Panic (in firewall while doing lots of ifconfigs)

Hi

I got this panic while ifconfiging a few vlan interfaces with carp
interfaces on top of them.  I think it's related to interface
addresses disappearing or reappearing while doing a match on "me"
in the firewall:

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 06
fault virtual address   = 0xbd
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0584e47
stack pointer           = 0x28:0xe2b558f0
frame pointer           = 0x28:0xe2b559f4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 35 (idlepoll)
trap number             = 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
kdb_backtrace(c0686796,1,c0667484,e2b557c0,5,...) at kdb_backtrace+0x2f
panic(c0667484,c06876a1,c41a7608,1,1,...) at panic+0x129
trap_fatal(e2b558b0,bd,1,0,e2b55818,...) at trap_fatal+0x332
trap_pfault(e2b558b0,0,bd,6,bd,...) at trap_pfault+0x232
trap(e2b50008,c04c0028,c06a0028,1,e2b55990,...) at trap+0x3cb
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc0584e47, esp = 0xe2b558f0, ebp = 0xe2b559f4 ---
ipfw_chk(e2b55a0c,1,1,0,c492ce00,...) at ipfw_chk+0xfc8
ipfw_check_in(0,e2b55b10,c4379800,1,0,...) at ipfw_check_in+0xcd
pfil_run_hooks(c06cc5e0,e2b55b7c,c4379800,1,0,...) at pfil_run_hooks+0x81
ip_fastforward(c492ce00,e,0,ed240257,0,...) at ip_fastforward+0x305
ether_demux(c4379800,c492ce00,0,c9a81000,0,c492ce00) at ether_demux+0x26f
ether_input(c4379800,c492ce00,e,c9a80802,0,...) at ether_input+0x239
vlan_input(c4123c00,c492ce00,e2b55c3c,c0468ef2,0,...) at vlan_input+0x1a7
ether_demux(c4123c00,c492ce00,1,2,c4050001,c40cd800) at ether_demux+0x1f4
ether_input(c4123c00,c492ce00,c492ce00,e2b55c68,c04f1e4e,...) at ether_input+0x239
em_rxeof(c40cd800,3e7,c41a7468,e2b55ccc,c04df2ed,...) at em_rxeof+0x45c
em_poll(c4123c00,0,3e8,c4050870,e2b55ccc,...) at em_poll+0x13b
ether_poll(3e8,0,0,0,0,...) at ether_poll+0xda
poll_idle(0,e2b55d38,0,0,0,...) at poll_idle+0xea
fork_exit(c04cc9a9,0,e2b55d38) at fork_exit+0x83
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xe2b55d6c, ebp = 0 ---
Uptime: 19h5m9s
Physical memory: 2043 MB
Dumping 177 MB: 162 146 130 114 98 82 66 50 34 18 2

#0  doadump () at pcpu.h:166
166             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt
#0  doadump () at pcpu.h:166
#1  0xc04d5ff4 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc04d63d3 in panic (fmt=0xc0667484 "%s")
    at /usr/src/sys/kern/kern_shutdown.c:565
#3  0xc0641dcf in trap_fatal (frame=0xe2b558b0, eva=189)
    at /usr/src/sys/i386/i386/trap.c:867
#4  0xc0641a79 in trap_pfault (frame=0xe2b558b0, usermode=0, eva=189)
    at /usr/src/sys/i386/i386/trap.c:776
#5  0xc06415eb in trap (frame=
      {tf_fs = -491454456, tf_es = -1068761048, tf_ds = -1066794968, tf_edi = 1, tf_esi = -491431536, tf_ebp = -491431436, tf_isp = -491431716, tf_ebx = -996038748, tf_edx = -932950458, tf_ecx = -1, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1067954617, tf_cs = 32, tf_eflags = 66050, tf_esp = -1002989568, tf_ss = -1000588380}) at /usr/src/sys/i386/i386/trap.c:461
#6  0xc0629e1a in calltrap () at /usr/src/sys/i386/i386/exception.s:138
#7  0xc0584e47 in ipfw_chk (args=0xe2b55a0c)
    at /usr/src/sys/netinet/ip_fw2.c:2593
#8  0xc0587815 in ipfw_check_in (arg=0x0, m0=0xe2b55b10, ifp=0xc4379800, 
    dir=1, inp=0x0) at /usr/src/sys/netinet/ip_fw_pfil.c:128
#9  0xc056a871 in pfil_run_hooks (ph=0xc06cc5e0, mp=0xe2b55b7c, 
    ifp=0xc4379800, dir=1, inp=0x0) at /usr/src/sys/net/pfil.c:78
#10 0xc0581000 in ip_fastforward (m=0xc492ce00)
    at /usr/src/sys/netinet/ip_fastfwd.c:351
#11 0xc05672fb in ether_demux (ifp=0xc4379800, m=0xc492ce00)
    at /usr/src/sys/net/if_ethersubr.c:745
#12 0xc0567085 in ether_input (ifp=0xc4379800, m=0xc492ce00)
    at /usr/src/sys/net/if_ethersubr.c:596
#13 0xc05694c7 in vlan_input (ifp=0xc4123c00, m=0xc492ce00)
    at /usr/src/sys/net/if_vlan.c:999
#14 0xc0567280 in ether_demux (ifp=0xc4123c00, m=0xc492ce00)
    at /usr/src/sys/net/if_ethersubr.c:722
#15 0xc0567085 in ether_input (ifp=0xc4123c00, m=0xc492ce00)
    at /usr/src/sys/net/if_ethersubr.c:596
#16 0xc0469af5 in em_rxeof (adapter=0xc40cd800, count=999)
    at /usr/src/sys/dev/em/if_em.c:3279
#17 0xc0465cce in em_poll (ifp=0xc4123c00, cmd=POLL_ONLY, count=1)
    at /usr/src/sys/dev/em/if_em.c:1141
#18 0xc04cc001 in ether_poll (count=1000) at /usr/src/sys/kern/kern_poll.c:339
#19 0xc04cca93 in poll_idle () at /usr/src/sys/kern/kern_poll.c:590
#20 0xc04b9640 in fork_exit (callout=0xc04cc9a9 <poll_idle>, arg=0x1, 
    frame=0x1) at /usr/src/sys/kern/kern_fork.c:818
#21 0xc0629e7c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:199
(kgdb) frame 7
#7  0xc0584e47 in ipfw_chk (args=0xe2b55a0c)
    at /usr/src/sys/netinet/ip_fw2.c:2593
2593                                            INADDR_TO_IFP(src_ip, tif);
(kgdb) l 
2588
2589                            case O_IP_SRC_ME:
2590                                    if (is_ipv4) {
2591                                            struct ifnet *tif;
2592
2593                                            INADDR_TO_IFP(src_ip, tif);
2594                                            match = (tif != NULL);
2595                                    }
2596                                    break;
2597
(kgdb) print src_ip
$1 = {s_addr = 3362016838}
(kgdb) print tif   
$2 = (struct ifnet *) 0x1


--
Ian Freislich