22.05.b.20220513.0600 UPnP Crash

Bob.Dig

Version 22.05-BETA (amd64)
built on Fri May 13 06:28:24 UTC 2022
FreeBSD 12.3-STABLE

When I start tixati, a P2P application for windows, it will try to use UPnP.
I then tried to look at "Status UPnP & NAT-PMP" but pfSense already is crashing and will reboot.
Tried it 3 times.

My config:
PPPoE done by pfSense
Limiters on WAN

BIOS 	Vendor: Microsoft Corporation
Version: Hyper-V UEFI Release v4.1
Release Date: Thu Dec 3 2020
Boot Environment 	Current: default
Next: default
Version 	22.05-BETA (amd64)
built on Fri May 13 06:28:24 UTC 2022
FreeBSD 12.3-STABLE

The system is on the latest version.
Version information updated at Sat May 14 22:28:34 CEST 2022

stephenw10

You have a crash report or a panic string? Console log?

Bob.Dig

@stephenw10 I have info.0 and textdump.tar.0

Dump header from device: /dev/da1p3
  Architecture: amd64
  Architecture Version: 4
  Dump Length: 75776
  Blocksize: 512
  Compression: none
  Dumptime: Sat May 14 22:16:17 2022
  Hostname: pfSense.home.arpa
  Magic: FreeBSD Text Dump
  Version String: FreeBSD 12.3-STABLE plus-devel-12-n202677-15e5e3705cd pfSense
  Panic String: page fault
  Dump Parity: 1668257125
  Bounds: 0
  Dump Status: good

Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 02
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x20:0xffffffff810a8fef
stack pointer	        = 0x28:0xfffffe003a45e2b0
frame pointer	        = 0x28:0xfffffe003a45e2e0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 27958 (pfctl)
trap number		= 12
panic: page fault
cpuid = 2
time = 1652559377
KDB: enter: panic

stephenw10

Can we see the backtrace from ddb.txt?

The output between db:0:kdb.enter.default> bt and db:0:kdb.enter.default> ps.

Steve

Bob.Dig

@stephenw10 Found it.

db:0:kdb.enter.default>  bt
Tracing pid 27958 tid 100558 td 0xfffff8003af7c740
kdb_enter() at kdb_enter+0x37/frame 0xfffffe003a45e070
vpanic() at vpanic+0x194/frame 0xfffffe003a45e0c0
panic() at panic+0x43/frame 0xfffffe003a45e120
trap_fatal() at trap_fatal+0x38f/frame 0xfffffe003a45e180
trap_pfault() at trap_pfault+0x4f/frame 0xfffffe003a45e1e0
calltrap() at calltrap+0x8/frame 0xfffffe003a45e1e0
--- trap 0xc, rip = 0xffffffff810a8fef, rsp = 0xfffffe003a45e2b0, rbp = 0xfffffe003a45e2e0 ---
pf_krule_to_nvrule() at pf_krule_to_nvrule+0x55f/frame 0xfffffe003a45e2e0
pfioctl() at pfioctl+0x79cf/frame 0xfffffe003a45e7d0
devfs_ioctl() at devfs_ioctl+0xb0/frame 0xfffffe003a45e820
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x7b/frame 0xfffffe003a45e850
vn_ioctl() at vn_ioctl+0x16c/frame 0xfffffe003a45e960
devfs_ioctl_f() at devfs_ioctl_f+0x1e/frame 0xfffffe003a45e980
kern_ioctl() at kern_ioctl+0x298/frame 0xfffffe003a45e9f0
sys_ioctl() at sys_ioctl+0x100/frame 0xfffffe003a45eac0
amd64_syscall() at amd64_syscall+0x387/frame 0xfffffe003a45ebf0
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe003a45ebf0
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x8004960da, rsp = 0x7fffffffcc78, rbp = 0x7fffffffcce0 ---
db:0:kdb.enter.default>  ps

stephenw10

Do you know what Tixati is trying to open that triggers this?

Bob.Dig

@stephenw10 No, I only know that it is doing this right at the startup, no DLs needed. I would guess it is connecting to some DHT network and also checks if your port is open and UPnP is working.
And it has worked before.
But also I am not a regular user of its UPnP features, mostly using it in a VM together with a privacy VPN, so in general no UPnP for me.
Edit: Just to make sure I disabled UPnP in Pfsense and started tixati, no problem, so it is UPnP related.

stephenw10

Ok, we replicated that: https://redmine.pfsense.org/issues/13176

Nothing special is required, a single port mapping will hit it.

Steve

stephenw10

This should be fixed in the new snapshot. Looks good in my local testing.
Please retest and let us know.

Steve

Bob.Dig

@stephenw10 Working great now, thx guys!

havastamas

@stephenw10

Im facing with this issue again, lastest on lastest dev build. Any suggestions to solve this problem?

Thank you!

stephenw10

Same crash? Same backtrace? Todays snapshot?

w0w

@stephenw10
https://forum.netgate.com/topic/172502/fatal-trap-12-since-22-05-b-20220526-0600/6

stephenw10

@w0w said in 22.05.b.20220513.0600 UPnP Crash:

https://forum.netgate.com/topic/172502/fatal-trap-12-since-22-05-b-20220526-0600/6

Ah, OK. Continuing there...