kern/121382: 6.3-RELEASE-p1 page fault in dummynet (corrupt stack?) after ~5d uptime

[andrew bliznak]

>Number:         121382
>Category:       kern
>Synopsis:       6.3-RELEASE-p1 page fault in dummynet (corrupt stack?) after ~5d uptime
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Mar 05 09:40:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     andrew bliznak
>Release:        6.3-RELEASE-p1
>Organization:
>Environment:
FreeBSD gw1.xxxxx.net 6.3-RELEASE-p1 FreeBSD 6.3-RELEASE-p1 #4: Wed Feb 27 10:48:27 EET 2008     andrew at gw1.xxxxx.net:/usr/obj/usr/src/sys/GW1  i386
>Description:
gw1# cat /usr/src/sys/i386/conf/GW1
include GENERIC

gw1#

${fwcmd} pipe 1 config bw 18Mbits/s queue 45Kbytes
${fwcmd} pipe 2 config bw 18Mbits/s queue 45Kbytes

~10 queues attached to this pipes

${fwcmd} queue 5 config pipe 1 mask src-ip 0xffffffff \
        weight 30
${fwcmd} queue 6 config pipe 2 mask dst-ip 0xffffffff \
        weight 30

several smaller pipes (64kbits - 4 Mbits)

${fwcmd} pipe 17 config bw 1088Kbits/s queue 18Kbytes mask src-ip 0xffffffff \
        gred 0.002/4500/13500/0.1
${fwcmd} pipe 18 config bw 1088Kbits/s queue 18Kbytes mask dst-ip 0xffffffff \
        gred 0.002/4500/13500/0.1

net.inet.ip.fw.one_pass=0

gw1# kgdb /boot/kernel/kernel.debug vmcore.15
kgdb: kvm_nlist(_stopped_cpus): 
kgdb: kvm_nlist(_stoppcbs): 
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x18
fault code		= supervisor write, page not present
instruction pointer	= 0x20:0xc0c27ab1
stack pointer	        = 0x28:0xd0411c3c
frame pointer	        = 0x28:0xd0411c94
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 34 (dummynet)
trap number		= 12
panic: page fault
Uptime: 5d4h9m8s
Dumping 383 MB (2 chunks)
  chunk 0: 1MB (160 pages) ... ok
  chunk 1: 383MB (97911 pages) 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:165
165	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc06a4b76 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc06a4e0c in panic (fmt=0xc096bb43 "%s")
    at /usr/src/sys/kern/kern_shutdown.c:565
#3  0xc090d1b4 in trap_fatal (frame=0xd0411bfc, eva=24)
    at /usr/src/sys/i386/i386/trap.c:838
#4  0xc090cf1b in trap_pfault (frame=0xd0411bfc, usermode=0, eva=24)
    at /usr/src/sys/i386/i386/trap.c:745
#5  0xc090cb59 in trap (frame=
      {tf_fs = 8, tf_es = -801046488, tf_ds = 40, tf_edi = 1, tf_esi = 0, tf_ebp = -801039212, tf_isp = -801039320, tf_ebx = 34, tf_edx = -1022897152, tf_ecx = -1022897128, tf_eax = 16, tf_trapno = 12, tf_err = 2, tf_eip = -1060996431, tf_cs = 32, tf_eflags = 66050, tf_esp = 223032704, tf_ss = 1})
    at /usr/src/sys/i386/i386/trap.c:435
#6  0xc08f9fea in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc0c27ab1 in ?? ()
Previous frame inner to this frame (corrupt stack?)


>How-To-Repeat:
Repitable every five days....
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: