NetBSD Problem Report #58720

From gson@gson.org  Sun Oct  6 08:34:20 2024
Return-Path: <gson@gson.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 417F71A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun,  6 Oct 2024 08:34:20 +0000 (UTC)
Message-Id: <20241006083414.35277253EFA@guava.gson.org>
Date: Sun,  6 Oct 2024 11:34:14 +0300 (EEST)
From: gson@gson.org (Andreas Gustafsson)
Reply-To: gson@gson.org (Andreas Gustafsson)
To: gnats-bugs@NetBSD.org
Subject: Trap in arpintr
X-Send-Pr-Version: 3.95

>Number:         58720
>Category:       kern
>Synopsis:       Trap in arpintr
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 06 08:35:00 +0000 2024
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2024-07-01 17:47:24 Z
>Organization:

>Environment:
System: NetBSD
Architecture: i386
Machine: i386
>Description:

My NetBSD-current/i386 router/firewall/NAT machine paniced with a trap
in arpintr and left a crash dump.

  gusev /var/crash # gdb /netbsd
  [...]
  (gdb) target kvm netbsd.11.core
  0xc012ce85 in maybe_dump (howto=260) at /usr/src/sys/arch/i386/i386/machdep.c:725
  725			dumpsys();
  (gdb) bt
  #0  0xc012ce85 in maybe_dump (howto=260) at /usr/src/sys/arch/i386/i386/machdep.c:725
  #1  cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/i386/i386/machdep.c:746
  #2  0xc0c62338 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:91
  #3  0xc0ca74a9 in vpanic (fmt=fmt@entry=0xc11b224c "trap", ap=0xdbaf2d2c "\364-\257\333\364-\257\333\003") at /usr/src/sys/kern/subr_prf.c:288
  #4  0xc0ca755c in panic (fmt=fmt@entry=0xc11b224c "trap") at /usr/src/sys/kern/subr_prf.c:209
  #5  0xc013026e in trap (frame=0xdbaf2df4) at /usr/src/sys/arch/i386/i386/trap.c:357
  #6  0xc0125333 in alltraps ()
  #7  0xdbaf2df4 in ?? ()
  #8  0xc0db7b09 in arpintr (arg=<optimized out>) at /usr/src/sys/netinet/if_arp.c:736
  #9  0xc0c70b5e in softint_execute (s=4, l=0xc3e26300) at /usr/src/sys/kern/kern_softint.c:599
  #10 softint_dispatch (pinned=0xc3e26040, s=4) at /usr/src/sys/kern/kern_softint.c:848
  #11 0xc0102ab8 in Xsoftintr ()
  #12 0xc3e26040 in ?? ()
  Backtrace stopped: previous frame inner to this frame (corrupt stack?)
  (gdb) frame 8
  #8  0xc0db7b09 in arpintr (arg=<optimized out>) at /usr/src/sys/netinet/if_arp.c:736
  736				in_arpinput(m);
  (gdb) print m
  $1 = (struct mbuf *) 0x4
  (gdb) up
  #9  0xc0c70b5e in softint_execute (s=4, l=0xc3e26300) at /usr/src/sys/kern/kern_softin

  599				(*sh->sh_func)(sh->sh_arg);
  (gdb) print *sh
  $2 = {sh_q = {sqe_next = 0x0}, sh_func = 0xc0db79e4 <arpintr>, sh_arg = 0x0, sh_isr = 0xdb666160, sh_flags = 771, sh_ipi_id = 5}
  (gdb) 

>How-To-Repeat:

Don't know, it has only happened once.

>Fix:

Home	PR Database Search