NetBSD Problem Report #59740

From www@netbsd.org  Thu Oct 30 09:13:50 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id E42C71A9239
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 30 Oct 2025 09:13:49 +0000 (UTC)
Message-Id: <20251030091348.A64281A923C@mollari.NetBSD.org>
Date: Thu, 30 Oct 2025 09:13:48 +0000 (UTC)
From: k0ga@shike2.net
Reply-To: k0ga@shike2.net
To: gnats-bugs@NetBSD.org
Subject: Page fault in supervisor mode
X-Send-Pr-Version: www-1.0

>Number:         59740
>Category:       kern
>Synopsis:       Page fault in supervisor mode
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 30 09:15:00 +0000 2025
>Last-Modified:  Wed Nov 12 13:55:01 +0000 2025
>Originator:     Roberto E. Vargas Caballero
>Release:        10.1
>Organization:
>Environment:
The error happens in the init phase of the kernel in the installer image
>Description:
Using the installer image of NetBSD 10.1 in a Supermicro 5019A-FTN4 (https://www.supermicro.com/manuals/superserver/1U/MNL-2042.pdf). This computer has 4 Intel® Ethernet Connection X553. The first two are attached without problems as igx0 and igx1, but when it tries to attach the 3rd one then the hardware initialization fails, and it produces a page fault in supervisor mode in intr_disestablish called from ixgbe_free_pciintr_resources. A full picture with the backtrace can be located at http://k0ga.sdfeu.org/netbsd-backtrace.jpg.
>How-To-Repeat:
Boot the Supermicro 5019A-FTN4 with the NetBSD 10.1 installer image
>Fix:

>Audit-Trail:
From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/59740: Page fault in supervisor mode
Date: Thu, 30 Oct 2025 10:30:52 +0100

 >From the image: the crash happens at:

 intr_disestablish()+0x17
 ixgbe_free_pciintr_resources()+0x3f
 ixgbe_attach()+0x24a

 The msix interrupt queue disestablish is not protected with if
 (sc->osdep.ihs[i] != NULL) like the others a few lines below, so if we
 have not been sucessfully through ixgbe_allocate_msix() this might
 crash (we go to err_out in ixgbe.c: 7048 and then call
 ixgbe_free_pciintr_resources).

 Martin

From: "Roberto E. Vargas Caballero" <k0ga@shike2.net>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
	netbsd-bugs@netbsd.org
Subject: Re: kern/59740: Page fault in supervisor mode
Date: Tue, 11 Nov 2025 11:50:07 +0100

 >  The msix interrupt queue disestablish is not protected with if
 >  (sc->osdep.ihs[i] != NULL) like the others a few lines below, so if we
 >  have not been sucessfully through ixgbe_allocate_msix() this might
 >  crash (we go to err_out in ixgbe.c: 7048 and then call
 >  ixgbe_free_pciintr_resources).

 Is this change to be pushed to mainline? I don't have any NetBSD
 machine where I can compile the kernel to try it.

From: Martin Husemann <martin@duskware.de>
To: "Roberto E. Vargas Caballero" <k0ga@shike2.net>
Cc: gnats-bugs@netbsd.org
Subject: Re: kern/59740: Page fault in supervisor mode
Date: Tue, 11 Nov 2025 14:40:10 +0100

 On Tue, Nov 11, 2025 at 11:50:07AM +0100, Roberto E. Vargas Caballero wrote:
 > >  The msix interrupt queue disestablish is not protected with if
 > >  (sc->osdep.ihs[i] != NULL) like the others a few lines below, so if we
 > >  have not been sucessfully through ixgbe_allocate_msix() this might
 > >  crash (we go to err_out in ixgbe.c: 7048 and then call
 > >  ixgbe_free_pciintr_resources).
 > 
 > Is this change to be pushed to mainline? I don't have any NetBSD
 > machine where I can compile the kernel to try it.
 > 

 :-)

 You don't need a NetBSD system to compile a kernel - but besides that:
 adding the missing test for NULL won't make your card work, because
 something goes wrong before the crash and the crash is only a side
 effect.

 We need someone who understands the driver better to look at it...

 Martin

From: "Roberto E. Vargas Caballero" <k0ga@shike2.net>
To: Martin Husemann <martin@duskware.de>
Cc: gnats-bugs@netbsd.org
Subject: Re: kern/59740: Page fault in supervisor mode
Date: Tue, 11 Nov 2025 15:05:22 +0100

 Hi,

 On Tue, Nov 11, 2025 at 02:40:10PM +0100, Martin Husemann wrote:
 > You don't need a NetBSD system to compile a kernel - but besides that:

 Yes, you are right, but the process is not straighforward, and for
 a so small change I suppose it is worthless.

 > adding the missing test for NULL won't make your card work, because

 Indeed, but at least the system would boot and I could install it.
 The problem is related to the phy, because this board has 4 macs
 and the two with the 1gb phy are attached without problems (and I
 suppose they will work too), but the 2 macs with the 10gb phys
 will fail. Not a a big issue in my side as I am going to use only
 one of the interfaces. As, commented in the original report,
 OpenBSD was able to boot enumerating only the first 2 macs, and
 they worked without problems.

 > We need someone who understands the driver better to look at it...

 I can try to take a look to the problem with the phy, but for that
 I need first a bootable system.

 Regards,

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59740 CVS commit: src/sys/dev/pci/ixgbe
Date: Tue, 11 Nov 2025 14:17:47 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Tue Nov 11 14:17:47 UTC 2025

 Modified Files:
 	src/sys/dev/pci/ixgbe: ixgbe.c

 Log Message:
 PR 59740: avoid use after free (and obvious crash if hardware
 initialization fails)


 To generate a diff of this commit:
 cvs rdiff -u -r1.354 -r1.355 src/sys/dev/pci/ixgbe/ixgbe.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Martin Husemann <martin@duskware.de>
To: "Roberto E. Vargas Caballero" <k0ga@shike2.net>
Cc: gnats-bugs@netbsd.org
Subject: Re: kern/59740: Page fault in supervisor mode
Date: Tue, 11 Nov 2025 15:18:49 +0100

 On Tue, Nov 11, 2025 at 03:05:22PM +0100, Roberto E. Vargas Caballero wrote:
 > I can try to take a look to the problem with the phy, but for that
 > I need first a bootable system.

 I just commited the change to avoid the crash.

 Martin

From: "Roberto E. Vargas Caballero" <k0ga@shike2.net>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
	netbsd-bugs@netbsd.org
Subject: Re: kern/59740: Page fault in supervisor mode
Date: Wed, 12 Nov 2025 14:53:47 +0100

 Hi,

 On Tue, Nov 11, 2025 at 02:20:03PM +0000, Martin Husemann via gnats wrote:
 >  I just commited the change to avoid the crash.

 I just tested it, and the network interface configuration passed,
 but it panics scanning the sata bus [1]. As I suppose it is a
 unrelated problem, I think we can close this bug and open a new
 one.

 Regards,

 [1] http://k0ga.sdfeu.org/netbsd-backtrace2.jpg

Home	PR Database Search