgdb) p ef->progtab[i]
$8 = {
addr = 0x0,
size = 0x0,
flags = 0x0,
sec = 0x0,
name = 0x0
}
--
Eitan Adler
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAF6rxgmHZm1H08DX2nxdq_3pBckEU0MTzba0P1S79d1W6EB_2w>