Bug 201947 - Panics in if_bfe under certain loads types (reproducible with rtorrent)
Summary: Panics in if_bfe under certain loads types (reproducible with rtorrent)
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 10.1-STABLE
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-net (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-28 17:48 UTC by Hugh O'Brien
Modified: 2023-06-20 20:45 UTC (History)
0 users

See Also:

Attachments
kgdb printout (2.56 KB, text/plain)
2015-07-28 17:48 UTC, Hugh O'Brien 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hugh O'Brien 2015-07-28 17:48:03 UTC 
Created attachment 159341 [details]
kgdb printout

rtorrent usage will often cause a panic. Sustained traffic with scp, etc. does not exhibit this. I've caught one in action:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x30
fault code              = supervisor write data, page not present
instruction pointer     = 0x20:0xffffffff8048c5ad
stack pointer           = 0x28:0xfffffe0018667a50
frame pointer           = 0x28:0xfffffe0018667ab0
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (irq21: bfe0)
trap number             = 12
panic: page fault
cpuid = 0
KDB: stack backtrace:
#0 0xffffffff80963000 at kdb_backtrace+0x60
#1 0xffffffff80928125 at panic+0x155
#2 0xffffffff80d258df at trap_fatal+0x38f
#3 0xffffffff80d25bf8 at trap_pfault+0x308
#4 0xffffffff80d2525a at trap+0x47a
#5 0xffffffff80d0b142 at calltrap+0x8
#6 0xffffffff8048d0bd at bfe_intr+0x17d
#7 0xffffffff808faf4b at intr_event_execute_handlers+0xab
#8 0xffffffff808fb396 at ithread_loop+0x96
#9 0xffffffff808f8b6a at fork_exit+0x9a
#10 0xffffffff80d0b67e at fork_trampoline+0xe
Uptime: 4d17h28m15s

<snip>
Full output in attachment.

Info file:

Dump header from device /dev/ada0p2
  Architecture: amd64
  Architecture Version: 2
  Dump Length: 174780416B (166 MB)
  Blocksize: 512
  Dumptime: Mon Jul 27 14:01:00 2015
  Hostname: majortom
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 10.1-RELEASE-p10 #0: Wed May 13 06:54:13 UTC 2015
    root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC
  Panic String: page fault
  Dump Parity: 2579429912
  Bounds: 1
  Dump Status: good

I've uploaded the vmcore file here if it's helpful: https://skynet.ie/~teslacut/vmcore.0.xz
Comment 1 commit-hook freebsd_committer freebsd_triage 2023-06-20 20:45:08 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=4bc148c30effe0fc1c21b6bbaee366f239353ac1

commit 4bc148c30effe0fc1c21b6bbaee366f239353ac1
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2023-06-20 12:44:22 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-06-20 20:42:34 +0000

    bfe: add unmaintained / deprecation notice

    The bfe (Broadcom BCM4401 10/100 Ethernet) driver has known bugs and no
    active maintenance.  There have been no changes other than sweeping tree
    changes, typo corrections etc. since 2008 a far as I can tell.  Add a
    note in the man page so that users expectations are correctly set, and
    indicate that it may be removed in the future.

    I did not add a gone_in() call in the driver itself as there is no
    specific target version for removal, and this driver has evidence of
    recent use (dmesg, PRs).

    PR:             201947, 213751
    Reviewed by:    brooks
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D40625

 share/man/man4/bfe.4 | 7 +++++++
 1 file changed, 7 insertions(+)