Date: Tue, 27 Sep 2005 06:40:42 GMT From: "Yuriy N. Shkandybin" <jura@networks.ru> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/86618: panic with ifconfig nge Message-ID: <200509270640.j8R6egLF086527@www.freebsd.org> Resent-Message-ID: <200509270650.j8R6oEdg084470@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 86618
>Category: kern
>Synopsis: panic with ifconfig nge
>Confidential: no
>Severity: non-critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Sep 27 06:50:14 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Yuriy N. Shkandybin
>Release: RELENG_6
>Organization:
NetAMS
>Environment:
FreeBSD ftp 6.0-BETA5 FreeBSD 6.0-BETA5 #11: Mon Sep 26 17:09:08 MSD 2005 root@server:/usr/obj/usr/src/sys/FTP i386
>Description:
Because sc->nge_ldata allocated without zeroing memory, when nge_stop(sc); and buffers are freed - wrong values might be there.
I belive same problem actual for HEAD too.
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x80030
fault code = supervisor read, page not present
instruction pointer = 0x20:0xc0512a10
stack pointer = 0x28:0xe4d16b3c
frame pointer = 0x28:0xe4d16b4c
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 2818 (ifconfig)
[thread pid 2818 tid 100118 ]
Stopped at m_freem+0x10: testb $0x1,0x10(%eax)
db> trace
Tracing pid 2818 tid 100118 td 0xc1f91a80
m_freem(80020,0,c1fb8400,80206910,c1fa2900) at m_freem+0x10
nge_stop(c1ec7bb8,c244c9d4,805f000,0,e4d16bc4) at nge_stop+0x1b8
nge_init_locked(2,c1f934a0,0,c1f93400,c1fb8400) at nge_init_locked+0x2a
nge_ioctl(c1fb8400,80206910,c2658cc0,c1eb92c0,c2556bcc) at nge_ioctl+0x2f1
ifhwioctl(c2658cc0,c1f91a80,c05d2298,c06a4020,c065e213) at ifhwioctl+0x634
ifioctl(c2556b20,80206910,c2658cc0,c1f91a80,0) at ifioctl+0x68
soo_ioctl(c21a4ab0,80206910,c2658cc0,c2529000,c1f91a80) at soo_ioctl+0x2e8
ioctl(c1f91a80,e4d16d04,c,c,c1f91a80) at ioctl+0x115
syscall(3b,3b,3b,3,1) at syscall+0x223
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (54, FreeBSD ELF32, ioctl), eip = 0x480db35f, esp = 0xbfbfe3dc, ebp = 0xbfbfe428 ---
kgdb
#7 0xc0635164 in trap (frame=
{tf_fs = -415563768, tf_es = 40, tf_ds = 40, tf_edi = -1040566016, tf_esi = 11, tf_ebp = -415499444, tf_isp = -415499480, tf_ebx = 352, tf_edx = 524320, tf_ecx = 55296, tf_eax = 524320, tf_trapno = 12, tf_err = 0, tf_eip = -1068416848, tf_cs = 32, tf_eflags = 66050, tf_esp = 1000000, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:442
#8 0xc061aaca in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#9 0xc05140b0 in m_freem (mb=0x80020) at mbuf.h:420
#10 0xc0471478 in nge_stop (sc=0xc1fa3900) at /usr/src/sys/dev/nge/if_nge.c:2125
#11 0xc04719da in nge_init_locked (sc=0xc1fa3900) at /usr/src/sys/dev/nge/if_nge.c:1685
#12 0xc04732a1 in nge_ioctl (ifp=0xc1fb8400, command=2149607696, data=0xc26f61a0 "nge0")
at /usr/src/sys/dev/nge/if_nge.c:2018
#13 0xc055a8d4 in ifhwioctl (cmd=0, ifp=0xc1fb8400, data=0xc26f61a0 "nge0", td=0x80020) at /usr/src/sys/net/if.c:1272
#14 0xc055b108 in ifioctl (so=0xc25c2858, cmd=2149607696, data=0xc26f61a0 "nge0", td=0xc24c9a80)
at /usr/src/sys/net/if.c:1506
#15 0xc0502308 in soo_ioctl (fp=0x80020, cmd=2149607696, data=0xc26f61a0, active_cred=0xc2190c00, td=0xc24c9a80)
at /usr/src/sys/kern/sys_socket.c:214
#16 0xc04fac95 in ioctl (td=0xc24c9a80, uap=0xe73bfd04) at file.h:258
#17 0xc0635643 in syscall (frame=
{tf_fs = 59, tf_es = 59, tf_ds = -1078001605, tf_edi = 3, tf_esi = 1, tf_ebp = -1077943256, tf_isp = -415498908, tf_ebx = -1077943312, tf_edx = -2145359600, tf_ecx = 134595453, tf_eax = 54, tf_trapno = 12, tf_err = 2, tf_eip = 1208857439, tf_cs = 51, tf_eflags = 583, tf_esp = -1077943332, tf_ss = 59}) at /usr/src/sys/i386/i386/trap.c:986
#18 0xc061ab1f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
#19 0x00000033 in ?? ()
>How-To-Repeat:
ifconfig nge0 up
>Fix:
--- if_nge.c.orig Mon Sep 26 17:02:00 2005
+++ if_nge.c.my Mon Sep 26 16:59:26 2005
@@ -839,7 +839,7 @@
/* XXX: leaked on error */
sc->nge_ldata = contigmalloc(sizeof(struct nge_list_data), M_DEVBUF,
- M_NOWAIT, 0, 0xffffffff, PAGE_SIZE, 0);
+ M_NOWAIT|M_ZERO, 0, 0xffffffff, PAGE_SIZE, 0);
if (sc->nge_ldata == NULL) {
printf("nge%d: no memory for list buffers!\n", unit);
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200509270640.j8R6egLF086527>