misc/168247: FreeBSD 7.2 kernel panic after update MPD from 5.5 to 5.6 version

Wed May 23 03:50:02 UTC 2012

>Number:         168247
>Category:       misc
>Synopsis:       FreeBSD 7.2 kernel panic after update MPD from 5.5 to 5.6 version
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 23 03:50:01 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator:     Egor
>Release:        7.2-RELEASE
>Organization:
>Environment:
FreeBSD vpn2 7.2-RELEASE FreeBSD 7.2-RELEASE #0: Tue Jun 16 15:58:09 IRKST 2009     majestic@:/usr/obj/usr/src/sys/GATE_062009  i386
>Description:
After updating MPD from version 5.5 to version 5.6 from ports server start to reboot after a panic periodically about once a week. 

# kgdb /boot/kernel/kernel /var/crash/vmcore.1
GNU gdb 6.1.1 [FreeBSD]
..

Unread portion of the kernel message buffer:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x819eaa90
fault code		= supervisor write, page not present
instruction pointer	= 0x20:0xc4cd1eb6
stack pointer	        = 0x28:0xc3f92670
frame pointer	        = 0x28:0xc3f926c0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 26 (em1 taskq)
trap number		= 12
panic: page fault
cpuid = 0
Uptime: 5d23h57m43s
Physical memory: 1002 MB
Dumping 173 MB: 158 142 126 110 94 78 62 46 30 14

