Bug 201947

Summary: Panics in if_bfe under certain loads types (reproducible with rtorrent)
Product: Base System Reporter: Hugh O'Brien <freebsdbugs>
Component: kernAssignee: freebsd-net (Nobody) <net>
Status: New ---    
Severity: Affects Some People    
Priority: ---    
Version: 10.1-STABLE   
Hardware: amd64   
OS: Any   
Attachments:
Description Flags
kgdb printout none

Description Hugh O'Brien 2015-07-28 17:48:03 UTC 
Created attachment 159341 [details]
kgdb printout

rtorrent usage will often cause a panic. Sustained traffic with scp, etc. does not exhibit this. I've caught one in action:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x30
fault code              = supervisor write data, page not present
instruction pointer     = 0x20:0xffffffff8048c5ad
stack pointer           = 0x28:0xfffffe0018667a50
frame pointer           = 0x28:0xfffffe0018667ab0
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (irq21: bfe0)
trap number             = 12
panic: page fault
cpuid = 0
KDB: stack backtrace:
#0 0xffffffff80963000 at kdb_backtrace+0x60
#1 0xffffffff80928125 at panic+0x155
#2 0xffffffff80d258df at trap_fatal+0x38f
#3 0xffffffff80d25bf8 at trap_pfault+0x308
#4 0xffffffff80d2525a at trap+0x47a
#5 0xffffffff80d0b142 at calltrap+0x8
#6 0xffffffff8048d0bd at bfe_intr+0x17d
#7 0xffffffff808faf4b at intr_event_execute_handlers+0xab
#8 0xffffffff808fb396 at ithread_loop+0x96
#9 0xffffffff808f8b6a at fork_exit+0x9a
#10 0xffffffff80d0b67e at fork_trampoline+0xe
Uptime: 4d17h28m15s

<snip>
Full output in attachment.

Info file:

Dump header from device /dev/ada0p2
  Architecture: amd64
  Architecture Version: 2
  Dump Length: 174780416B (166 MB)
  Blocksize: 512
  Dumptime: Mon Jul 27 14:01:00 2015
  Hostname: majortom
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 10.1-RELEASE-p10 #0: Wed May 13 06:54:13 UTC 2015
    root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC
  Panic String: page fault
  Dump Parity: 2579429912
  Bounds: 1
  Dump Status: good

I've uploaded the vmcore file here if it's helpful: https://skynet.ie/~teslacut/vmcore.0.xz
Comment 1 commit-hook freebsd_committer freebsd_triage 2023-06-20 20:45:08 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=4bc148c30effe0fc1c21b6bbaee366f239353ac1

commit 4bc148c30effe0fc1c21b6bbaee366f239353ac1
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2023-06-20 12:44:22 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-06-20 20:42:34 +0000

    bfe: add unmaintained / deprecation notice

    The bfe (Broadcom BCM4401 10/100 Ethernet) driver has known bugs and no
    active maintenance.  There have been no changes other than sweeping tree
    changes, typo corrections etc. since 2008 a far as I can tell.  Add a
    note in the man page so that users expectations are correctly set, and
    indicate that it may be removed in the future.

    I did not add a gone_in() call in the driver itself as there is no
    specific target version for removal, and this driver has evidence of
    recent use (dmesg, PRs).

    PR:             201947, 213751
    Reviewed by:    brooks
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D40625

 share/man/man4/bfe.4 | 7 +++++++
 1 file changed, 7 insertions(+)