kern/121274: [panic] Panic in ether_input() with different NIC's.

[Sean C. Farley]

The following reply was made to PR kern/121274; it has been noted by GNATS.

From: "Sean C. Farley" <scf at FreeBSD.org>
To: bug-followup at FreeBSD.org
Cc:  
Subject: Re: kern/121274: [panic] Panic in ether_input() with different
 NIC's.
Date: Tue, 4 Mar 2008 13:15:49 -0600 (CST)

 Two additional items of interest, but I do not know for certain if this
 is related to the panic I am seeing:
 1. I have recently found that running "ipnat -s" will cause a panic
     regardless of how long the system has been running.
 2. Here is the LOR along with a backtrace from running "ipnat -s".  More
     information can be found here:
     http://www.farley.org/freebsd/tmp/panic/dmesg.boot
 
 
 IP Filter: v4.1.28 initialized.  Default = pass all, Logging = enabled
 Kernel page fault with the following non-sleepable locks held:
 shared rw ipf filter load/unload mutex r = 0 (0xc52088a0) locked @ /usr/FreeBSD/RELENG_7/src/sys/modules/ipfilter/../../contrib/ipfilter/netinet/ip_fil_freebsd.c:350
 KDB: enter: witness_warn
 
 
 Fatal trap 12: page fault while in kernel mode
 cpuid = 0; apic id = 00
 fault virtual address	= 0x28202000
 fault code		= supervisor write, page not present
 instruction pointer	= 0x20:0xc0777556
 stack pointer	        = 0x28:0xdf59cde4
 frame pointer	        = 0x28:0xdf59dbb4
 code segment		= base 0x0, limit 0xfffff, type 0x1b
  			= DPL 0, pres 1, def32 1, gran 1
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process		= 62 (ipnat)
 lock order reversal: (sleepable after non-sleepable)
   1st 0xc52088a0 ipf filter load/unload mutex (ipf filter load/unload mutex) @ /usr/FreeBSD/RELENG_7/src/sys/modules/ipfilter/../../contrib/ipfilter/netinet/ip_fil_freebsd.c:350
   2nd 0xc4f0b12c user map (user map) @ /usr/FreeBSD/RELENG_7/src/sys/vm/vm_map.c:3111
 KDB: stack backtrace:
 db_trace_self_wrapper(c07ba661,df59cb00,c059895e,c07bcc04,c4f0b12c,...) at db_trace_self_wrapper+0x26
 kdb_backtrace(c07bcc04,c4f0b12c,c07d5a0c,c07d5a0c,c07d5990,...) at kdb_backtrace+0x29
 witness_checkorder(c4f0b12c,9,c07d5990,c27,c0461b23,...) at witness_checkorder+0x6de
 _sx_xlock(c4f0b12c,0,c07d5990,c27,df59cb68,...) at _sx_xlock+0x7d
 _vm_map_lock_read(c4f0b0e8,c07d5990,c27,0,0,...) at _vm_map_lock_read+0x50
 vm_map_lookup(df59cc60,28202000,2,df59cc64,df59cc54,...) at vm_map_lookup+0x38
 vm_fault(c4f0b0e8,28202000,2,8,28202000,...) at vm_fault+0x83
 trap_pfault(5,0,c07df7db,0,c,...) at trap_pfault+0xf9
 trap(df59cda4) at trap+0x3f2
 calltrap() at calltrap+0x6
 --- trap 0xc, eip = 0xc0777556, esp = 0xdf59cde4, ebp = 0xdf59dbb4 ---
 generic_copyout(c51a1480,c034725d,1,0,c5020880,...) at generic_copyout+0x36
 iplioctl(c5191a00,c034725d,c51a1480,1,c5020880,...) at iplioctl+0xca
 devfs_ioctl_f(c51b0120,c034725d,c51a1480,c524f000,c5020880,...) at devfs_ioctl_f+0xc9
 kern_ioctl(c5020880,3,c034725d,c51a1480,1000000,...) at kern_ioctl+0x243
 ioctl(c5020880,df59dcfc,c,c07b487b,c07f8bb0,...) at ioctl+0x134
 syscall(df59dd38) at syscall+0x2b3
 Xint0x80_syscall() at Xint0x80_syscall+0x20
 --- syscall (54, FreeBSD ELF32, ioctl), eip = 0x28166363, esp = 0xbfbfeccc, ebp = 0xbfbfed38 ---
 KDB: enter: witness_checkorder
 Kernel page fault with the following non-sleepable locks held:
 shared rw ipf filter load/unload mutex r = 0 (0xc52088a0) locked @ /usr/FreeBSD/RELENG_7/src/sys/modules/ipfilter/../../contrib/ipfilter/netinet/ip_fil_freebsd.c:350
 KDB: enter: witness_warn
 
 
 Fatal trap 12: page fault while in kernel mode
 cpuid = 0; apic id = 00
 fault virtual address	= 0x28203000
 fault code		= supervisor write, page not present
 instruction pointer	= 0x20:0xc0777556
 stack pointer	        = 0x28:0xdf59cde4
 frame pointer	        = 0x28:0xdf59dbb4
 code segment		= base 0x0, limit 0xfffff, type 0x1b
  			= DPL 0, pres 1, def32 1, gran 1
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process		= 62 (ipnat)