[Bug 285813] Panic (NULL deref) in arptimer

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285813

--- Comment #2 from Peter Blok <[email protected]> ---
Well v has been optimised out, but as far as I can tell lv_rw_owner returns
NULL when RW_LOCK_READ is set. But to reach the call to lv_rw_owner
RW_LOCK_READ has to be unset.

#define lv_rw_wowner(v)                         \
    ((v) & RW_LOCK_READ ? NULL :                    \
     (struct thread *)RW_OWNER((v)))

To me it looks as if another thread got the lock in between the if and the call
to lv_rw_owner

(kgdb) bt
#0  __curthread () at /usr/14-stable/sys/amd64/include/pcpu_aux.h:57
#1  doadump (textdump=<optimized out>) at
/usr/14-stable/sys/kern/kern_shutdown.c:405
#2  0xffffffff805ebfcb in kern_reboot (howto=260) at
/usr/14-stable/sys/kern/kern_shutdown.c:523
#3  0xffffffff805ec4c9 in vpanic (fmt=0xffffffff80a03764 "%s",
ap=ap@entry=0xfffffe00109d6bb0) at /usr/14-stable/sys/kern/kern_shutdown.c:967
#4  0xffffffff805ec303 in panic (fmt=<unavailable>) at
/usr/14-stable/sys/kern/kern_shutdown.c:891
#5  0xffffffff809a61af in trap_fatal (frame=<optimized out>, eva=<optimized
out>) at /usr/14-stable/sys/amd64/amd64/trap.c:986
#6  0xffffffff809a61af in trap_pfault (frame=0xfffffe00109d6c30,
usermode=false, signo=<optimized out>, ucode=<optimized out>)
#7  <signal handler called>
#8  __rw_wlock_hard (c=c@entry=0xfffff8001bc27d28, v=<optimized out>) at
/usr/14-stable/sys/kern/kern_rwlock.c:1005
#9  0xffffffff80748432 in arptimer (arg=0xfffff8001bc27c00) at
/usr/14-stable/sys/netinet/if_ether.c:212
#10 0xffffffff8060a249 in softclock_call_cc (c=0xfffff8001bc27cd0,
cc=cc@entry=0xffffffff81ddd0c0, direct=direct@entry=0)
    at /usr/14-stable/sys/kern/kern_timeout.c:719
#11 0xffffffff8060ba15 in softclock_thread (arg=arg@entry=0xffffffff81ddd0c0)
at /usr/14-stable/sys/kern/kern_timeout.c:858
#12 0xffffffff805a6a41 in fork_exit (callout=0xffffffff8060b930
<softclock_thread>, arg=0xffffffff81ddd0c0, frame=0xfffffe00109d6f40)
    at /usr/14-stable/sys/kern/kern_fork.c:1153
#13 <signal handler called>
#14 0xa5b2b4b2b4a3b4b2 in ?? ()

-- 
You are receiving this mail because:
You are the assignee for the bug.