Bug 149479 - [panic] 8.1-RELEASE kernel panic
Summary: [panic] 8.1-RELEASE kernel panic
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 8.1-RELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2010-08-09 23:50 UTC by Oleksandr V. Typlyns'kyi
Modified: 2022-10-17 12:17 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Oleksandr V. Typlyns'kyi 2010-08-09 23:50:01 UTC
Unread portion of the kernel message buffer:
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 3; apic id = 03
fault virtual address   = 0x14
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0688fef
stack pointer           = 0x28:0xe81589d4
frame pointer           = 0x28:0xe81589f0
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = 18657 (httpd)
trap number             = 12
panic: page fault
cpuid = 3
Uptime: 7d1h3m30s
Physical memory: 2038 MB
Dumping 258 MB: 243 227 211 195 179 163 147 131 115 99 83 67 51 35 19 3

Reading symbols from /boot/kernel/aio.ko...done.
Loaded symbols for /boot/kernel/aio.ko
#0  doadump () at pcpu.h:246
246             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) where
#0  doadump () at pcpu.h:246
#1  0xc064d8e7 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:416
#2  0xc064db49 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:590
#3  0xc082c76c in trap_fatal (frame=0xe8158994, eva=20) at /usr/src/sys/i386/i386/trap.c:938
#4  0xc082d061 in trap (frame=0xe8158994) at /usr/src/sys/i386/i386/trap.c:328
#5  0xc080fdfb in calltrap () at /usr/src/sys/i386/i386/exception.s:165
#6  0xc0688fef in turnstile_broadcast (ts=0x0, queue=0) at /usr/src/sys/kern/subr_turnstile.c:832
#7  0xc063da09 in _mtx_unlock_sleep (m=0xc094b950, opts=0, file=0x0, line=0) at /usr/src/sys/kern/kern_mutex.c:675
#8  0xc06ccbd1 in lookup (ndp=0xe8158b5c) at /usr/src/sys/kern/vfs_lookup.c:907
#9  0xc06cd28b in namei (ndp=0xe8158b5c) at /usr/src/sys/kern/vfs_lookup.c:269
#10 0xc06dbad2 in kern_statat_vnhook (td=0xcae82500, flag=512, fd=-100, path=0xbfbfa118 <Address 0xbfbfa118 out of bounds>, pathseg=UIO_USERSPACE, sbp=0xe8158c18, hook=0)
    at /usr/src/sys/kern/vfs_syscalls.c:2346
#11 0xc06dbc4c in kern_statat (td=0xcae82500, flag=512, fd=-100, path=0xbfbfa118 <Address 0xbfbfa118 out of bounds>, pathseg=UIO_USERSPACE, sbp=0xe8158c18)
    at /usr/src/sys/kern/vfs_syscalls.c:2327
#12 0xc06dbc86 in kern_lstat (td=0xcae82500, path=0xbfbfa118 <Address 0xbfbfa118 out of bounds>, pathseg=UIO_USERSPACE, sbp=0xe8158c18) at /usr/src/sys/kern/vfs_syscalls.c:2400
#13 0xc06dbd2f in lstat (td=0xcae82500, uap=0xe8158cf8) at /usr/src/sys/kern/vfs_syscalls.c:2390
#14 0xc082ccc3 in syscall (frame=0xe8158d38) at /usr/src/sys/i386/i386/trap.c:1111
#15 0xc080fe60 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:261
#16 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) bt full
#0  doadump () at pcpu.h:246
No locals.
#1  0xc064d8e7 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:416
        _giantcnt = Variable "_giantcnt" is not available.
(kgdb) list *0xc0688fef
0xc0688fef is in turnstile_broadcast (/usr/src/sys/kern/subr_turnstile.c:832).
827
828             /*
829              * Transfer the blocked list to the pending list.
830              */
831             mtx_lock_spin(&td_contested_lock);
832             TAILQ_CONCAT(&ts->ts_pending, &ts->ts_blocked[queue], td_lockq);
833             mtx_unlock_spin(&td_contested_lock);
834
835             /*
836              * Give a turnstile to each thread.  The last thread gets
(kgdb) list *0xc06cd28b
0xc06cd28b is in namei (/usr/src/sys/kern/vfs_lookup.c:269).
264                             VREF(dp);
265                     }
266                     if (vfslocked)
267                             ndp->ni_cnd.cn_flags |= GIANTHELD;
268                     ndp->ni_startdir = dp;
269                     error = lookup(ndp);
270                     if (error) {
271                             uma_zfree(namei_zone, cnp->cn_pnbuf);
272     #ifdef DIAGNOSTIC
273                             cnp->cn_pnbuf = NULL;
(kgdb) list *0xc06dbad2
0xc06dbad2 is in kern_statat_vnhook (/usr/src/sys/kern/vfs_syscalls.c:2346).
2341
2342            NDINIT_AT(&nd, LOOKUP, ((flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW :
2343                FOLLOW) | LOCKSHARED | LOCKLEAF | AUDITVNODE1 | MPSAFE, pathseg,
2344                path, fd, td);
2345
2346            if ((error = namei(&nd)) != 0)
2347                    return (error);
2348            vfslocked = NDHASGIANT(&nd);
2349            error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
2350            if (!error) {
(kgdb) list *0xc06dbc4c
0xc06dbc4c is in kern_statat (/usr/src/sys/kern/vfs_syscalls.c:2328).
2323    kern_statat(struct thread *td, int flag, int fd, char *path,
2324        enum uio_seg pathseg, struct stat *sbp)
2325    {
2326
2327            return (kern_statat_vnhook(td, flag, fd, path, pathseg, sbp, NULL));
2328    }
2329
2330    int
2331    kern_statat_vnhook(struct thread *td, int flag, int fd, char *path,
2332        enum uio_seg pathseg, struct stat *sbp,
(kgdb) list *0xc06dbd2f
0xc06dbd2f is in lstat (/usr/src/sys/kern/vfs_syscalls.c:2391).
2386    {
2387            struct stat sb;
2388            int error;
2389
2390            error = kern_lstat(td, uap->path, UIO_USERSPACE, &sb);
2391            if (error == 0)
2392                    error = copyout(&sb, uap->ub, sizeof (sb));
2393            return (error);
2394    }
Comment 1 Remko Lodder freebsd_committer freebsd_triage 2010-09-05 11:49:26 UTC
Responsible Changed
From-To: freebsd-i386->freebsd-bugs

This might be more generic then i386 only
Comment 2 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:59:25 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 3 Graham Perrin freebsd_committer freebsd_triage 2022-10-17 12:17:45 UTC
Keyword: 

    crash

– in lieu of summary line prefix: 

    [panic]

* bulk change for the keyword
* summary lines may be edited manually (not in bulk). 

Keyword descriptions and search interface: 

    <https://bugs.freebsd.org/bugzilla/describekeywords.cgi>