Kernel Panic: general protection fault in ng_netflow_flow6_add #260
Description
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
- I have read the contributing guide lines at https://github.com/opnsense/src/blob/master/CONTRIBUTING.md
- I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/src/issues?q=is%3Aissue
Describe the bug
The system experiences a recurring kernel panic when the NetFlow / Insight reporting feature is enabled. The panic is a "Fatal trap 9: general protection fault" that occurs deep within the kernel's networking stack, specifically within the Netgraph NetFlow module.
The backtrace consistently points to the ng_netflow_flow6_add function, indicating the crash is triggered when processing an IPv6 data flow.
To Reproduce
Steps to reproduce the behavior:
Enable the "Insight" service under Reporting -> Insight on one or more interfaces that handle IPv6 traffic.
Allow network traffic to flow normally.
The system will eventually panic and reboot. The trigger appears to be a specific type of IPv6 packet, but it occurs during regular operation.
Expected behavior
The system should remain stable with the NetFlow/Insight service enabled, correctly processing both IPv4 and IPv6 traffic without causing a kernel panic.
Relevant log files
Crash report
[639965] load_dn_sched dn_sched FIFO loaded
[639965] load_dn_sched dn_sched QFQ loaded
[639965] load_dn_sched dn_sched RR loaded
[639965] load_dn_sched dn_sched WF2Q+ loaded
[639965] load_dn_sched dn_sched PRIO loaded
[639965] load_dn_sched dn_sched FQ_CODEL loaded
[639965] load_dn_sched dn_sched FQ_PIE loaded
[639965] load_dn_aqm dn_aqm CODEL loaded
[639965] load_dn_aqm dn_aqm PIE loaded
[640128] ipfw2 (+ipv6) initialized, divert loadable, nat loadable, default to accept, logging disabled
[833564]
[833564]
[833564] Fatal trap 9: general protection fault while in kernel mode
[833564] cpuid = 15; apic id = 2e
[833564] instruction pointer = 0x20:0xffffffff80bb48e9
[833564] stack pointer = 0x28:0xfffffe0038f4c940
[833564] frame pointer = 0x28:0xfffffe0038f4c9c0
[833564] code segment = base 0x0, limit 0xfffff, type 0x1b
[833564] = DPL 0, pres 1, long 1, def32 0, gran 1
[833564] processor eflags = interrupt enabled, resume, IOPL = 0
[833564] current process = 0 (if_io_tqg_15)
[833564] rdi: fffffe01888c2368 rsi: 0040000000000000 rdx: 0000000000000000
[833564] rcx: 0000000000000001 r8: 0000000006000003 r9: 0000000000000000
[833564] rax: 0040000000000000 rbx: fffff80001b93000 rbp: fffffe0038f4c9c0
[833564] r10: 0000000000000050 r11: 0000000000000002 r12: 0000000000000000
[833564] r13: fffff80001b93000 r14: fffffe0038f4c968 r15: fffffe01888c2368
[833564] trap number = 9
[833564] panic: general protection fault
[833564] cpuid = 15
[833564] time = 1755876649
[833564] KDB: stack backtrace:
[833564] db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0038f4c6c0
[833564] vpanic() at vpanic+0x161/frame 0xfffffe0038f4c7f0
[833564] panic() at panic+0x43/frame 0xfffffe0038f4c850
[833564] trap_fatal() at trap_fatal+0x68/frame 0xfffffe0038f4c870
[833564] calltrap() at calltrap+0x8/frame 0xfffffe0038f4c870
[833564] --- trap 0x9, rip = 0xffffffff80bb48e9, rsp = 0xfffffe0038f4c940, rbp = 0xfffffe0038f4c9c0 ---
[833564] __mtx_lock_sleep() at __mtx_lock_sleep+0xc9/frame 0xfffffe0038f4c9c0
[833564] ng_netflow_flow6_add() at ng_netflow_flow6_add+0x50e/frame 0xfffffe0038f4ca70
[833564] ng_netflow_rcvdata() at ng_netflow_rcvdata+0x83f/frame 0xfffffe0038f4caf0
[833564] ng_apply_item() at ng_apply_item+0x147/frame 0xfffffe0038f4cb90
[833564] ng_snd_item() at ng_snd_item+0x26c/frame 0xfffffe0038f4cbd0
[833564] ng_ether_input() at ng_ether_input+0x4c/frame 0xfffffe0038f4cc00
[833564] ether_nh_input() at ether_nh_input+0x1dc/frame 0xfffffe0038f4cc60
[833564] netisr_dispatch_src() at netisr_dispatch_src+0x9f/frame 0xfffffe0038f4ccb0
[833564] ether_input() at ether_input+0x56/frame 0xfffffe0038f4cd00
[833564] iflib_rxeof() at iflib_rxeof+0xc4e/frame 0xfffffe0038f4ce00
[833564] _task_fn_rx() at _task_fn_rx+0x72/frame 0xfffffe0038f4ce40
[833564] gtaskqueue_run_locked() at gtaskqueue_run_locked+0x14e/frame 0xfffffe0038f4cec0
[833564] gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0xc2/frame 0xfffffe0038f4cef0
[833564] fork_exit() at fork_exit+0x81/frame 0xfffffe0038f4cf30
[833564] fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0038f4cf30
[833564] --- trap 0x8054bef0, rip = 0x1ec5e32, rsp = 0, rbp = 0xc ---
[833564] KDB: enter: panic
Environment
Software version used and hardware type if relevant, e.g.:
OPNsense Version: 25.7.1_1
FreeBSD Version: 14.3-RELEASE-p1
Architecture: amd64 (SMP)