[udp] crash in DemuxBroadcast

[diver]

hrev50001 running in VMware Fusion 7.1.3.

Haiku was running for some time mostly idling. When I switched to it from another Workspace (in OS X) it was sitting in KDL. Might be related to #9721.

'DHCP': /dev/net/pcnet/0: Send DHCP_DISCOVER to 255.255.255.255:67
'DHCP': /dev/net/pcnet/0: Received DHCP_OFFER from 192.168.132.254
'DHCP':   your_address: 192.168.132.241
'DHCP':   server: 192.168.132.254
'DHCP':   lease time: 1800 seconds
'DHCP':   subnet: 255.255.255.0
'DHCP':   gateway: 192.168.132.2
'DHCP':   nameserver[0]: 192.168.132.2
'DHCP':   broadcast: 192.168.132.255
'DHCP':   domain name: "localdomain"
'DHCP': /dev/net/pcnet/0: Send DHCP_REQUEST for 192.168.132.241 to 255.255.255.255:67
'DHCP': /dev/net/pcnet/0: Received DHCP_ACK from 192.168.132.254
'DHCP':   server: 192.168.132.254
'DHCP':   lease time: 1800 seconds
'DHCP':   subnet: 255.255.255.0
'DHCP':   gateway: 192.168.132.2
'DHCP':   nameserver[0]: 192.168.132.2
'DHCP':   broadcast: 192.168.132.255
'DHCP':   domain name: "localdomain"
read access attempted on read-protected area 0x56 at 0xdeadb000
vm_page_fault: vm_soft_fault returned error 'Permission denied' on fault at 0xdeadbefb, ip 0x817877b8, write 0, user 0, thread 0x5c5
PANIC: vm_page_fault: unhandled page fault in kernel space at 0xdeadbefb, ip 0x817877b8

Welcome to Kernel Debugging Land...
Thread 1477 "/dev/net/pcnet/0 consumer" running on CPU 1
stack trace for thread 1477 "/dev/net/pcnet/0 consumer"
    kernel stack: 0x81790000 to 0x81794000
frame               caller     <image>:function + offset
 0 81793b78 (+  32) 80144c7a   <kernel_x86> arch_debug_stack_trace + 0x12
 1 81793b98 (+  16) 800a68c7   <kernel_x86> stack_trace_trampoline(NULL) + 0x0b
 2 81793ba8 (+  12) 80136cd6   <kernel_x86> arch_debug_call_with_fault_handler + 0x1b
 3 81793bb4 (+  48) 800a834b   <kernel_x86> debug_call_with_fault_handler + 0x5f
 4 81793be4 (+  64) 800a6adb   <kernel_x86> kernel_debugger_loop(0x80188957 "PANIC: ", 0x8019f5a0 "vm_page_fault: unhandled page fault in kernel space at 0x%lx, ip 0x%lx
", 0x81793c90 "���޸wx[@\=y", int32: 1) + 0x20f
 5 81793c24 (+  48) 800a6e7f   <kernel_x86> kernel_debugger_internal(0x80188957 "PANIC: ", 0x8019f5a0 "vm_page_fault: unhandled page fault in kernel space at 0x%lx, ip 0x%lx
", 0x81793c90 "���޸wx[@\=y", int32: 1) + 0x77
 6 81793c54 (+  48) 800a86ca   <kernel_x86> panic + 0x3a
 7 81793c84 (+ 144) 8011bc5d   <kernel_x86> vm_page_fault + 0x13d
 8 81793d14 (+  80) 80146457   <kernel_x86> x86_page_fault_exception + 0x183
 9 81793d64 (+  12) 801395bc   <kernel_x86> int_bottom + 0x3c
kernel iframe at 0x81793d70 (end = 0x81793dc0)
 eax 0xdeadbeef    ebx 0x8178b1fc     ecx 0x175       edx 0xd7ed66fc
 esi 0xec5c9340    edi 0xec5c9340     ebp 0x81793e14  esp 0x81793da4
 eip 0x817877b8 eflags 0x10297   
 vector: 0xe, error code: 0x0
10 81793d70 (+ 164) 817877b8   </boot/system/add-ons/kernel/network/protocols/udp> UdpDomainSupport<0xec5c9340>::_DemuxBroadcast(net_buffer*: 0xd7ed6640) + 0x30
11 81793e14 (+  64) 81786a5f   </boot/system/add-ons/kernel/network/protocols/udp> UdpDomainSupport<0xec5c9340>::DemuxIncomingBuffer(net_buffer*: 0xd7ed6640) + 0x53
12 81793e54 (+  48) 81787d4c   </boot/system/add-ons/kernel/network/protocols/udp> UdpEndpointManager<0xd7ea01e0>::ReceiveData(net_buffer*: 0xd7ed6640) + 0x4c
13 81793e84 (+  48) 81789492   </boot/system/add-ons/kernel/network/protocols/udp> udp_receive_data(net_buffer*: 0xd7ed6640) + 0x26
14 81793eb4 (+ 128) 81aa7554   </boot/system/add-ons/kernel/network/protocols/ipv4> ipv4_receive_data(net_buffer*: 0xd7ed6640) + 0x364
15 81793f34 (+  48) 81a88ad1   </boot/system/add-ons/kernel/network/stack> domain_receive_adapter(0xd7eb3980, net_device*: 0x80dab478, net_buffer*: 0xd7ed6640) + 0x25
16 81793f64 (+  80) 81a88a1e   </boot/system/add-ons/kernel/network/stack> device_consumer_thread(0xd7eedb58) + 0x102
17 81793fb4 (+  48) 8008661e   <kernel_x86> common_thread_entry(0x81793ff0) + 0x3a

[humdinger]

similar KDL

[humdinger]

Added a screenshot of a similar KDL.

[diver]

Still here in hrev51425.

Leaving Telegram running in the background seems to trigger it.

[pulkomandy]

Got this to happen 2 or 3 times this week, at a slightly different address (deadbf33 instead of deadbefb).

Could be because of running the webkit testsuite, or maybe just DHCP traffic going on.

udp_endpoints does not show anything.

[pulkomandy]

Fixed in hrev51603.