i386/118258: sysctl causing panics on 7.0-xxxx

[Jeff Palmer]

>Number:         118258
>Category:       i386
>Synopsis:       sysctl causing panics on 7.0-xxxx
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-i386
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Nov 26 08:40:02 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator:     Jeff Palmer
>Release:        7.0-BETA3
>Organization:
>Environment:
FreeBSD Laptop.totaldiver.net 7.0-BETA3 FreeBSD 7.0-BETA3 #0: Fri Nov 23 21:33:53 EST 2007     root at Laptop.totaldiver.net:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
I've been having kernel panics intermittantly since 7.0-CURRENT,  all through the PRERELEASE and each of the 3 BETA's,  however, until now I was never able to get a savecore.

They always seem to be from "sysctl -a | grep whatever" but the panic is not 100%. In fact,  I can do the above command many times before it panics.

It seems to happen more frequently when I have the coretemp module loaded,  though it doesn't seem to be required.

%kldstat
Id Refs Address    Size     Name
 1   25 0xc0400000 8ccc54   kernel
 2    1 0xc0ccd000 3324     splash_bmp.ko
 3    1 0xc0cd1000 5464     vesa.ko
 4    1 0xc0ce7000 14fe4    snd_hda.ko
 5    2 0xc0cfc000 4a5cc    sound.ko
 6    1 0xc0d47000 342c     umodem.ko
 7    2 0xc0d4b000 3518     ucom.ko
 8    1 0xc0d4f000 295c     coretemp.ko
 9    1 0xc0d52000 ef50     if_wpi.ko
10    1 0xc0d61000 69184    acpi.ko
11    1 0xc4890000 2000     blank_saver.ko
12    1 0xc4924000 6000     i915.ko
13    1 0xc492a000 f000     drm.ko


Laptop# kgdb kernel.debug /var/crash/vmcore.0
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Unde
fined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0xc0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc06e6a11
stack pointer           = 0x28:0xe43e1aa4
frame pointer           = 0x28:0xe43e1aa4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 68795 (sysctl)
trap number             = 12
panic: page fault
cpuid = 1
Uptime: 9h22m21s
Physical memory: 1001 MB
Dumping 176 MB: 161 145 129 113 97 81 65 49 33 17 1

#0  doadump () at pcpu.h:195
195             __asm __volatile("movl %%fs:0,%0" : "=r" (td));

(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc0750c17 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc0750ed9 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc0a1542c in trap_fatal (frame=0xe43e1a64, eva=192)
    at /usr/src/sys/i386/i386/trap.c:872
#4  0xc0a156b0 in trap_pfault (frame=0xe43e1a64, usermode=0, eva=192)
    at /usr/src/sys/i386/i386/trap.c:785
#5  0xc0a16025 in trap (frame=0xe43e1a64) at /usr/src/sys/i386/i386/trap.c:463
#6  0xc09fc04b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc06e6a11 in dev2udev (x=0xc5abdb00)
    at /usr/src/sys/fs/devfs/devfs_vnops.c:1322
#8  0xc0790e22 in sysctl_kern_ttys (oidp=0xc0b4b7e0, arg1=0x0, arg2=0,
    req=0xe43e1ba4) at /usr/src/sys/kern/tty.c:3078
#9  0xc075a457 in sysctl_root (oidp=Variable "oidp" is not available.
) at /usr/src/sys/kern/kern_sysctl.c:1306
#10 0xc075a5a4 in userland_sysctl (td=0xc4d5f210, name=0xe43e1c14, namelen=2,
    old=0x0, oldlenp=0xbfbfdcc4, inkernel=0, new=0x0, newlen=0,
    retval=0xe43e1c10, flags=0) at /usr/src/sys/kern/kern_sysctl.c:1401
#11 0xc075b33e in __sysctl (td=0xc4d5f210, uap=0xe43e1cfc)
    at /usr/src/sys/kern/kern_sysctl.c:1336
#12 0xc0a15a05 in syscall (frame=0xe43e1d38)
    at /usr/src/sys/i386/i386/trap.c:1008
#13 0xc09fc0b0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196
#14 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) list
196             call    syscall
197             add     $4, %esp
198             MEXITCOUNT
199             jmp     doreti
200
201     ENTRY(fork_trampoline)
202             pushl   %esp                    /* trapframe pointer */
203             pushl   %ebx                    /* arg1 */
204             pushl   %esi                    /* function */
205             call    fork_exit



Please let me know if I can provide more information, or if it'd be of help for me to host the kernel.debug and the vmcore.0 somewhere for review.

Jeff Palmer

>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: