NetBSD Problem Report #54244

From khorben@defora.org  Wed May 29 00:02:59 2019
Return-Path: <khorben@defora.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id F0AAD7A188
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 29 May 2019 00:02:58 +0000 (UTC)
Message-Id: <20190529000238.2B02C10AF0@tungsten.defora.rom>
Date: Wed, 29 May 2019 02:01:49 +0200 (CEST)
From: Pierre Pronchery <khorben@defora.org>
Reply-To:
To: gnats-bugs@NetBSD.org
Subject: Panic in dev_findproduct() with 8.0_STABLE
X-Send-Pr-Version: 3.95

>Number:         54244
>Category:       kern
>Synopsis:       Page fault in dev_findproduct()
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 29 00:05:00 +0000 2019
>Last-Modified:  Sun Jun 09 23:45:01 +0000 2019
>Originator:     Pierre Pronchery <khorben@defora.org>
>Release:        NetBSD 8.0_STABLE
>Organization:
>Environment:
System: NetBSD hostname 8.1_RC1 NetBSD 8.1_RC1 (GENERIC) amd64
Architecture: x86_64
Machine: amd64
>Description:
On a Lenovo T440s with root filesystem encryption (and therefore init
chrooting first thing) I got the following panic:

uvm_fault(0xffffffff8154b3c0, 0xffffffff82288000, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip 0xffffffff8051f1a8 cs 0x8 rflags 0x10206 cr2 0xffffffff82288000 ilevel 0 rsp 0xffff8000f2c32bd0
curlwp 0xfffffe83217c70c0 pid 4517.3 lowest kstack 0xffff8000f2c302c0
panic: trap
cpu1: Begin traceback...
vpanic() at netbsd:vpanic+0x15d
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xa00
--- trap (number 6) ---
dev_findproduct() at netbsd:dev_findproduct+0x32
?() at ffffffff8228c033
usbd_fill_deviceinfo() at netbsd:usbd_fill_deviceinfo+0x68
ugenioctl() at netbsd:ugenioctl+0x4d4
cdev_ioctl() at netbsd:cdev_ioctl+0xb4
VOP_IOCTL() at netbsd:VOP_IOCTL+0x54
vn_ioctl() at netbsd:vn_ioctl+0xa6
sys_ioctl() at netbsd:sys_ioctl+0x11a
syscall() at netbsd:syscall+0x1ec
--- syscall (number 54) ---
710a322cec3a:
cpu1: End traceback...

This was under heavy CPU activity. This information might also be useful:
$ dmesg | grep ^ugen
ugen0 at uhub5 port 5
ugen0: Generic (0x58f) EMV Smartcard Reader (0x9540), rev 2.01/1.20, addr 3
ugen1 at uhub1 port 6
ugen1: vendor 138a (0x138a) product 0017 (0x17), rev 1.10/0.78, addr 8

I usually have pcscd running in the background.
>How-To-Repeat:
I wasn't doing anything I swear!
>Fix:
Unknown.

>Audit-Trail:
From: David Holland <dholland-bugs@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/54244: Panic in dev_findproduct() with 8.0_STABLE
Date: Sun, 9 Jun 2019 23:44:40 +0000

 On Wed, May 29, 2019 at 12:05:00AM +0000, Pierre Pronchery wrote:
  > uvm_fault(0xffffffff8154b3c0, 0xffffffff82288000, 1) -> e
  > fatal page fault in supervisor mode
  > trap type 6 code 0 rip 0xffffffff8051f1a8 cs 0x8 rflags 0x10206 cr2 0xffffffff82288000 ilevel 0 rsp 0xffff8000f2c32bd0
  > curlwp 0xfffffe83217c70c0 pid 4517.3 lowest kstack 0xffff8000f2c302c0
  > panic: trap
  > cpu1: Begin traceback...
  > vpanic() at netbsd:vpanic+0x15d
  > snprintf() at netbsd:snprintf
  > trap() at netbsd:trap+0xa00
  > --- trap (number 6) ---
  > dev_findproduct() at netbsd:dev_findproduct+0x32
  > ?() at ffffffff8228c033
  > usbd_fill_deviceinfo() at netbsd:usbd_fill_deviceinfo+0x68

 The only reasonable explanation for this is that the products[] array
 passed to dev_findproduct was corrupted - it appears to have faulted
 on the products[n] lookup on line 93.

 However at least on casual inspection I don't see how
 usbd_fill_deviceinfo gets to dev_findproduct or what that ?() is;
 maybe someone else can take it form here...

 -- 
 David A. Holland
 dholland@netbsd.org

>Unformatted:
 On the netbsd-8 branch around commit "Tickets #1255 - #1257"

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.43 2018/01/16 07:36:43 maya Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2017 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.