NetBSD Problem Report #55680
From kim@gw.fi Tue Sep 22 15:35:29 2020
Return-Path: <kim@gw.fi>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 617FF1A9217
for <gnats-bugs@gnats.NetBSD.org>; Tue, 22 Sep 2020 15:35:29 +0000 (UTC)
Message-Id: <20200922153507.ED8D96837C@chronologie.gw.fi>
Date: Tue, 22 Sep 2020 18:35:07 +0300 (EEST)
From: kim@netbsd.org (Kimmo Suominen)
To: gnats-bugs@NetBSD.org
Subject: llentry_free panic
X-Send-Pr-Version: 3.95
>Number: 55680
>Category: kern
>Synopsis: llentry_free panic
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Tue Sep 22 15:40:00 +0000 2020
>Last-Modified: Mon Aug 08 17:10:02 +0000 2022
>Originator: Kimmo Suominen
>Release: NetBSD 9.0_STABLE (202009201240Z)
>Organization:
>Environment:
System: NetBSD chronologie.gw.fi 9.0_STABLE NetBSD 9.0_STABLE (GENERIC) #0: Sun Sep 20 10:17:44 UTC 2020 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
I rebooted the currently selected default router (high pref) and the system paniced.
panic: pr_item_bitmap_put: [llentrypl] 0xffff88bff9db2330 already freed
cpu1: Begin traceback...
vpanic() at netbsd:vpanic+0x160
snprintf() at netbsd:snprintf
pool_put() at netbsd:pool_put+0x492
llentry_free() at netbsd:llentry_free+0xad
nd6_free() at netbsd:nd6_free+0x161
nd6_llinfo_timer() at netbsd:nd6_llinfo_timer+0x388
callout_softclock() at netbsd:callout_softclock+0xc6
softint_dispatch() at netbsd:softint_dispatch+0xab
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xffffcc8031e9b0f0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
cpu1: End traceback...
>How-To-Repeat:
Reboot a router?
>Fix:
>Audit-Trail:
From: Ryota Ozaki <ozaki-r@netbsd.org>
To: Kimmo Suominen <kim@netbsd.org>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/55680: llentry_free panic
Date: Wed, 23 Sep 2020 11:52:36 +0900
On Wed, Sep 23, 2020 at 12:40 AM Kimmo Suominen <kim@netbsd.org> wrote:
>
> >Number: 55680
> >Category: kern
> >Synopsis: llentry_free panic
> >Confidential: no
> >Severity: non-critical
> >Priority: medium
> >Responsible: kern-bug-people
> >State: open
> >Class: sw-bug
> >Submitter-Id: net
> >Arrival-Date: Tue Sep 22 15:40:00 +0000 2020
> >Originator: Kimmo Suominen
> >Release: NetBSD 9.0_STABLE (202009201240Z)
> >Organization:
> >Environment:
> System: NetBSD chronologie.gw.fi 9.0_STABLE NetBSD 9.0_STABLE (GENERIC) #0: Sun Sep 20 10:17:44 UTC 2020 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
> Architecture: x86_64
> Machine: amd64
> >Description:
> I rebooted the currently selected default router (high pref) and the system paniced.
>
> panic: pr_item_bitmap_put: [llentrypl] 0xffff88bff9db2330 already freed
> cpu1: Begin traceback...
> vpanic() at netbsd:vpanic+0x160
> snprintf() at netbsd:snprintf
> pool_put() at netbsd:pool_put+0x492
> llentry_free() at netbsd:llentry_free+0xad
> nd6_free() at netbsd:nd6_free+0x161
> nd6_llinfo_timer() at netbsd:nd6_llinfo_timer+0x388
> callout_softclock() at netbsd:callout_softclock+0xc6
> softint_dispatch() at netbsd:softint_dispatch+0xab
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xffffcc8031e9b0f0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> cpu1: End traceback...
> >How-To-Repeat:
> Reboot a router?
> >Fix:
>
One question. Is net.inet6.ip6.forwarding of your system 1 or 0?
Thanks,
ozaki-r
From: Kimmo Suominen <kim@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/55680: llentry_free panic
Date: Wed, 23 Sep 2020 07:06:35 +0300
Hi!
