crash during shutdown -after- disks unmounted

[Mike Harding]

I had a panic during shutdown, in the if_re.c interrupt handler,
likely because I had

ifconfig_re0="inet 192.168.0.2 netmask 255.255.255.0 -rxcsum -txcsum"

in /etc/rc.conf.

Please feel free to contact me for details.  This is a very recent -stable.

(kgdb) bsd# uname -a
FreeBSD bsd.mvh 6.2-STABLE FreeBSD 6.2-STABLE #0: Tue Sep 18 14:45:37 PDT 2007     root at bsd.mvh:/usr/obj/usr/src/sys/M62  i386

bsd# cd /usr/obj/usr/src/sys/M62
bsd# kgdb kernel.debug /usr/crash/vmcore.2
kdbd: Command not found.
bsd# kgdb kernel.debug /usr/crash/vmcore.2
kgdb: kvm_nlist(_stopped_cpus): 
kgdb: kvm_nlist(_stoppcbs): 
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
<118>.
<118>Terminated
<118>.
<118>Sep 18 20:46:50 bsd syslogd: exiting on signal 15
Waiting (max 60 seconds) for system process `vnlru' to stop...done
Waiting (max 60 seconds) for system process `bufdaemon' to stop...done
Waiting (max 60 seconds) for system process `syncer' to stop...
Syncing disks, vnodes remaining...5 4 3 0 0 0 done
All buffers synced.
Uptime: 5h42m34s


Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0xc
fault code		= supervisor write, page not present
instruction pointer	= 0x20:0xc05d8f4d
stack pointer	        = 0x28:0xe571cc64
frame pointer	        = 0x28:0xe571cc84
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 19 (swi5: +)
trap number		= 12
panic: page fault
Uptime: 5h42m34s
Dumping 1022 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 1022MB (261600 pages) 1006 990 974 958 942 926 910 894 878 862 846 830 814 798 782 766 750 734 718 702 686 670 654 638 622 606 590 574 558 542 526 510 494 478 462 446 430 414 398 382 366 350 334 318 302 286 270 254 238 222 206 190 174 158 142 126 110 94 78 62 46 30 14

#0  doadump () at pcpu.h:165
165		__asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) list *0xc05d8f4d
0xc05d8f4d is in re_rxeof (/usr/src/sys/dev/re/if_re.c:1723).
1718				}
1719				m = sc->rl_head;
1720				sc->rl_head = sc->rl_tail = NULL;
1721				m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
1722			} else
1723				m->m_pkthdr.len = m->m_len =
1724				    (total_len - ETHER_CRC_LEN);
1725	
1726	#ifdef RE_FIXUP_RX
1727			re_fixup_rx(m);
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc068f2c2 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc068f558 in panic (fmt=0xc0904c14 "%s")
    at /usr/src/sys/kern/kern_shutdown.c:565
#3  0xc08a68fc in trap_fatal (frame=0xe571cc24, eva=12)
    at /usr/src/sys/i386/i386/trap.c:838
#4  0xc08a6663 in trap_pfault (frame=0xe571cc24, usermode=0, eva=12)
    at /usr/src/sys/i386/i386/trap.c:745
#5  0xc08a6299 in trap (frame=
      {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -985962496, tf_esi = 38, tf_ebp = -445526908, tf_isp = -445526960, tf_ebx = 0, tf_edx = -985337856, tf_ecx = 536872960, tf_eax = 66, tf_trapno = 12, tf_err = 2, tf_eip = -1067610291, tf_cs = 32, tf_eflags = 590342, tf_esp = 15, tf_ss = 31743})
    at /usr/src/sys/i386/i386/trap.c:435
#6  0xc089377a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc05d8f4d in re_rxeof (sc=0xc53b6800) at /usr/src/sys/dev/re/if_re.c:1723
#8  0xc05d9416 in re_int_task (arg=0xc53b6800, npending=1)
    at /usr/src/sys/dev/re/if_re.c:1984
#9  0xc06aee43 in taskqueue_run (queue=0xc53bf100)
    at /usr/src/sys/kern/subr_taskqueue.c:257
#10 0xc06af43a in taskqueue_fast_run (dummy=0x0)
    at /usr/src/sys/kern/subr_taskqueue.c:435
#11 0xc0679685 in ithread_execute_handlers (p=0xc53ca860, ie=0xc53bf080)
---Type <return> to continue, or q <return> to quit---
    at /usr/src/sys/kern/kern_intr.c:682
#12 0xc067979c in ithread_loop (arg=0xc539e170)
    at /usr/src/sys/kern/kern_intr.c:765
#13 0xc067860c in fork_exit (callout=0xc0679748 <ithread_loop>, 
    arg=0xc539e170, frame=0xe571cd38) at /usr/src/sys/kern/kern_fork.c:830
#14 0xc08937dc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
(kgdb)