ports/136805: [virtualbox] panic when unloading kernel module

[Alexander Best]

>Number:         136805
>Category:       ports
>Synopsis:       [virtualbox] panic when unloading kernel module
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 15 22:20:01 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Alexander Best
>Release:        8.0-BETA2
>Organization:
>Environment:
FreeBSD otaku 8.0-BETA2 FreeBSD 8.0-BETA2 #4 r195712M: Wed Jul 15 22:31:17 CEST 2009     root at otaku:/usr/obj/usr/src/sys/ARUNDEL  i386
>Description:
when unloading vboxdrv.ko the kernel panics. i'm running virtualbox-2.2.51.r20457_3. here's a bt:

Unread portion of the kernel message buffer:
panic: vm_page_dirty: page is invalid!
cpuid = 1
KDB: stack backtrace:
db_trace_self_wrapper(c07d8831,e8723a48,c05ca649,c07fb1c6,1,...) at db_trace_self_wrapper+0x26
kdb_backtrace(c07fb1c6,1,c07f35ff,e8723a54,1,...) at kdb_backtrace+0x29
panic(c07f35ff,e8723a7c,c076870b,c1d1d370,e6338000,...) at panic+0x119
vm_page_dirty(c1d1d370,e6338000,c07fbb44,99f,e6338000,...) at vm_page_dirty+0x42
pmap_remove_pte(e8723ac0,4,c07fbb44,9bf,c0a214e0,...) at pmap_remove_pte+0xbb
pmap_remove_page(c0a214e0,0,c07fbb44,9df,c0a214e0,...) at pmap_remove_page+0x94
pmap_remove(c0a214e0,e6338000,e6339000,c07f241b,e8723b24,...) at pmap_remove+0xb2
vm_map_delete(c1c90000,e6338000,e6339000,c80e1d90,fffffffc,...) at vm_map_delete+0x18c
vm_map_remove(c1c90000,e6338000,e6339000,c156b9a0,c80e1d90,...) at vm_map_remove+0x55
rtR0MemObjNativeFree(c80e1d90,c1577b20,0,e8723bac,c156dee4,...) at rtR0MemObjNativeFree+0xae
RTR0MemObjFree(c80e1d90,1,0,e8723bd4,c15621e7,...) at RTR0MemObjFree+0xe2
supdrvGipDestroy(c8171a50,c7cbabc0,c7cbabc0,e8723bf4,c155c136,...) at supdrvGipDestroy+0x4c
supdrvDeleteDevExt(c1577b20,c8160620,0,c7cbabc0,c7cbabc0,...) at supdrvDeleteDevExt+0x97
VBoxDrvFreeBSDModuleEvent(c7cbabc0,1,0,109,0,...) at VBoxDrvFreeBSDModuleEvent+0xe6
module_unload(c7cbabc0,c07d21c1,273,270,c05af1d6,...) at module_unload+0x43
linker_file_unload(c7d01b00,0,c07d21c1,437,e8723d38,...) at linker_file_unload+0x15e
kern_kldunload(c8a3dd80,c,0,e8723d2c,c076c426,...) at kern_kldunload+0xc5
kldunloadf(c8a3dd80,e8723cf8,8,c07dc8d2,c,...) at kldunloadf+0x2b
syscall(e8723d38) at syscall+0x2a6
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (444, FreeBSD ELF32, kldunloadf), eip = 0x280d37eb, esp = 0xbfbfe41c, ebp = 0xbfbfec68 ---
Uptime: 4m17s
Physical memory: 2026 MB
Dumping 155 MB:usbd_transfer_poll: USB polling is not supported!

