Bug 203276 - PC-BSD and TrueOS Desktop kernel panics if Adobe Flash Player Preferences is used to attempt a check for updates
Summary: PC-BSD and TrueOS Desktop kernel panics if Adobe Flash Player Preferences is ...
Status: Closed Overcome By Events
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Kris Moore
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-09-23 02:26 UTC by Graham Perrin
Modified: 2021-01-16 20:57 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Graham Perrin 2015-09-23 02:26:59 UTC
11.0-CURRENTSEPT2015 on an Ergo Vista 621 notebook with Lumina 0.8.7-Devel built a couple of days ago (Friday evening).

Twice, after clicking the 'Check Now' button in Adobe Flash Player Preferences, the kernel panicked.

https://bugs.pcbsd.org/issues/11603#note-1

> … FWIW I can't duplicate with 10.2 and latest Lumina so this appears to only apply to 11.0.

https://bugs.pcbsd.org/issues/11603#note-2

> this should be reported upstream. sounds like bug in Linux emulation layer updates.

I'm reading https://www.freebsd.org/doc/en/books/developers-handbook/kerneldebug.html#kerneldebug-obtain aiming to get a kernel crash dump.
Comment 1 Graham Perrin 2015-09-23 03:26:29 UTC
I added lines to /etc/rc.conf –

dumpdev="AUTO"
dumpdir="/var/crash"

– then rebooted, then reproduced the panic, but there's no dump. 

It seems that the panic may not occur immediately after the check for updates. For the most recent panic, I observed that Chromium was launched; I quit from Chromium, observed Adobe Flash Player Preferences (the GUI looked OK), proceeded to launch and work with other apps (HexChat, Firefox, Insight …), then the panic. 

With Firefox, HexChat and MATE Terminal running, I'll now launch Adobe Flash Player Preferences and make another attempt to reproduce the panic.
Comment 2 Graham Perrin 2015-09-23 03:57:47 UTC
> … With Firefox, HexChat and MATE Terminal running, I'll now launch Adobe Flash Player Preferences and make another attempt to reproduce the panic.

I launched PC-BSD Control Panel, used that to open Adobe Flash Player Preferences, used its button to attempt a check for updates. Moments later (too soon for Chromium to appear), another kernel panic. 

Incidentally, Firefox (not Chromium) is my preferred browser. 

Still no dump file, so I posted to the forums: 

PC-PSD kernel panics but no core dump files at /var/crash
https://forums.pcbsd.org/thread-20244.html
Comment 3 Graham Perrin 2015-09-29 03:00:06 UTC
Here's an extract from the core dump. 

Should I attach the dump in its entirety? vmcore.0.gz is 52M

----

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80914f89
stack pointer           = 0x28:0xfffffe00921afa20
frame pointer           = 0x28:0xfffffe00921afb20
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (irq257: wpi0)
trap number             = 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
#0 0xffffffff80ac8d27 at kdb_backtrace+0x67
#1 0xffffffff80a85059 at vpanic+0x189
#2 0xffffffff80a84ec3 at panic+0x43
#3 0xffffffff80f055e5 at trap_fatal+0x355
#4 0xffffffff80f05926 at trap_pfault+0x326
#5 0xffffffff80f04f84 at trap+0x464
#6 0xffffffff80ee8b9a at calltrap+0x8
#7 0xffffffff80a4761a at intr_event_execute_handlers+0x1da
#8 0xffffffff80a47a26 at ithread_loop+0xa6
#9 0xffffffff80a4472c at fork_exit+0x9c
#10 0xffffffff80ee90ce at fork_trampoline+0xe
Uptime: 6m52s
Comment 4 Graham Perrin 2015-10-05 17:26:20 UTC
Another extract. From a dump of a panic that occurred on 2015-09-30. 

The events preceding this panic were memorable. The notebook had a wireless network connection and the wireless router was working, but the OS could not get Internet service. 

I tried to reproduce the panic, it didn't occur until long after I pressed the button in the Adobe dialogue. 

The panic occurred after I did something to gain Internet connectivity. Probably a restart of the network software. 


