kern/87596: [panic] OS crash on a Firefox link click (FreeBSD 6.0-RC1, kernel with options)

[Alex Goncharov]

The following reply was made to PR kern/87596; it has been noted by GNATS.

From: Alex Goncharov <algo at relicore.com>
To: bug-followup at FreeBSD.org, goncharov.alex at gmail.com
Cc:  
Subject: Re: kern/87596: [panic] OS crash on a Firefox link click (FreeBSD
 6.0-RC1, kernel with options)
Date: Wed, 19 Oct 2005 08:29:10 -0400

 One more system crash this past night, with no user activity on the 
 system.  The backtrace follows:
 
 -------------------------------------------------------------------
 kgdb kernel.debug /var/crash/vmcore.1
 [GDB will not be able to debug user-mode threads: 
 /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain 
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-marcel-freebsd".
 
 Unread portion of the kernel message buffer:
 panic: clist reservation botch
 Uptime: 1d4h8m34s
 Dumping 511 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 511MB (130800 pages) 495 479 463 447 431 415 399 383 367 351 
 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 
 31 15
 
 #0  doadump () at pcpu.h:165
 165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
 (kgdb) bt
 #0  doadump () at pcpu.h:165
 #1  0xc0637ffa in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
 #2  0xc0638290 in panic (fmt=0xc086a79b "clist reservation botch") at 
 /usr/src/sys/kern/kern_shutdown.c:555
 #3  0xc066b900 in cblock_free_cblocks (number=77) at 
 /usr/src/sys/kern/tty_subr.c:104
 #4  0xc066b954 in clist_free_cblocks (clistp=0xc1b12800) at 
 /usr/src/sys/kern/tty_subr.c:209
 #5  0xc0664470 in tty_close (tp=0xc1b12800) at /usr/src/sys/kern/tty.c:327
 #6  0xc066ad07 in ptsclose (dev=0x0, flag=3, mode=8192, td=0xc1f19780) 
 at /usr/src/sys/kern/tty_pty.c:203
 #7  0xc060fb67 in giant_close (dev=0xc2013200, fflag=3, devtype=8192, 
 td=0xc1f19780) at /usr/src/sys/kern/kern_conf.c:267
 #8  0xc05ed897 in devfs_close (ap=0xda9fdab8) at 
 /usr/src/sys/fs/devfs/devfs_vnops.c:287
 #9  0xc0816b10 in VOP_CLOSE_APV (vop=0x0, a=0x0) at vnode_if.c:426
 #10 0xc06990c6 in vn_close (vp=0xc2408880, flags=3, file_cred=0x0, 
 td=0xc1f19780) at vnode_if.h:227
 #11 0xc0699f06 in vn_closefile (fp=0xc1f86a20, td=0xc1f19780) at 
 /usr/src/sys/kern/vfs_vnops.c:864
 #12 0xc05ed8bf in devfs_close_f (fp=0xc1f86a20, td=0xc1f19780) at 
 /usr/src/sys/fs/devfs/devfs_vnops.c:297
 #13 0xc06198a8 in fdrop_locked (fp=0xc1f86a20, td=0xc1f19780) at file.h:289
 #14 0xc06197f9 in fdrop (fp=0xc1f86a20, td=0xc1f19780) at 
 /usr/src/sys/kern/kern_descrip.c:2101
 #15 0xc0617e27 in closef (fp=0xc1f86a20, td=0xc1f19780) at 
 /usr/src/sys/kern/kern_descrip.c:1921
 #16 0xc0616dd3 in fdfree (td=0xc1f19780) at 
 /usr/src/sys/kern/kern_descrip.c:1622
 #17 0xc0620139 in exit1 (td=0xc1f19780, rv=0) at 
 /usr/src/sys/kern/kern_exit.c:237
 #18 0xc061fc64 in sys_exit (td=0xc1f19780, uap=0x0) at 
 /usr/src/sys/kern/kern_exit.c:94
 #19 0xc0807b07 in syscall (frame=
       {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = 671507080, tf_esi = 
 -1077940988, tf_ebp = -1077941208, tf_isp = -627057308, tf_ebx = 3, 
 tf_edx = 0, tf_ecx = 0, tf_eax = 1, tf_trapno = 0, tf_err = 2, tf_eip = 
 672257075, tf_cs = 51, tf_eflags = 662, tf_esp = -1077941332, tf_ss = 
 59}) at /usr/src/sys/i386/i386/trap.c:976
 #20 0xc07f69ef in Xint0x80_syscall () at 
 /usr/src/sys/i386/i386/exception.s:200
 #21 0x00000033 in ?? ()
 Previous frame inner to this frame (corrupt stack?)
 (kgdb)
 --------------------------------------------------------------------------
 
 # ls -l /var/crash/vmcore.1
 -rw-------  1 root  wheel  536412160 Oct 19 01:30 /var/crash/vmcore.1