Re: panic possibly on on bridge member removal

On Mon, Oct 1, 2012 at 9:49 AM, John Baldwin <jhb_at_freebsd.org> wrote:
> On Monday, October 01, 2012 9:08:30 am Kim Culhan wrote:
>> On Mon, Oct 1, 2012 at 8:04 AM, John Baldwin <jhb_at_freebsd.org> wrote:
>> > On Saturday, September 29, 2012 8:40:03 am Kim Culhan wrote:
>> >> After a few hours of operation involving tap0 added to the bridge
>> >> running openvpn
>> >> and shutting down openvpn which removes tap0 from the bridge, the
>> >> machine is found to have a panic:
>> >>
>> >> Fatal trap 12: page fault while in kernel mode
>> >> cpuid = 1; apic id = 01
>> >> fault virtual address   = 0x188
>> >> fault code              = supervisor read data, page not present
>> >> instruction pointer     = 0x20:0xffffffff82a14f96
>> >> stack pointer           = 0x28:0xffffff8000285670
>> >> frame pointer           = 0x28:0xffffff80002856b0
>> >> code segment            = base 0x0, limit 0xfffff, type 0x1b
>> >>                         = DPL 0, pres 1, long 1, def32 0, gran 1
>> >> processor eflags        = interrupt enabled, resume, IOPL = 0
>> >> current process         = 12 (swi5: fast taskq)
>> >> [ thread pid 12 tid 100022 ]
>> >> Stopped at      bridge_enqueue+0x86:    calll   *0x188(%r12)
>> >> db> bt
>> >> Tracing pid 12 tid 100022 td 0xfffffe0003aff000
>> >> bridge_enqueue() at bridge_enqueue+0x86
>> >
>> > Can you run 'gdb /boot/kernel/kernel' and do 'l *bridge_enqueue+0x86'?
>> >
>> > --
>> > John Baldwin
>>
>> (gdb) l *bridge_enqueue+0x86
>> No symbol "bridge_enqueue" in current context.
>> (gdb)
>
> Oh, are you using if_bridge.ko as a module?  If so, you can try running 'gdb
> /boot/kernel/if_bridge.ko' instead.

(gdb) l *bridge_enqueue+0x86
0x2f96 is in bridge_enqueue
(/usr/src/sys/modules/if_bridge/../../net/if_bridge.c:1810).
1805                                    continue;
1806                            }
1807                            m->m_flags &= ~M_VLANTAG;
1808                    }
1809
1810                    if ((err = dst_ifp->if_transmit(dst_ifp, m))) {
1811                            m_freem(m0);
1812                            break;
1813                    }
1814            }
(gdb)

--
-lo,