… 
<118>Sep 30 03:24:40 cces3-gjp4-pc-bsd-ergo-vista-621 wpa_supplicant[453]: ioctl[SIOCS80211, op=26, val=0, arg_len=0]: Operation not supported


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80914f89
stack pointer           = 0x28:0xfffffe00921afa20
frame pointer           = 0x28:0xfffffe00921afb20
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (irq257: wpi0)
trap number             = 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
#0 0xffffffff80ac8d27 at kdb_backtrace+0x67
#1 0xffffffff80a85059 at vpanic+0x189
#2 0xffffffff80a84ec3 at panic+0x43
#3 0xffffffff80f055e5 at trap_fatal+0x355
#4 0xffffffff80f05926 at trap_pfault+0x326
#5 0xffffffff80f04f84 at trap+0x464
#6 0xffffffff80ee8b9a at calltrap+0x8
#7 0xffffffff80a4761a at intr_event_execute_handlers+0x1da
#8 0xffffffff80a47a26 at ithread_loop+0xa6
#9 0xffffffff80a4472c at fork_exit+0x9c
#10 0xffffffff80ee90ce at fork_trampoline+0xe
Uptime: 11m8s
…
Comment 5 Graham Perrin 2015-10-05 21:21:42 UTC
(In reply to Graham Perrin from comment #4)

> … Probably a restart of the network software. …

More specifically: if recall correctly, the panic occurred moments after the 'Running DHCP' message appeared on screen.
Comment 6 Graham Perrin 2015-10-18 14:21:47 UTC
Today I four or five times to reproduce the panic. In this case the panic was whist using GNOME, not long after use of Adobe Flash Player Preferences (after closure of both Chromium and the preferences app). AFAIR the panic was shortly after launching Firefox, whilst an (add-on) session manager dialogue was on screen. 


$ date ; freebsd-version ; uname -a
Sun 18 Oct 2015 15:14:59 BST
11.0-CURRENTOCT2015
FreeBSD cces3-gjp4-pc-bsd-ergo-vista-621 11.0-CURRENTOCT2015 FreeBSD 11.0-CURRENTOCT2015 #1 9551f87(master): Fri Sep 25 21:43:02 UTC 2015     root@devastator:/usr/obj/net/executor/builds/git/freebsd-11-current/sys/GENERIC  amd64
$ 

…

Fatal trap 9: general protection fault while in kernel mode
cpuid = 1; apic id = 01
instruction pointer     = 0x20:0xffffffff820b84ed
stack pointer           = 0x28:0xfffffe00954ef740
frame pointer           = 0x28:0xfffffe00954ef750
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 7574 (URL Classifier)
trap number             = 9
panic: general protection fault
cpuid = 1
KDB: stack backtrace:
#0 0xffffffff80acca47 at kdb_backtrace+0x67
#1 0xffffffff80a89a79 at vpanic+0x189
#2 0xffffffff80a898e3 at panic+0x43
#3 0xffffffff80f123f5 at trap_fatal+0x355
#4 0xffffffff80f1208d at trap+0x76d
#5 0xffffffff80ef568a at calltrap+0x8
#6 0xffffffff8214460b at zil_itx_assign+0x15b
#7 0xffffffff821754eb at zfs_freebsd_remove+0x5bb
#8 0xffffffff81063297 at VOP_REMOVE_APV+0xa7
#9 0xffffffff80b4d558 at kern_unlinkat+0x208
#10 0xffffffff80f12da8 at amd64_syscall+0x508
#11 0xffffffff80ef596b at Xfast_syscall+0xfb
Uptime: 6m49s
Dumping 283 out of 2004 MB: …
Comment 7 Enji Cooper freebsd_committer 2015-10-19 07:31:30 UTC
What custom patches is PCBSD carrying in this build?
Comment 8 Graham Perrin 2015-11-30 06:59:29 UTC
Sorry, I can't answer that question. 

I'll draw the attention of a developer from the PC-BSD area.
Comment 9 Graham Perrin 2015-11-30 07:23:20 UTC
(In reply to Graham Perrin from comment #5)

> … if recall correctly, the panic occurred moments after the 'Running DHCP' message appeared on screen.

Maybe unrelated, but I saw this posted by 'cathode' a few hours ago in 
irc://chat.freenode.net/#freebsd :

> … managed to kernel panic the entire system by rebooting netif service
Comment 10 Kris Moore freebsd_committer 2015-11-30 15:56:09 UTC
This PC-BSD build only includes patches to the boot-loader, for EFI/ZFS support. Nothing kernel / world related.
Comment 11 Graham Perrin 2015-11-30 19:37:06 UTC
Kris, thank you. 

Lumina 0.8.8-Devel on PC-BSD 11.0-CURRENTNOV2015 on the Ergo Vista 621 (circa 2007, 4 GB memory): 

* first attempt, panic reproduced. 

Fluxbox on on PC-BSD 11.0-CURRENTNOV2015 on the Ergo Vista 621: 

* first attempt, Fluxbox crashed

* second attempt, the system locked (no response to keyboard, trackpad or trackball input). 

Lumina with PC-BSD 11.0-CURRENTNOV2015 in a VirtualBoxVM guest with 2 GB memory (early 2009 MacBookPro5,2 host with 8 GB memory): 

* I'll install the recent upgrade of pkg to 1.6.2 and then tell whether a panic is reproducible.
Comment 12 Graham Perrin 2015-12-01 23:03:00 UTC
With PC-BSD in the VirtualBoxVM, the first attempt did not result in a kernel panic. Adobe Flash Player Preferences became unresponsive, I logged out then again in to Lumina. 

Then an attempt to launch Adobe Flash Player Preferences and -- before an opportunity to (re)check for updates -- a panic in the VM. 

----

From today's panic on the real machine: 

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff809178c1
stack pointer           = 0x28:0xfffffe011f0cea20
frame pointer           = 0x28:0xfffffe011f0ceb20
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (irq257: wpi0)
trap number             = 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
#0 0xffffffff80acf0d7 at kdb_backtrace+0x67
#1 0xffffffff80a8bc62 at vpanic+0x182
#2 0xffffffff80a8bad3 at panic+0x43
#3 0xffffffff80f0e421 at trap_fatal+0x351
#4 0xffffffff80f0e614 at trap_pfault+0x1e4
#5 0xffffffff80f0ddce at trap+0x46e
#6 0xffffffff80ef1e37 at calltrap+0x8
#7 0xffffffff80a4e196 at intr_event_execute_handlers+0x1b6
#8 0xffffffff80a4e3e6 at ithread_loop+0xa6
#9 0xffffffff80a4b21c at fork_exit+0x9c
#10 0xffffffff80ef236e at fork_trampoline+0xe
Uptime: 46m45s

----

Maybe worth mentioning: 

Adobe Flash Player preferences are present but browsers treat Adobe's plug-in as missing
https://bugs.pcbsd.org/issues/12549
Comment 13 Graham Perrin 2015-12-30 15:34:46 UTC
<https://bugs.pcbsd.org/issues/12549> worked around/resolved. 

I reproduced kernel panics before, and after, an update to yesterday's version 11.2r202.559 <http://www.freshports.org/www/linux-c6-flashplugin11/> on EOL PC-BSD 11.0-CURRENTNOV2015. 

I aim to retest after PC-BSD 11.0-CURRENTJAN2016 is distributed.
Comment 14 Graham Perrin 2016-01-01 12:18:26 UTC
…

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x8
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80b113c0
stack pointer           = 0x28:0xfffffe0121640900
frame pointer           = 0x28:0xfffffe0121640940
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1755 (kwin)
trap number             = 12
panic: page fault
cpuid = 0
KDB: stack backtrace:
#0 0xffffffff80acf0d7 at kdb_backtrace+0x67
#1 0xffffffff80a8bc62 at vpanic+0x182
#2 0xffffffff80a8bad3 at panic+0x43
#3 0xffffffff80f0e421 at trap_fatal+0x351
#4 0xffffffff80f0e614 at trap_pfault+0x1e4
#5 0xffffffff80f0ddce at trap+0x46e
#6 0xffffffff80ef1e37 at calltrap+0x8
#7 0xffffffff80b102b8 at sbdestroy+0x18
#8 0xffffffff80b1297b at sofree+0x24b
#9 0xffffffff80b1301a at soclose+0x4ca
#10 0xffffffff80a317fa at _fdrop+0x1a
#11 0xffffffff80a34fa8 at closef+0x2d8
#12 0xffffffff80a31cdd at closefp+0xbd
#13 0xffffffff80f0edbb at amd64_syscall+0x50b
#14 0xffffffff80ef211b at Xfast_syscall+0xfb
Uptime: 3m32s
Dumping 427 out of 4052 MB: …

----

The backtrace above is, at a glance, a little different. Condensed steps, as far as I recall: 

* logged in to KDE (PersonaCrypt home directory)
* used PC-BSD Control Panel to open Adobe Flash Player preferences
* closed PC-BSD Control Panel
* Adobe Flash Player preferences, Advanced, Check Now
* whilst Firefox launched, attempted to close Adobe Flash Player preferences 
  (probably a click in the close box)
* responded to a dialogue about Adobe Flash Player preferences 
  not responding
* closure of the app
* panic
----