Reading symbols from /boot/kernel/ng_car.ko...Reading symbols from /boot/kernel/ng_car.ko.symbols...done.
done.
...skipped.....
(kgdb) where
#0  doadump () at pcpu.h:196
#1  0xc07e7c17 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2  0xc07e7ee9 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:574
#3  0xc0afe0ac in trap_fatal (frame=0xc3f92630, eva=2174659216)
    at /usr/src/sys/i386/i386/trap.c:939
#4  0xc0afe330 in trap_pfault (frame=0xc3f92630, usermode=0, eva=2174659216)
    at /usr/src/sys/i386/i386/trap.c:852
#5  0xc0afecdc in trap (frame=0xc3f92630) at /usr/src/sys/i386/i386/trap.c:530
#6  0xc0ae33eb in calltrap () at /usr/src/sys/i386/i386/exception.s:159
#7  0xc4cd1eb6 in bpf_filter (pc=0xc5165f04, p=0xc46aa018 "F", wirelen=40, 
    buflen=40)
    at /usr/src/sys/modules/netgraph/bpf/../../../net/bpf_filter.c:371
#8  0xc4cd13a0 in ng_bpf_rcvdata (hook=0xc53e5100, item=0xc488cae0)
    at /usr/src/sys/modules/netgraph/bpf/../../../netgraph/ng_bpf.c:473
#9  0xc08bf4cf in ng_apply_item (node=0xc5027500, item=0xc488cae0, rw=0)
    at /usr/src/sys/netgraph/ng_base.c:2336
#10 0xc08be632 in ng_snd_item (item=0xc488cae0, flags=Variable "flags" is not available.
)
    at /usr/src/sys/netgraph/ng_base.c:2254
#11 0xc08bf4cf in ng_apply_item (node=0xc4dc3d00, item=0xc488cae0, rw=0)
    at /usr/src/sys/netgraph/ng_base.c:2336
#12 0xc08be632 in ng_snd_item (item=0xc488cae0, flags=Variable "flags" is not available.
)
---Type <return> to continue, or q <return> to quit---
    at /usr/src/sys/netgraph/ng_base.c:2254
#13 0xc4cc5ca0 in ng_ppp_proto_recv (node=0xc5107e00, item=0xc488cae0, proto=Variable "proto" is not available.
)
    at /usr/src/sys/modules/netgraph/ppp/../../../netgraph/ng_ppp.c:934
#14 0xc4cc6995 in ng_ppp_rcvdata (hook=0xc5306100, item=0xc488cae0)
    at /usr/src/sys/modules/netgraph/ppp/../../../netgraph/ng_ppp.c:1509
#15 0xc08bf4cf in ng_apply_item (node=0xc5107e00, item=0xc488cae0, rw=0)
    at /usr/src/sys/netgraph/ng_base.c:2336
#16 0xc08be632 in ng_snd_item (item=0xc488cae0, flags=Variable "flags" is not available.
)
    at /usr/src/sys/netgraph/ng_base.c:2254
#17 0xc08bf4cf in ng_apply_item (node=0xc5026b80, item=0xc488cae0, rw=0)
    at /usr/src/sys/netgraph/ng_base.c:2336
#18 0xc08be632 in ng_snd_item (item=0xc488cae0, flags=Variable "flags" is not available.
)
    at /usr/src/sys/netgraph/ng_base.c:2254
#19 0xc08c5d81 in ng_pppoe_rcvdata_ether (hook=0xc4a1f080, item=0xc488cae0)
    at /usr/src/sys/netgraph/ng_pppoe.c:1656
#20 0xc08bf4cf in ng_apply_item (node=0xc49f2e00, item=0xc488cae0, rw=0)
    at /usr/src/sys/netgraph/ng_base.c:2336
#21 0xc08be632 in ng_snd_item (item=0xc488cae0, flags=Variable "flags" is not available.
)
    at /usr/src/sys/netgraph/ng_base.c:2254
#22 0xc088630f in ether_demux (ifp=0xc443b800, m=0xc48cea00)
    at /usr/src/sys/net/if_ethersubr.c:851
---Type <return> to continue, or q <return> to quit---
#23 0xc0886663 in ether_input (ifp=0xc443b800, m=0xc48cea00)
    at /usr/src/sys/net/if_ethersubr.c:692
#24 0xc08861b7 in ether_demux (ifp=0xc4205c00, m=0xc48cea00)
    at /usr/src/sys/net/if_ethersubr.c:743
#25 0xc0886663 in ether_input (ifp=0xc4205c00, m=0xc48cea00)
    at /usr/src/sys/net/if_ethersubr.c:692
#26 0xc05b971a in em_rxeof (adapter=0xc4208000, count=999)
    at /usr/src/sys/dev/e1000/if_em.c:4539
#27 0xc05ba247 in em_handle_rxtx (context=0xc4208000, pending=1)
    at /usr/src/sys/dev/e1000/if_em.c:1702
#28 0xc081cea5 in taskqueue_run (queue=0xc419b180)
    at /usr/src/sys/kern/subr_taskqueue.c:282
#29 0xc081d0b8 in taskqueue_thread_loop (arg=0xc420c35c)
    at /usr/src/sys/kern/subr_taskqueue.c:401
#30 0xc07c1609 in fork_exit (callout=0xc081cff0 <taskqueue_thread_loop>, 
    arg=0xc420c35c, frame=0xc3f92d38) at /usr/src/sys/kern/kern_fork.c:810
#31 0xc0ae3460 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:264
(kgdb) list *0xc4cd1eb6
0xc4cd1eb6 is in bpf_filter (/usr/src/sys/modules/netgraph/bpf/../../../net/bpf_filter.c:371).
366			case BPF_LDX|BPF_MEM:
367				X = mem[pc->k];
368				continue;
369	
370			case BPF_ST:
371				mem[pc->k] = A;
372				continue;
373	
374			case BPF_STX:
375				mem[pc->k] = X;

# diff GENERIC GATE_062009 
324a325,338
> options         IPFIREWALL
> options         IPDIVERT
> options         IPFIREWALL_FORWARD
> options         NETGRAPH
> options         NETGRAPH_IPFW
> options         NETGRAPH_PPPOE
> options         NETGRAPH_IFACE
> options         DEVICE_POLLING
> options         HZ=1000

# cat /etc/sysctl.conf 
net.inet.icmp.icmplim=800
net.inet.flowtable.enable=0
net.isr.direct=1
kern.random.sys.harvest.ethernet=0
kern.random.sys.harvest.point_to_point=0
kern.random.sys.harvest.interrupt=0
net.inet.ip.fastforwarding=1
vm.pmap.shpgperproc=2048
net.isr.maxthreads 2
net.isr.bindthreads 1

>How-To-Repeat:
It happens once in a week or 2 weeks and I can not understand what does it depend.
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: