panic: page fault in kern_kevent

[Pawel Worach]

Under moderate kqueue load I caught the following:

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0x0
stack pointer           = 0x28:0xe745db78
frame pointer           = 0x28:0xe745dbb8
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 582 (squid)
trap number             = 12
panic: page fault
KDB: stack backtrace:
kdb_backtrace(c065b33b,c06a4780,c065344e,e745da80,100) at kdb_backtrace+0x2e
panic(c065344e,c066df69,c49c0dd0,1,1) at panic+0xb7
trap_fatal(e745db38,0,1,0,c05239e2) at trap_fatal+0x33e
trap_pfault(e745db38,0,0,e745db38,0) at trap_pfault+0x242
trap(c05e0008,c7310028,28,0,4) at trap+0x350
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0, esp = 0xe745db78, ebp = 0xe745dbb8 ---
MAXCPU(c4b20500,e745dbe8,c65c3300,1,c0c38000) at 0
kern_kevent(c65c3300,3,5,80,e745dcbc) at kern_kevent+0xf8
kevent(c65c3300,e745dd04,18,16,c65c3300) at kevent+0x7a
syscall(821003b,3b,822003b,48106cf0,bfbfeec8) at syscall+0x380
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (363, FreeBSD ELF32, kevent), eip = 0x4821ccfb, esp = 
0xbfbfedfc, ebp = 0xbfbfee48 ---
Uptime: 3d15h16m7s
Dumping 1023 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 1023MB (261884 pages) 1008 992 976 960 944 928 912 896 880 
864 848 832 816 800 784 768 752 736 720 704 688 672 656 640 624 608 592 
576 560 544 528 512 496 480 464 448 432 416 400 384 368 352 336 320 304 
288 272 256 240 224 208 192 176 160 144 128 112 96 80 64 48 32 16

(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc04c261c in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc04c299d in panic (fmt=0xc065344e "%s")
     at /usr/src/sys/kern/kern_shutdown.c:565
#3  0xc0637f7e in trap_fatal (frame=0xe745db38, eva=0)
     at /usr/src/sys/i386/i386/trap.c:836
#4  0xc0637c12 in trap_pfault (frame=0xe745db38, usermode=0, eva=0)
     at /usr/src/sys/i386/i386/trap.c:744
#5  0xc0637780 in trap (frame=
       {tf_fs = -1067581432, tf_es = -953090008, tf_ds = 40, tf_edi = 0, 
tf_esi = 4, tf_ebp = -414852168, tf_isp = -414852252, tf_ebx = 4, tf_edx 
= -953052640, tf_ecx = -1066925280, tf_eax = -1066924800, tf_trapno = 
12, tf_err = 0, tf_eip = 0, tf_cs = 32, tf_eflags = 66118, tf_esp = 
-1068903001, tf_ss = -953052640})
     at /usr/src/sys/i386/i386/trap.c:434
#6  0xc062498a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0x00000000 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) l *kern_kevent+0xf8
0xc049c6d8 is in kern_kevent (/usr/src/sys/kern/kern_event.c:637).
632                             goto done;
633                     changes = keva;
634                     for (i = 0; i < n; i++) {
635                             kevp = &changes[i];
636                             kevp->flags &= ~EV_SYSFLAGS;
637                             error = kqueue_register(kq, kevp, td, 1);
638                             if (error) {
639                                     if (nevents != 0) {
640                                             kevp->flags = EV_ERROR;
641                                             kevp->data = error;

System is i386 UP running FreeBSD 6.1-STABLE #0: Sun Jul  9 01:11:16 
CEST 2006

-- 
Pawel