On 25/05/19(Sat) 00:51, Lévai, Dániel wrote:
> Hi everyone!
>
> I had this panic in the recent days.
> Attached the ddb output (traces, ps) and the dmesg.
> Unfortunately I wasn't around when it happened, I have no clue what went on
> with the machine then.
> Reading through the traces it has some in6* stuff in it, this box has IPv6
> set up, if this is helpful.
> [...]
> __mtx_enter_try(ffffffff81d81cc0) at __mtx_enter_try+0x11
> end trace frame: 0xffff80002252b050, count: 0
> ddb{1}> trace
> __mtx_enter_try(ffffffff81d81cc0) at __mtx_enter_try+0x11
> __mtx_enter(ffffffff81d81cc0) at __mtx_enter+0x3a
> uvm_pmr_getpages(1,0,100000,1,0,1) at uvm_pmr_getpages+0x1cd
> uvm_pglistalloc(1000,0,ffffffff,0,0,ffff80002252b268) at uvm_pglistalloc+0x27b
> km_alloc(1000,ffff80002252b2e8,ffffffff81c32d48,ffff80002252b300) at
> km_alloc+0
> x269
> pool_multi_alloc(ffffffff81d34950,2,ffff80002252b4d4) at pool_multi_alloc+0xb0
> m_pool_alloc(ffffffff81d34950,2,ffff80002252b4d4) at m_pool_alloc+0x8a
> pool_p_alloc(ffffffff81d34950,2,ffff80002252b4d4) at pool_p_alloc+0x5a
> pool_do_get(ffffffff81d34950,2,ffff80002252b4d4) at pool_do_get+0xd3
> pool_get(ffffffff81d34950,2) at pool_get+0x93
> m_copym(fffffd80d32d6b00,0,3b9aca00,2) at m_copym+0xe4
> rtm_sendup(fffffd81193eb7c8,fffffd80d32d6b00,1) at rtm_sendup+0x52
> route_input(fffffd80d32d6b00,0,18) at route_input+0x127
> rtm_send(fffffd811a905940,2,0,0) at rtm_send+0x12e
> rtdeletemsg(fffffd811a905940,ffff80000040b000,0) at rtdeletemsg+0x118
> rtflushclone1(fffffd811a905940,fffffd811a905550,0) at rtflushclone1+0x87
> rtable_walk_helper(fffffd811d90c7a0,ffff80002252ce40) at
> rtable_walk_helper+0x5
> 3
> art_table_walk(ffff8000000a58c0,fffffd811ad5f468,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x1d9
> art_table_walk(ffff8000000a58c0,fffffd811ad5f448,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5f3a8,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5f388,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5fb68,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5fba8,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5fbc8,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5fbe8,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5fc08,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5fc88,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811ad5f728,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811983b9b0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811983b270,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811983b230,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811983b1f0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d202600,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2028e0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2028c0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2028a0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d202880,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2027c0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2027a0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d202700,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2026e0,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2628,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2608,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b25c8,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2588,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2568,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2508,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d90b540,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d90bf60,ffffffff81a094d0,ffff80002252c
> e40) at art_table_walk+0x25c
> art_walk(ffff8000000a58c0,ffffffff81a094d0,ffff80002252ce40) at art_walk+0xd3
> rtable_walk(0,18,ffffffff813d28c0,fffffd811a905550) at rtable_walk+0xa2
> rtrequest_delete(ffff80002252cf38,4,ffff80000040b000,ffff80002252cff8,0) at
> rtr
> equest_delete+0x115
> rtdeletemsg(fffffd811a905550,ffff80000040b000,0) at rtdeletemsg+0xfc
> rt_ifa_purge_walker(fffffd811a905550,ffff800000cdaa00,0) at
> rt_ifa_purge_walker
> +0x27
> rtable_walk_helper(fffffd811d90ca90,ffff80002252db60) at
> rtable_walk_helper+0x5
> 3
> art_table_walk(ffff8000000a58c0,fffffd811d2028e0,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x1d9
> art_table_walk(ffff8000000a58c0,fffffd811d2028c0,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2028a0,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d202880,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2027c0,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2027a0,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d202700,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2026e0,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2628,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2608,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b25c8,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2588,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2568,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d2b2508,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d90b540,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_table_walk(ffff8000000a58c0,fffffd811d90bf60,ffffffff81a094d0,ffff80002252d
> b60) at art_table_walk+0x25c
> art_walk(ffff8000000a58c0,ffffffff81a094d0,ffff80002252db60) at art_walk+0xd3
> rtable_walk(0,18,ffffffff813d35a0,ffff800000cdaa00) at rtable_walk+0xa2
> rt_ifa_purge(ffff800000cdaa00) at rt_ifa_purge+0x7f
> in6_unlink_ifa(ffff800000cdaa00,ffff80000040b000) at in6_unlink_ifa+0x324
> in6_purgeaddr(ffff800000cdaa00) at in6_purgeaddr+0x11e
> in6_ioctl_change_ifaddr(81206919,ffff800000cbce00,ffff80000040b000) at
> in6_ioct
> l_change_ifaddr+0x156
> ifioctl(fffffd81180a2dd8,81206919,ffff800000cbce00,ffff8000222ae018) at
> ifioctl
> +0x2b7
> sys_ioctl(ffff8000222ae018,ffff80002252df00,ffff80002252df70) at
> sys_ioctl+0x3c
> 4
> syscall(ffff80002252dfe0) at syscall+0x305
> Xsyscall(6,36,421d5b03200,36,421d5b03200,d) at Xsyscall+0x128
> end of kernel
> end trace frame: 0x7f7fffff7430, count: -81
> ddb{1}> mach ddbcpu 0
> Stopped at x86_ipi_db+0x12: leave
> ddb{0}> trace
> x86_ipi_db(ffffffff81cbaff0) at x86_ipi_db+0x12
> x86_ipi_handler() at x86_ipi_handler+0x80
> Xresume_lapic_ipi(7,ffffffff81cbaff0,ffff80000007e600,0,ffff80000007e600,ffff80
It looks like a stack exhaustion. Apparently an IPv6 address still has
some routes attached to it when its parent interface is destroyed. That
generates a first recursion. A cloning route is then found, so
rtflushclone() is called before freeing it. This generates another
recursion. Finally a routing message is being send to userland, which
requires some memory...
Having a non-recursive art_table_walk() might be a solution.
