kern/99825: Repeated crashes after a few days of uptime

[Daniel J. O'Connor]

>Number:         99825
>Category:       kern
>Synopsis:       Repeated crashes after a few days of uptime
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jul 06 01:20:18 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Daniel J. O'Connor
>Release:        FreeBSD 6.1-STABLE i386
>Organization:
>Environment:
System: FreeBSD midget.dons.net.au 6.1-STABLE FreeBSD 6.1-STABLE #0: Mon Jun 26 21:09:27 CST 2006 darius at midget.dons.net.au:/data/obj/data/src/sys/MIDGET i386

>Description:
I get a panic after a few days of uptime, it does not appear to be directly
related to any specific activity. I have run memtest86 and burncpu for several
hours with no instability noted.

This system is my wife's main PC (she browses web pages, reads email, etc) as
well as running mail (sendmail, MIMEdefang, Cyrus IMAPD, SpamAssassin), web
serving (apache), as well as Samba and OpenLDAP. The internet link is PPPoE.

Peculiarly, after the panic the machine reboots several times and panics in
other places (before userland starts, so no dump..) and then hangs solid at
a panic message. I've turned "quick boot" off in the BIOS but no change.. A
cold reset brings it back to the land of the living.

welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0xfc
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0512564
stack pointer           = 0x28:0xdec8ab1c
frame pointer           = 0x28:0xdec8ab4c
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 46867 (rtorrent)
trap number             = 12
panic: page fault
Uptime: 2d4h26m53s
Dumping 511 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 511MB (130800 pages) (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  495 (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  479 463 447 431 415 399 383 367 351 335 319 303 (CTRL-C to abort)  287 271 255 239 223 207 191 175 159 (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  143 (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  127 (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  111 (CTRL-C to abort)  (CTRL-C to abort)  (CTRL-C to abort)  95 79 63 47 31 15

#0  doadump () at pcpu.h:165
165     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc04eaf44 in boot (howto=260) at /data/src/sys/kern/kern_shutdown.c:409
#2  0xc04eb1dc in panic (fmt=0xc06462f7 "%s") at /data/src/sys/kern/kern_shutdown.c:565
#3  0xc06262dc in trap_fatal (frame=0xdec8aadc, eva=252) at /data/src/sys/i386/i386/trap.c:836
#4  0xc0626043 in trap_pfault (frame=0xdec8aadc, usermode=0, eva=252) at /data/src/sys/i386/i386/trap.c:744
#5  0xc0625ca1 in trap (frame=
      {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = 4087, tf_esi = 84, tf_ebp = -557274292, tf_isp = -557274360, tf_ebx = -997227776, tf_edx = -991687512, tf_ecx = 0, tf_eax = -1066928096, tf_trapno = 12, tf_err = 0, tf_eip = -1068423836, tf_cs = 32, tf_eflags = 2163334, tf_esp = -1068444423, tf_ss = -991687512}) at /data/src/sys/i386/i386/trap.c:434
#6  0xc0615b3a in calltrap () at /data/src/sys/i386/i386/exception.s:139
#7  0xc0512564 in soo_poll (fp=0x54, events=-557274220, active_cred=0xdec8ab84, td=0x122) at /data/src/sys/kern/sys_socket.c:232
#8  0xc050cff1 in kern_select (td=0xc48f8300, nd=290, fd_in=0x8122000, fd_ou=0x8122400, fd_ex=0x8122800, tvp=0xdec8acd0)
    at /data/src/sys/kern/sys_generic.c:763
#9  0xc050cc40 in select (td=0xc48f8300, uap=0xdec8ad04) at /data/src/sys/kern/sys_generic.c:667
#10 0xc06265f3 in syscall (frame=
      {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = 289, tf_esi = 134960488, tf_ebp = -1077942552, tf_isp = -557273756, tf_ebx = 0, tf_edx = 0, tf_ecx = 135193600, tf_eax = 93, tf_trapno = 0, tf_err = 2, tf_eip = 677214055, tf_cs = 51, tf_eflags = 2097798, tf_esp = -1077942644, tf_ss = 59}) at /data/src/sys/i386/i386/trap.c:981
#11 0xc0615b8f in Xint0x80_syscall () at /data/src/sys/i386/i386/exception.s:200
#12 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

Also, this is peculiar..
#7  0xc0512564 in soo_poll (fp=0x54, events=-557274220, active_cred=0xdec8ab84, td=0x122) at /data/src/sys/kern/sys_socket.c:232
232     {
Current language:  auto; currently c
(kgdb) list
227     soo_poll(fp, events, active_cred, td)
228             struct file *fp;
229             int events;
230             struct ucred *active_cred;
231             struct thread *td;
232     {
233             struct socket *so = fp->f_data;
234             int error;
235
236             NET_LOCK_GIANT();
(kgdb) print fp
$1 = (struct file *) 0x54
(kgdb) up
#8  0xc050cff1 in kern_select (td=0xc48f8300, nd=290, fd_in=0x8122000, fd_ou=0x8122400, fd_ex=0x8122800, tvp=0xdec8acd0)
    at /data/src/sys/kern/sys_generic.c:763
763             error = selscan(td, ibits, obits, nd);
(kgdb) print td
$2 = (struct thread *) 0xc48f8300

What happened to td/fp?

>How-To-Repeat:
Wait :(

>Fix:



>Release-Note:
>Audit-Trail:
>Unformatted: