Bug 214705
| Summary: | Kernel panic trying to playback encrypted DVD, "Fatal trap 12: page fault while in kernel mode" | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | Joshua Kinard <freebsd> | ||||
| Component: | kern | Assignee: | freebsd-bugs (Nobody) <bugs> | ||||
| Status: | Closed FIXED | ||||||
| Severity: | Affects Only Me | CC: | gonzo, kib, op | ||||
| Priority: | --- | Keywords: | patch | ||||
| Version: | 11.0-RELEASE | Flags: | op:
mfc-stable10?
|
||||
| Hardware: | amd64 | ||||||
| OS: | Any | ||||||
| Attachments: |
|
||||||
|
Description
Joshua Kinard
2016-11-21 15:42:13 UTC
Can you get a core file for the panic, and backtrace using kgdb ? I will request additional information once I see that. (In reply to Konstantin Belousov from comment #1) Well, I am running GENERIC-11.0-p2, but it looks like I can only find the debug symbols from the original RELEASE kernel. Doesn't seem that kgdb minds that, though: # kgdb kernel.debug /var/crash/vmcore.last GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"... Unread portion of the kernel message buffer: panic: page fault cpuid = 1 KDB: stack backtrace: #0 0xffffffff80b24077 at kdb_backtrace+0x67 #1 0xffffffff80ad93e2 at vpanic+0x182 #2 0xffffffff80ad9253 at panic+0x43 #3 0xffffffff80fa0d51 at trap_fatal+0x351 #4 0xffffffff80fa0f43 at trap_pfault+0x1e3 #5 0xffffffff80fa04ec at trap+0x26c #6 0xffffffff80f84141 at calltrap+0x8 #7 0xffffffff8110b469 at VOP_READ_APV+0x89 #8 0xffffffff80bc0977 at vn_read+0x157 #9 0xffffffff80bbc18d at vn_io_fault+0x10d #10 0xffffffff80b40df8 at dofileread+0x98 #11 0xffffffff80b40ac8 at kern_readv+0x68 #12 0xffffffff80b40a54 at sys_read+0x84 #13 0xffffffff80fa16ae at amd64_syscall+0x4ce #14 0xffffffff80f8442b at Xfast_syscall+0xfb Uptime: 6m21s Dumping 529 out of 7743 MB:..4%..13%..22%..31%..43%..52%..61%..73%..82%..91% Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/zfs.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/zfs.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/opensolaris.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/opensolaris.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/amdtemp.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/amdtemp.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/tmpfs.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/tmpfs.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/ums.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/ums.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/uftdi.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/uftdi.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/ucom.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/ucom.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/fdescfs.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/fdescfs.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/radeonkms.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/radeonkms.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/drm2.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/drm2.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/iicbus.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/iicbus.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/iic.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/iic.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/iicbb.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/iicbb.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/radeonkmsfw_PALM_pfp.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/radeonkmsfw_PALM_pfp.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/radeonkmsfw_PALM_me.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/radeonkmsfw_PALM_me.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/radeonkmsfw_SUMO_rlc.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/radeonkmsfw_SUMO_rlc.ko.debug Reading symbols from /usr/obj/usr/lib/debug/boot/kernel/udf.ko.debug...done. Loaded symbols for /usr/obj/usr/lib/debug/boot/kernel/udf.ko.debug #0 doadump (textdump=<value optimized out>) at pcpu.h:221 221 pcpu.h: No such file or directory. in pcpu.h Backtrace: (kgdb) bt #0 doadump (textdump=<value optimized out>) at pcpu.h:221 #1 0xffffffff80ad8e69 in kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:366 #2 0xffffffff80ad941b in vpanic (fmt=<value optimized out>, ap=<value optimized out>) at /usr/src/sys/kern/kern_shutdown.c:759 #3 0xffffffff80ad9253 in panic (fmt=0x0) at /usr/src/sys/kern/kern_shutdown.c:690 #4 0xffffffff80fa0d51 in trap_pfault (frame=0x0, usermode=0) at /usr/src/sys/amd64/amd64/trap.c:642 #5 0xffffffff80fa0f43 in trap_pfault (frame=0xfffffe0220881780, usermode=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:750 #6 0xffffffff80fa04ec in trap (frame=0xfffffe0220881780) at /usr/src/sys/amd64/amd64/trap.c:576 #7 0xffffffff80f84141 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:236 #8 0xffffffff82bc6fb3 in udf_read (ap=0xfffffe0220881910) at /usr/src/sys/modules/udf/../../fs/udf/udf_vnops.c:490 #9 0xffffffff8110b469 in VOP_READ_APV (vop=<value optimized out>, a=<value optimized out>) at vnode_if.c:936 #10 0xffffffff80bc0977 in vn_read (fp=<value optimized out>, uio=0xfffffe0220881aa0, active_cred=0x800, flags=<value optimized out>, td=0x0) at vnode_if.h:384 #11 0xffffffff80bbc18d in vn_io_fault (fp=<value optimized out>, uio=<value optimized out>, active_cred=<value optimized out>, flags=0, td=<value optimized out>) at /usr/src/sys/kern/vfs_vnops.c:1168 #12 0xffffffff80b40df8 in dofileread (td=0xfffff800c8ecfa00, fd=<value optimized out>, fp=0xfffff801160b7780, auio=0xfffffe0220881aa0, offset=<value optimized out>, flags=<value optimized out>) at file.h:303 #13 0xffffffff80b40ac8 in kern_readv (td=0xfffff800c8ecfa00, fd=21, auio=0xfffffe0220881aa0) at /usr/src/sys/kern/sys_generic.c:293 #14 0xffffffff80b40a54 in sys_read (td=0x0, uap=<value optimized out>) at /usr/src/sys/kern/sys_generic.c:206 #15 0xffffffff80fa16ae in amd64_syscall (td=<value optimized out>, traced=0) at subr_syscall.c:139 #16 0xffffffff80f8442b in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:396 #17 0x0000000800dbd75a in ?? () Previous frame inner to this frame (corrupt stack?) Current language: auto; currently minimal Tracing the address at the instruction pointer: (kgdb) l *(0xffffffff82bc6fb3) 0xffffffff82bc6fb3 is in udf_read (/usr/src/sys/modules/udf/../../fs/udf/udf_vnops.c:490). 485 error = bread(vp, lbn, size, NOCRED, &bp); 486 } 487 } else { 488 error = bread(vp, lbn, size, NOCRED, &bp); 489 } 490 n = min(n, size - bp->b_resid); 491 if (error) { 492 brelse(bp); 493 return (error); 494 } (kgdb) This code looks remarkably similar to the cd9660_read() code from #208275, just in this instance, it's in udf_read(). So my bet is udf_read needs the same fix that solved #208275 applied, to check 'bp' for NULL before attempting to dereference it and the 'min' call moved to come after the conditional. Also maybe swap 'min()' out for 'MIN()', unless that's a local macro specific to the UDF driver. Created attachment 177271 [details]
Proposed fix
(In reply to Joshua Kinard from comment #2) Sure. Please test the patch attached. (In reply to Konstantin Belousov from comment #4) Rolling a new GENERIC kernel now on a VM I quickly setup. I did confirm that the panic is triggered by telling VLC to try and play the DVD as a "disc", while the DVD was mounted to /media. Looks like the patch fixes the panic issue. Instead of crashing the whole OS now, VLC just kinda spins the drive up and down once or twice, then stops. Seems there's still issues in the kernel dealing with basic movie DVDs that are CSS encoded (given the CAM driver's spamming of dmesg), but the main problem here appears to be solved. A commit references this bug: Author: kib Date: Tue Nov 22 13:24:57 UTC 2016 New revision: 308995 URL: https://svnweb.freebsd.org/changeset/base/308995 Log: On error, bread(9) zeroes buffer pointer, do not dereference it. See r294954 for the bread(9) change and r297401 for similar cd9660 fix. Reported and tested by: Joshua Kinard <kumba@gentoo.org> PR: 214705 Sponsored by: The FreeBSD Foundation MFC after: 1 week Changes: head/sys/fs/udf/udf_vnops.c There is a commit referencing this PR, but it's still not closed and has been inactive for some time. Closing the PR as fixed but feel free to re-open it if the issue hasn't been completely resolved. Thanks (In reply to Oleksandr Tymoshenko from comment #8) All good. The same laptop is on 12.0-RELEASE and hasn't had any problems w/ DVD playback in over a year. Thanks! |
