kern/104569: panic w/zebra

Fri Jan 26 14:30:20 UTC 2007

The following reply was made to PR kern/104569; it has been noted by GNATS.

From: Mark Kamichoff <prox at prolixium.com>
To: bug-followup at FreeBSD.org
Cc:  
Subject: Re: kern/104569: panic w/zebra
Date: Fri, 26 Jan 2007 09:21:36 -0500

 Can this please be looked at?  It is still happening with 6.2-STABLE as
 of Jan 24th.  I suspect this affects any FreeBSD 6.x-based router
 running Quagga/IPv6, so perhaps the PR priority should be increased.

 Thanks.

 - Mark

 On Sun, Jan 14, 2007 at 06:25:24PM -0500,  wrote:
 > This is *almost* reproducible, now.  If I cause a number of OSPFv2/v3
 > adjacencies to time out (by unplugging cables, etc.), FreeBSD has a
 > 50-60% chance of panicking on the spot.  I assume this is due to the
 > zebra process changing around routes.
 > 
 > - Mark
 > 
 > On Mon, Dec 11, 2006 at 08:23:33AM -0500,  wrote:
 > > Is there anything else I can provide that will help tracking this down?
 > > It is still happening:
 > > 
 > > Unread portion of the kernel message buffer:
 > > kernel trap 12 with interrupts disabled
 > > 
 > > 
 > > Fatal trap 12: page fault while in kernel mode
 > > fault virtual address   = 0x78
 > > fault code              = supervisor read, page not present
 > > instruction pointer     = 0x20:0xc0554bcb
 > > stack pointer           = 0x28:0xdea8ea64
 > > frame pointer           = 0x28:0xdea8ea68
 > > code segment            = base 0x0, limit 0xfffff, type 0x1b
 > >                         = DPL 0, pres 1, def32 1, gran 1
 > > processor eflags        = resume, IOPL = 0
 > > current process         = 1548 (zebra)
 > > trap number             = 12
 > > panic: page fault
 > > Uptime: 2d5h52m33s
 > > Dumping 510 MB (2 chunks)
 > >   chunk 0: 1MB (159 pages) ... ok
 > >   chunk 1: 510MB (130544 pages) 494 478 462 446 430 414 398 382 366 350 334 318 302 286 270 254 238 222 206 190 174 158 142 126 110 94 78 62 46 30 14
 > > 
 > > #0  doadump () at pcpu.h:165
 > > 165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
 > > (kgdb) bt
 > > #0  doadump () at pcpu.h:165
 > > #1  0xc052f46e in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
 > > #2  0xc052f778 in panic (fmt=0xc0709d51 "%s") at /usr/src/sys/kern/kern_shutdown.c:565
 > > #3  0xc06e5d2d in trap_fatal (frame=0xdea8ea24, eva=0) at /usr/src/sys/i386/i386/trap.c:837
 > > #4  0xc06e5445 in trap (frame=
 > >       {tf_fs = -629538808, tf_es = -1066139608, tf_ds = 40, tf_edi = -1015486796, tf_esi = -1014488704, tf_ebp = -559355288, tf_isp = -559355312, tf_ebx = -1015492032, tf_edx = -1014488704, tf_ecx = 4, tf_eax = 4, tf_trapno = 12, tf_err = 0, tf_eip = -1068151861, tf_cs = 32, tf_eflags = 65543, tf_esp = -1014488704, tf_ss = -559355252}) at /usr/src/sys/i386/i386/trap.c:270
 > > #5  0xc06d27ca in calltrap () at /usr/src/sys/i386/i386/exception.s:139
 > > #6  0xc0554bcb in turnstile_setowner (ts=0xc378d240, owner=0x4)
 > >     at /usr/src/sys/kern/subr_turnstile.c:432
 > > #7  0xc0554ef7 in turnstile_wait (lock=0xc38c6504, owner=0x4)
 > >     at /usr/src/sys/kern/subr_turnstile.c:591
 > > #8  0xc0524ddb in _mtx_lock_sleep (m=0xc38c6504, tid=3280478592, opts=0, file=0x0, line=0)
 > >     at /usr/src/sys/kern/kern_mutex.c:579
 > > #9  0xc05bcb44 in rtrequest1 (req=2, info=0xdea8eb24, ret_nrt=0xdea8eb10)
 > >     at /usr/src/sys/net/route.c:703
 > > #10 0xc05be7e5 in route_output (m=0xc55fa800, so=0xc3553164) at /usr/src/sys/net/rtsock.c:391
 > > #11 0xc05bbb12 in raw_usend (so=0x4, flags=0, m=0xc3882180, nam=0x0, control=0x4, 
 > >     td=0xc3882180) at /usr/src/sys/net/raw_usrreq.c:263
 > > #12 0xc05be457 in rts_send (so=0x4, flags=4, m=0x4, nam=0x4, control=0x4, td=0x4)
 > >     at /usr/src/sys/net/rtsock.c:269
 > > #13 0xc057136c in sosend (so=0xc3553164, addr=0x0, uio=0xdea8ecb0, top=0xc55fa800, 
 > >     control=0x0, flags=0, td=0xc3882180) at /usr/src/sys/kern/uipc_socket.c:836
 > > #14 0xc055d2b8 in soo_write (fp=0x4, uio=0xdea8ecb0, active_cred=0xc33d2c00, flags=0, 
 > >     td=0xc3882180) at /usr/src/sys/kern/sys_socket.c:118
 > > #15 0xc05569e0 in dofilewrite (td=0xc3882180, fd=4, fp=0xc37b0c18, auio=0xdea8ecb0, offset=Unhandled dwarf expression opcode 0x93
 > > )
 > >     at file.h:252
 > > #16 0xc0556817 in kern_writev (td=0xc3882180, fd=6, auio=0x4)
 > >     at /usr/src/sys/kern/sys_generic.c:402
 > > ---Type <return> to continue, or q <return> to quit---
 > > #17 0xc05566e9 in write (td=0x4, uap=0x4) at /usr/src/sys/kern/sys_generic.c:326
 > > #18 0xc06e60e3 in syscall (frame=
 > >       {tf_fs = 672006203, tf_es = 672006203, tf_ds = -1078001605, tf_edi = -1077941792, tf_esi = -1077942328, tf_ebp = -1077941864, tf_isp = -559354524, tf_ebx = 20, tf_edx = -1077942496, tf_ecx = 0, tf_eax = 4, tf_trapno = 0, tf_err = 2, tf_eip = 673045383, tf_cs = 51, tf_eflags = 514, tf_esp = -1077942516, tf_ss = 59}) at /usr/src/sys/i386/i386/trap.c:983
 > > #19 0xc06d281f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
 > > #20 0x00000033 in ?? ()
 > > Previous frame inner to this frame (corrupt stack?)
 > > (kgdb) 
 > > 
 > > Thanks!
 > > 
 > > - Mark
 > > 
 > > -- 
 > > Mark Kamichoff
 > > prox at prolixium.com
 > > http://prolixium.com/
 > > Rensselaer Polytechnic Institute, Class of 2004
 > 
 > 
 > -- 
 > Mark Kamichoff
 > prox at prolixium.com
 > http://prolixium.com/
 > Rensselaer Polytechnic Institute, Class of 2004

 -- 
 Mark Kamichoff
 prox at prolixium.com
 http://prolixium.com/
 Rensselaer Polytechnic Institute, Class of 2004