> sysctl net.inet6.ip6.forwarding
net.inet6.ip6.forwarding = 0
And normally there are two routers learned by the kernel from RAs (not
running dhcpcd):
> ndp -r
fe80::822a:a8ff:fe4f:8c3a%vioif0 if=vioif0, flags=, pref=high, expire=21m43s
fe80::de9f:dbff:fe28:91fa%vioif0 if=vioif0, flags=, pref=medium, expire=28m49s
I've rebooted the same router (pref=high) two more times since without
a panic, so it would appear to be timing related.
Kind regards,
+ Kimmo
On Wed, 23 Sep 2020 at 05:55, Ryota Ozaki <ozaki-r@netbsd.org> wrote:
>
> The following reply was made to PR kern/55680; it has been noted by GNATS.
>
> From: Ryota Ozaki <ozaki-r@netbsd.org>
> To: Kimmo Suominen <kim@netbsd.org>
> Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org,
> gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
> Subject: Re: kern/55680: llentry_free panic
> Date: Wed, 23 Sep 2020 11:52:36 +0900
>
> On Wed, Sep 23, 2020 at 12:40 AM Kimmo Suominen <kim@netbsd.org> wrote:
> >
> > >Number: 55680
> > >Category: kern
> > >Synopsis: llentry_free panic
> > >Confidential: no
> > >Severity: non-critical
> > >Priority: medium
> > >Responsible: kern-bug-people
> > >State: open
> > >Class: sw-bug
> > >Submitter-Id: net
> > >Arrival-Date: Tue Sep 22 15:40:00 +0000 2020
> > >Originator: Kimmo Suominen
> > >Release: NetBSD 9.0_STABLE (202009201240Z)
> > >Organization:
> > >Environment:
> > System: NetBSD chronologie.gw.fi 9.0_STABLE NetBSD 9.0_STABLE (GENERIC) #0: Sun Sep 20 10:17:44 UTC 2020 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
> > Architecture: x86_64
> > Machine: amd64
> > >Description:
> > I rebooted the currently selected default router (high pref) and the system paniced.
> >
> > panic: pr_item_bitmap_put: [llentrypl] 0xffff88bff9db2330 already freed
> > cpu1: Begin traceback...
> > vpanic() at netbsd:vpanic+0x160
> > snprintf() at netbsd:snprintf
> > pool_put() at netbsd:pool_put+0x492
> > llentry_free() at netbsd:llentry_free+0xad
> > nd6_free() at netbsd:nd6_free+0x161
> > nd6_llinfo_timer() at netbsd:nd6_llinfo_timer+0x388
> > callout_softclock() at netbsd:callout_softclock+0xc6
> > softint_dispatch() at netbsd:softint_dispatch+0xab
> > DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xffffcc8031e9b0f0
> > Xsoftintr() at netbsd:Xsoftintr+0x4f
> > --- interrupt ---
> > 0:
> > cpu1: End traceback...
> > >How-To-Repeat:
> > Reboot a router?
> > >Fix:
> >
>
> One question. Is net.inet6.ip6.forwarding of your system 1 or 0?
>
> Thanks,
> ozaki-r
>
From: Ryota Ozaki <ozaki-r@netbsd.org>
To: Kimmo Suominen <kim@netbsd.org>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/55680: llentry_free panic
Date: Wed, 23 Sep 2020 16:19:10 +0900
On Wed, Sep 23, 2020 at 1:06 PM Kimmo Suominen <kim@netbsd.org> wrote:
>
> Hi!
>
> > sysctl net.inet6.ip6.forwarding
> net.inet6.ip6.forwarding = 0
>
> And normally there are two routers learned by the kernel from RAs (not
> running dhcpcd):
>
> > ndp -r
> fe80::822a:a8ff:fe4f:8c3a%vioif0 if=vioif0, flags=, pref=high, expire=21m43s
> fe80::de9f:dbff:fe28:91fa%vioif0 if=vioif0, flags=, pref=medium, expire=28m49s
>
> I've rebooted the same router (pref=high) two more times since without
> a panic, so it would appear to be timing related.
Thanks! The information is helpful.
One more question. Do you customize your kernel configuration?
(esp. is DIAGNOSTIC enabled?)
