Bug 48039

SMP 2 cpus
IdlePTD at phsyical address 0x002bb000
initial pcb at physical address 0x00236ee0
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
mp_lock = 00000002; cpuid = 0; lapic.id = 00000000
fault virtual address   = 0xc
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc01b1aef
stack pointer           = 0x10:0xf58b0dbc
frame pointer           = 0x10:0xf58b0dc4
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 96638 (cron)
interrupt mask          = none <- SMP: XXX
trap number             = 12
panic: page fault
mp_lock = 00000002; cpuid = 0; lapic.id = 00000000
boot() called on cpu#0

.....

(kgdb) where
#0  0xc95a2256 in ?? ()
#1  0xc013fb78 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:223
#2  0xc014029d in panic (fmt=0xc02136d9 "%s") at /usr/src/sys/kern/kern_shutdown.c:595
#3  0xc01e6e9d in trap_fatal (frame=0xf58b0d7c, eva=12) at /usr/src/sys/i386/i386/trap.c:974
#4  0xc01e6b09 in trap_pfault (frame=0xf58b0d7c, usermode=0, eva=12) at /usr/src/sys/i386/i386/trap.c:867
#5  0xc01e6663 in trap (frame={tf_fs = -175439848, tf_es = -1071972336, tf_ds = -1071448048, tf_edi = -169869312, tf_esi = -175436296, tf_ebp = -175436348,
      tf_isp = -175436376, tf_ebx = -1071398996, tf_edx = -454736464, tf_ecx = -169869312, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1071965457,
      tf_cs = 8, tf_eflags = 66055, tf_esp = -169869312, tf_ss = -169852928}) at /usr/src/sys/i386/i386/trap.c:466
#6  0xc01b1aef in vm_map_lookup_entry (map=0xc023bfac, address=4125097984, entry=0xf58b0df8) at /usr/src/sys/vm/vm_map.c:476
#7  0xc01b33b2 in vm_map_delete (map=0xc023bfac, start=4125097984, end=4125114368) at /usr/src/sys/vm/vm_map.c:2080
#8  0xc01b35ca in vm_map_remove (map=0xc023bfac, start=4125097984, end=4125114368) at /usr/src/sys/vm/vm_map.c:2198
#9  0xc01b1161 in kmem_free (map=0xc023bfac, addr=4125097984, size=16384) at /usr/src/sys/vm/vm_kern.c:233
#10 0xc01513a8 in pipe_free_kmem (cpipe=0xfbd17280) at /usr/src/sys/kern/sys_pipe.c:1166
#11 0xc015151e in pipeclose (cpipe=0xfbd17280) at /usr/src/sys/kern/sys_pipe.c:1222
#12 0xc015136d in pipe_close (fp=0xc96aefc0, p=0xf50e48a0) at /usr/src/sys/kern/sys_pipe.c:1153
#13 0xc0135887 in fdrop (fp=0xc96aefc0, p=0xf50e48a0) at /usr/src/sys/sys/file.h:218
#14 0xc01357cf in closef (fp=0xc96aefc0, p=0xf50e48a0) at /usr/src/sys/kern/kern_descrip.c:1279
#15 0xc0134bd1 in close (p=0xf50e48a0, uap=0xf58b0f80) at /usr/src/sys/kern/kern_descrip.c:581
#16 0xc01e71d9 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 0, tf_esi = 672186944, tf_ebp = -1077938468, tf_isp = -175435820,
      tf_ebx = 672111748, tf_edx = 0, tf_ecx = 0, tf_eax = 6, tf_trapno = 7, tf_err = 2, tf_eip = 672065104, tf_cs = 31, tf_eflags = 647,
      tf_esp = -1077938512, tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1175
#17 0xc01d451b in Xint0x80_syscall ()
#18 0x280dc74b in ?? ()
#19 0x804b12b in ?? ()
#20 0x804a798 in ?? ()
#21 0x804b2ce in ?? ()
#22 0x804a001 in ?? ()
#23 0x8049b30 in ?? ()
#24 0x80498f5 in ?? ()
(kgdb) up 5
#5  0xc01e6663 in trap (frame={tf_fs = -175439848, tf_es = -1071972336, tf_ds = -1071448048, tf_edi = -169869312, tf_esi = -175436296, tf_ebp = -175436348,
      tf_isp = -175436376, tf_ebx = -1071398996, tf_edx = -454736464, tf_ecx = -169869312, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1071965457,
      tf_cs = 8, tf_eflags = 66055, tf_esp = -169869312, tf_ss = -169852928}) at /usr/src/sys/i386/i386/trap.c:466
466                             (void) trap_pfault(&frame, FALSE, eva);
(kgdb) frame frame->tf_ebp frame->tf_eip
#0  vm_map_lookup_entry (map=0xc023bfac, address=4125097984, entry=0xf58b0df8) at /usr/src/sys/vm/vm_map.c:462
462                     if (cur->end > address) {
(kgdb) list
457             /*
458              * Search linearly
459              */
460
461             while (cur != last) {
462                     if (cur->end > address) {
463                             if (address >= cur->start) {
464                                     /*
465                                      * Save this lookup for future hints, and
466                                      * return