$ date ; uptime ; freebsd-version ; uname -a ; pwd
Fri  1 Jan 2016 12:07:38 GMT
12:07pm  up 21 mins, 2 users, load averages: 0.49, 0.71, 0.63
11.0-CURRENTNOV2015
FreeBSD cces3-gjp4-pc-bsd-ergovista621.university.brighton.ac.uk 11.0-CURRENTNOV2015 FreeBSD 11.0-CURRENTNOV2015 #0 54248db(freebsd-base-graphics)-dirty: Mon Oct 26 17:00:21 UTC 2015     root@devastator:/usr/obj/net/executor/builds/git/freebsd-11-graphics/sys/GENERIC  amd64
Comment 15 Graham Perrin 2016-12-20 03:14:43 UTC
Adobe Flash Player beta
=======================

Tested on a FreeBSD-CURRENT based OS with a relatively modern HP EliteBook 850 G2 with an external display on VGA (the integral display is not driven). 

----

[   214.441] (II) Module intel: vendor="X.Org Foundation"
[   214.442]    compiled for 1.18.4, module version = 2.99.917
[   214.442]    Module class: X.Org Video Driver
[   214.442]    ABI class: X.Org Video Driver, version 20.0
[   214.442] (II) intel: Driver for Intel(R) Integrated Graphics Chipsets:
        i810, i810-dc100, i810e, i815, i830M, 845G, 854, 852GM/855GM, 865G,
        915G, E7221 (i915), 915GM, 945G, 945GM, 945GME, Pineview GM,
        Pineview G, 965G, G35, 965Q, 946GZ, 965GM, 965GME/GLE, G33, Q35, Q33,
        GM45, 4 Series, G45/G43, Q45/Q43, G41, B43
[   214.442] (II) intel: Driver for Intel(R) HD Graphics: 2000-6000
[   214.442] (II) intel: Driver for Intel(R) Iris(TM) Graphics: 5100, 6100
[   214.442] (II) intel: Driver for Intel(R) Iris(TM) Pro Graphics: 5200, 6200, P6300
[   214.442] (--) Using syscons driver with X support (version 549739036674.0)
[   214.442] (++) using VT number 9

[   214.452] (II) intel(0): Using Kernel Mode Setting driver: i915, version 1.6.0 20160425
[   214.452] (WW) VGA arbiter: cannot open kernel arbiter, no multi-card support
[   214.453] (--) intel(0): Integrated Graphics Chipset: Intel(R) HD Graphics 5500

----

$ uname -v
FreeBSD 12.0-CURRENT #6 3a85611(drm-next-4.7): Fri Dec 16 19:46:18 UTC 2016     root@gauntlet:/usr/obj/usr/src/sys/GENERIC 
$ pkg info linux-c6-flashplugin | grep -i version
pkg-static: No package(s) matching linux-c6-flashplugin
$ pkg info linux-c6-flashplugin24 | grep -i version
Version        : 24.0.0.154
$ flash-player-properties
Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element
Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element
Fontconfig warning: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 80: saw unknown, expected number

(epiphany:8863): GVFS-RemoteVolumeMonitor-WARNING **: remote volume monitor with dbus name org.gtk.vfs.HalVolumeMonitor is not supported

(epiphany:8863): IBUS-WARNING **: Unable to connect to ibus: Could not connect: 

(epiphany:8863): Gdk-WARNING **: The program 'epiphany' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadRequest (invalid request code or no such operation)'.
  (Details: serial 5515 error_code 1 request_code 0 (core protocol) minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the GDK_SYNCHRONIZE environment
   variable to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

LEAK: 1 WebFrame
LEAK: 1 WebPage
LEAK: 1 CachedResource
LEAK: 1 WebFrame
LEAK: 1 WebPage
LEAK: 16 WebCoreNode
LEAK: 1 CachedResource
^C
$ 

I treat the crash of Web as negligible at this time, it did not occur with a slightly inferior version level of the OS. Neither was there a panic with that inferior version. 

Side note: the check routine did not respect my preference for Firefox. 


Adobe Flash Player ESR
======================

Tested with the same version of TrueOS Desktop on the much older Ergo notebook. At a glance this, too, uses KMS. 

No panic.
Comment 16 Graham Perrin 2016-12-20 04:30:20 UTC
My previous comment was posted too soon. Sorry. I should have waited **much** longer after pressing the button in the Adobe dialogue. 

From <https://gitter.im/trueos/troubleshooting?at=5858b0b796a565f844060d95>: 

> this morning's events with the HP EliteBook 850 G2 are symptomatic of a kernel panic some time (not always immediately) after using Adobe Flash Player Preferences to check for updates.