Reading symbols from /boot/kernel/ng_socket.ko...Reading symbols from /boot/kernel/ng_socket.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ng_socket.ko
Reading symbols from /boot/kernel/netgraph.ko...Reading symbols from /boot/kernel/netgraph.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/netgraph.ko
Reading symbols from /boot/kernel/acpi_video.ko...Reading symbols from /boot/kernel/acpi_video.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/acpi_video.ko
Reading symbols from /boot/kernel/acpi.ko...Reading symbols from /boot/kernel/acpi.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/acpi.ko
Reading symbols from /boot/modules/nvidia.ko...done.
Loaded symbols for /boot/modules/nvidia.ko
Reading symbols from /boot/kernel/ng_bluetooth.ko...Reading symbols from /boot/kernel/ng_bluetooth.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ng_bluetooth.ko
Reading symbols from /boot/kernel/ng_btsocket.ko...Reading symbols from /boot/kernel/ng_btsocket.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ng_btsocket.ko
Reading symbols from /boot/kernel/ng_ubt.ko...Reading symbols from /boot/kernel/ng_ubt.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ng_ubt.ko
Reading symbols from /boot/kernel/ng_hci.ko...Reading symbols from /boot/kernel/ng_hci.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ng_hci.ko
Reading symbols from /boot/kernel/ng_l2cap.ko...Reading symbols from /boot/kernel/ng_l2cap.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ng_l2cap.ko
Reading symbols from /boot/modules/vboxdrv.ko...done.
Loaded symbols for /boot/modules/vboxdrv.ko
#0  doadump () at pcpu.h:246
246     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:246
#1  0xc05ca39f in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:419
#2  0xc05ca685 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:575
#3  0xc071bb62 in vm_page_dirty (m=0x0) at /usr/src/sys/vm/vm_page.c:574
#4  0xc076870b in pmap_remove_pte (pmap=0xc0a214e0, ptq=Variable "ptq" is not available.
) at /usr/src/sys/i386/i386/pmap.c:2477
#5  0xc07687e4 in pmap_remove_page (pmap=0xc0a214e0, va=3862134784, free=0xe8723ac0) at /usr/src/sys/i386/i386/pmap.c:2498
#6  0xc0768fc2 in pmap_remove (pmap=0xc0a214e0, sva=3862134784, eva=3862138880) at /usr/src/sys/i386/i386/pmap.c:2536
#7  0xc0711cdc in vm_map_delete (map=0xc1c90000, start=3862134784, end=3862138880) at /usr/src/sys/vm/vm_map.c:2735
#8  0xc0711fc5 in vm_map_remove (map=0xc1c90000, start=3862134784, end=Variable "end" is not available.
) at /usr/src/sys/vm/vm_map.c:2764
#9  0xc157065e in rtR0MemObjNativeFree () from /boot/modules/vboxdrv.ko
#10 0xc156ec62 in RTR0MemObjFree () from /boot/modules/vboxdrv.ko
#11 0xc156212c in supdrvGipDestroy () from /boot/modules/vboxdrv.ko
#12 0xc15621e7 in supdrvDeleteDevExt () from /boot/modules/vboxdrv.ko
#13 0xc155c136 in VBoxDrvFreeBSDModuleEvent () from /boot/modules/vboxdrv.ko
#14 0xc05b9973 in module_unload (mod=0xc7cbabc0) at /usr/src/sys/kern/kern_module.c:266
#15 0xc05afe8e in linker_file_unload (file=0xc7d01b00, flags=0) at /usr/src/sys/kern/kern_linker.c:632
#16 0xc05b09c5 in kern_kldunload (td=0xc8a3dd80, fileid=12, flags=0) at /usr/src/sys/kern/kern_linker.c:1103
#17 0xc05b0a2b in kldunloadf (td=0xc8a3dd80, uap=0xe8723cf8) at /usr/src/sys/kern/kern_linker.c:1133
#18 0xc076c426 in syscall (frame=0xe8723d38) at /usr/src/sys/i386/i386/trap.c:1073
#19 0xc07503f0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:261
#20 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

cheers.
>How-To-Repeat:
kldunload vboxdrv
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: