From nobody Sat Mar 14 13:28:53 2026 X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fY2Hx2bz6z6VtJD for ; Sat, 14 Mar 2026 13:29:01 +0000 (UTC) (envelope-from imb@protected-networks.net) Received: from mail.protected-networks.net (mail.protected-networks.net [202.12.127.228]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mail.protected-networks.net", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fY2Hx0CV5z3FPC for ; Sat, 14 Mar 2026 13:29:00 +0000 (UTC) (envelope-from imb@protected-networks.net) Authentication-Results: mx1.freebsd.org; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d= protected-networks.net; h=content-transfer-encoding:content-type :content-type:in-reply-to:from:from:content-language:references :subject:subject:user-agent:mime-version:date:date:message-id; s=201508; t=1773494933; bh=7VUgH19QWEB8dkeng/VZgSs0LwJe34B14yDr NwQ59uU=; b=FZ84sLgWAFeHVTWucM1526IwRae8/83ZJ2hmWcGWzVX+IcusqHHp LVV7Zx93mBSSdo0zJ9yJyUtFXgCikDm/afGUjcpTg/OwqS1FiwSDHPPg2tQMwSym D8htlkQBJohgcKYgIkd5J0gJH7mHaPbu/OwK7qPMkeWJsY5BC7FnU7s= Received: from [192.168.1.9] (d5540.auburn.protected-networks.net [192.168.1.9]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: imb@mail.protected-networks.net) by mail.protected-networks.net (Postfix) with ESMTPSA id D95064896C; Sat, 14 Mar 2026 09:28:53 -0400 (EDT) Message-ID: Date: Sat, 14 Mar 2026 09:28:53 -0400 List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@FreeBSD.org MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: panic: supervisor write data, protection violation (vn_read/copyout_smap_erms?) To: Subbsd , freebsd-current Current References: Content-Language: en-NZ From: Michael Butler In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:5716, ipnet:202.12.127.0/24, country:US] X-Rspamd-Queue-Id: 4fY2Hx0CV5z3FPC X-Spamd-Bar: ---- To narrow this .. I can reliably start a kernel built at or before commit 277830b4d3ae. On 3/14/26 09:06, Subbsd wrote: > Hi, > > The latest FreeBSD 16-CURRENT panics during some disk activities > (e.g.: installing a packages, starting some services, for example > /etc/rc.d/devd) > > -- > Fatal trap 12: page fault while in kernel mode > cpuid = 6; apic id = 06 > fault virtual address = 0x45e4db029e00 > fault code = supervisor write data, protection violation > instruction pointer = 0x20:0xffffffff81127826 > stack pointer = 0x28:0xfffffe00ff03b930 > frame pointer = 0x28:0xfffffe00ff03b930 > code segment = base 0x0, limit 0xfffff, type 0x1b > = DPL 0, pres 1, long 1, def32 0, gran 1 > processor eflags = interrupt enabled, resume, IOPL = 0 > current process = 1042 (sh) > rdi: 000045e4db029e00 rsi: fffff80063fed000 rdx: 0000000000000400 > rcx: 0000000000000400 r8: fffff80063fed000 r9: 000000000000261f > rax: 0000000000000000 rbx: fffff80063fed000 rbp: fffffe00ff03b930 > r10: 0000000000000400 r11: fffff8000fb9ccd0 r12: fffffe00ff03bde8 > r13: 0000000000000400 r14: 0000000000000400 r15: fffffe00ff03bda8 > trap number = 12 > panic: page fault > cpuid = 6 > time = 1773492421 > KDB: stack backtrace: > db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00ff03b640 > vpanic() at vpanic+0x136/frame 0xfffffe00ff03b770 > panic() at panic+0x43/frame 0xfffffe00ff03b7d0 > trap_fatal() at trap_fatal+0x68/frame 0xfffffe00ff03b7f0 > trap_pfault() at trap_pfault+0x2ac/frame 0xfffffe00ff03b860 > calltrap() at calltrap+0x8/frame 0xfffffe00ff03b860 > --- trap 0xc, rip = 0xffffffff81127826, rsp = 0xfffffe00ff03b930, rbp > = 0xfffffe00ff03b930 --- > copyout_smap_erms() at copyout_smap_erms+0x196/frame 0xfffffe00ff03b930 > uiomove_fromphys() at uiomove_fromphys+0x15f/frame 0xfffffe00ff03b990 > vn_read_from_obj() at vn_read_from_obj+0x13f/frame 0xfffffe00ff03ba70 > VOP_READ_PGCACHE_APV() at VOP_READ_PGCACHE_APV+0x2a/frame 0xfffffe00ff03ba90 > vn_read() at vn_read+0x94/frame 0xfffffe00ff03bb10 > vn_io_fault_doio() at vn_io_fault_doio+0x45/frame 0xfffffe00ff03bb70 > vn_io_fault1() at vn_io_fault1+0x15e/frame 0xfffffe00ff03bcb0 > vn_io_fault() at vn_io_fault+0x19d/frame 0xfffffe00ff03bd40 > dofileread() at dofileread+0x80/frame 0xfffffe00ff03bd90 > sys_read() at sys_read+0x127/frame 0xfffffe00ff03be00 > amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe00ff03bf30 > fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00ff03bf30 > --- syscall (3, FreeBSD ELF64, read), rip = 0x3e8c57b7232a, rsp = > 0x3e8c53973298, rbp = 0x3e8c539732e0 --- > KDB: enter: panic > Uptime: 17s > -- > > Other info + messages in dmesg: > > Kernel: GENERIC > > uname -a: > > FreeBSD host1.my.domain 16.0-CURRENT FreeBSD 16.0-CURRENT #0 > main-f91464171d61: Sat Mar 14 12:35:27 UTC 2026 > root@host1.my.domain:/usr/obj/usr/jails/src/src_16/src/amd64.amd64/sys/GENERIC > amd64 > > Filesystem: UFS2 > > dmesg with suspicious entries: > ``` > lock order reversal: (sleepable after non-sleepable) > 1st 0xffffffff81da28a8 dev mtx (devd, sleep mutex) @ > /usr/jails/src/src_16/src/sys/kern/kern_devctl.c:572 > 2nd 0xffffffff82300d50 umareclaim (umareclaim, sx) @ > /usr/jails/src/src_16/src/sys/vm/uma_core.c:3428 > lock order devd -> umareclaim attempted at: > #0 0xffffffff80c43fbf at witness_checkorder+0xcaf > #1 0xffffffff80bd40f0 at _sx_xlock+0x60 > #2 0xffffffff80f9903d at uma_zdestroy+0x3d > #3 0xffffffff80b64fce at sysctl_devctl_queue+0x8e > #4 0xffffffff80bdb3ec at sysctl_root_handler_locked+0x9c > #5 0xffffffff80bda74f at sysctl_root+0x22f > #6 0xffffffff80bdae56 at userland_sysctl+0x1b6 > #7 0xffffffff80bdac65 at sys___sysctl+0x65 > #8 0xffffffff8112b719 at amd64_syscall+0x169 > #9 0xffffffff810fa54b at fast_syscall_common+0xf8 > Freed UMA keg (DEVCTL) was not empty (455 items). Lost 114 pages of memory. > ``` >