Thanks,
ozaki-r
From: Kimmo Suominen <kim@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/55680: llentry_free panic
Date: Wed, 23 Sep 2020 10:32:51 +0300
The panic is from the GENERIC kernel from the netbsd-9 daily build 202009201240Z
From: Ryota Ozaki <ozaki-r@netbsd.org>
To: Kimmo Suominen <kim@netbsd.org>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/55680: llentry_free panic
Date: Wed, 23 Sep 2020 18:33:14 +0900
On Wed, Sep 23, 2020 at 4:33 PM Kimmo Suominen <kim@netbsd.org> wrote:
>
> The panic is from the GENERIC kernel from the netbsd-9 daily build 202009201240Z
Okay, thanks. That's also needed information to investigate.
ozaki-r
From: Ryota Ozaki <ozaki-r@netbsd.org>
To: Kimmo Suominen <kim@netbsd.org>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/55680: llentry_free panic
Date: Fri, 25 Sep 2020 16:32:19 +0900
Hi,
I have not yet reproduced the panic but anyway prepared a possible fix:
http://www.netbsd.org/~ozaki-r/fix-nd6_free.diff
Please give it a try if the panic occurs again.
Thanks,
ozaki-r
From: Kimmo Suominen <kim@netbsd.org>
To: Ryota Ozaki <ozaki-r@netbsd.org>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>
Subject: Re: kern/55680: llentry_free panic
Date: Mon, 16 May 2022 16:53:24 +0300
Hi,
Thanks for preparing the patch. Installing it got away from me --
sorry about that.
This morning I got the same panic again when a router went offline.
One out of the three 9.2_STABLE nodes on that network panicked. I've
now compiled a GENERIC kernel with your patch included and installed
it on all four of my 9.2_STABLE nodes.
I expect that this code will get some exercise in a week or two, when
I work on getting the router back online and upgraded.
Kind regards,
+ Kimmo
NetBSD 9.2_STABLE (GENERIC.202205151238Z~GW) #3: Mon May 16 10:42:47 EEST 2022
From: Kimmo Suominen <kim@netbsd.org>
To: Ryota Ozaki <ozaki-r@netbsd.org>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>
Subject: Re: kern/55680: llentry_free panic
Date: Sun, 22 May 2022 22:53:47 +0300
--0000000000009fb10905df9f1571
Content-Type: text/plain; charset="UTF-8"
On Mon, 16 May 2022 at 16:53, Kimmo Suominen <kim@netbsd.org> wrote:
> I expect that this code will get some exercise in a week or two, when
> I work on getting the router back online and upgraded.
>
I just replaced a dead router, so the high precedence RA was going out and
possibly expiring a few times. No panics were observed.
Perhaps it would now be good to commit the patch in this ticket?
Thanks, and kind regards,
+ Kimmo
--0000000000009fb10905df9f1571
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr">On Mon, 16 May 2022 at 16:53, Kimmo Suomi=
nen <<a href=3D"mailto:kim@netbsd.org">kim@netbsd.org</a>> wrote:<br>=
</div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D=
"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;bor=
der-left-color:rgb(204,204,204);padding-left:1ex">I expect that this code w=
ill get some exercise in a week or two, when<br>
I work on getting the router back online and upgraded.<br></blockquote><div=
><br></div><div>I just replaced a dead router, so the high precedence RA wa=
s going out and possibly expiring a few times. No panics were observed.</di=
v><div><br></div><div>Perhaps it would now be good to commit the patch in t=
his ticket?</div><div><br></div><div>Thanks, and kind regards,</div><div>+ =
Kimmo</div><div><br></div></div></div>
--0000000000009fb10905df9f1571--
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/55680 CVS commit: [netbsd-9] src/sys/netinet6
Date: Mon, 8 Aug 2022 17:09:21 +0000
Module Name: src
Committed By: martin
Date: Mon Aug 8 17:09:21 UTC 2022
Modified Files:
src/sys/netinet6 [netbsd-9]: nd6.c
Log Message:
Apply patch, requested by kim in ticket #1497:
sys/netinet6/nd6.c (apply patch)
PR 55680: avoid duplicate free of link layer entries (code in HEAD is
different)
To generate a diff of this commit:
cvs rdiff -u -r1.256.2.8 -r1.256.2.9 src/sys/netinet6/nd6.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(Contact us)
$NetBSD: query-full-pr,v 1.46 2020/01/03 16:35:01 leot Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2020
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home