kern/94433: [panic] panic: sbdrop

[Eric van Gyzen]

Here is a backtrace from another panic with INVARIANTS, 
INVARIANT_SUPPORT, and SOCKBUF_DEBUG in the kernel.

Please feel free to ask for more information.

=============================================================

$ kgdb kernel.debug /var/crash/vmcore.3
GNU gdb 6.1.1 [FreeBSD]
[...]

Unread portion of the kernel message buffer:
[not ascii]

#0  doadump () at pcpu.h:165
165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt f
#0  doadump () at pcpu.h:165
No locals.
#1  0xc04f53f0 in boot (howto=260)
     at /freebsd/src/sys/kern/kern_shutdown.c:399
         first_buf_printf = 1
#2  0xc04f569b in panic (fmt=0xc0677f20 "%s")
     at /freebsd/src/sys/kern/kern_shutdown.c:555
         td = (struct thread *) 0xc110ea80
         bootopt = 260
         newpanic = 1
         ap = 0xcbdf9b40 ""
         buf = "page fault", '\0' <repeats 245 times>
#3  0xc064af42 in trap_fatal (frame=0xcbdf9bc4, eva=3735929054)
     at /freebsd/src/sys/i386/i386/trap.c:831
         code = 40
         type = 12
         ss = 40
         esp = 0
         softseg = {ssd_base = 0, ssd_limit = 1048575, ssd_type = 27,
                    ssd_dpl = 0, ssd_p = 1, ssd_xx = 0, ssd_xx1 = 0,
                    ssd_def32 = 1, ssd_gran = 1}
#4  0xc064ac77 in trap_pfault (frame=0xcbdf9bc4, usermode=0,
                                eva=3735929054)
     at /freebsd/src/sys/i386/i386/trap.c:742
         va = 3735928832
         vm = (struct vmspace *) 0x0
         map = 0xc0c43000
         rv = 1
         ftype = 1 '\001'
         td = (struct thread *) 0xc110ea80
         p = (struct proc *) 0xc11a1624
#5  0xc064a8e1 in trap (frame=
       {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -1060839808,
        tf_esi = -1050224640, tf_ebp = -874537972, tf_isp = -874538000,
        tf_ebx = -559038242, tf_edx = -1050224640, tf_ecx = 4,
        tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1068325284,
        tf_cs = 32, tf_eflags = 590470, tf_esp = -1050224640,
        tf_ss = -1054635368})
     at /freebsd/src/sys/i386/i386/trap.c:432
         td = (struct thread *) 0xc110ea80
         p = (struct proc *) 0xc11a1624
         sticks = 2
         i = 0
         ucode = 0
         type = 12
         code = 0
         eva = 3735929054
#6  0xc063abea in calltrap ()
     at /freebsd/src/sys/i386/i386/exception.s:139
No locals.
#7  0xc052a65c in m_tag_delete_chain (m=0xc166d800, t=0x0)
     at /freebsd/src/sys/kern/uipc_mbuf2.c:354
         p = (struct m_tag *) 0xdeadc0de
         q = (struct m_tag *) 0x0
#8  0xc04eca55 in mb_dtor_mbuf (mem=0xc166d800, size=256, arg=0x0)
     at /freebsd/src/sys/kern/kern_mbuf.c:244
No locals.
#9  0xc05e978c in uma_zfree_arg (zone=0xc0c4de80, item=0xc166d800,
                                  udata=0x0)
     at /freebsd/src/sys/vm/uma_core.c:2279
         keg = 0xc0c293c0
         cache = 0xc1238a98
         bucket = 0xdeadc0de
         bflags = 0
         cpu = 0
#10 0xc0528762 in m_freem (mb=0xc166d800) at uma.h:303
No locals.
#11 0xc046a3a0 in ath_tx_processq (sc=0xc122f000, txq=0xc1230170)
     at /freebsd/src/sys/dev/ath/if_ath.c:3692
         ah = (struct ath_hal *) 0xc1231000
         ic = (struct ieee80211com *) 0xc122f1ac
         bf = (struct ath_buf *) 0xc1238a98
         ds = (struct ath_desc *) 0xcea98190
         ds0 = (struct ath_desc *) 0xcea98190
         ni = (struct ieee80211_node *) 0xc173c000
         an = (struct ath_node *) 0xc173c000
         sr = 0
         lr = -1050224640
         pri = 0
         status = 3245588480
         __func__ = "ath_tx_processq"
#12 0xc046a48c in ath_tx_proc_q0123 (arg=0xc122f000, npending=1)
     at /freebsd/src/sys/dev/ath/if_ath.c:3737
         ifp = (struct ifnet *) 0xc122b400
#13 0xc0513262 in taskqueue_run (queue=0xc11a6380)
     at /freebsd/src/sys/kern/subr_taskqueue.c:217
         task = (struct task *) 0xc123040c
         owned = 0
         pending = 1
#14 0xc051334a in taskqueue_swi_run (dummy=0x0)
     at /freebsd/src/sys/kern/subr_taskqueue.c:252
No locals.
#15 0xc04e30b0 in ithread_loop (arg=0xc11a6300)
     at /freebsd/src/sys/kern/kern_intr.c:547
         ithd = (struct ithd *) 0xc11a6300
         ih = (struct intrhand *) 0xc119ee00
         td = (struct thread *) 0xc110ea80
         p = (struct proc *) 0xc11a1624
         count = 0
         warned = 0
         __func__ = "ithread_loop"
#16 0xc04e2520 in fork_exit (callout=0xc04e2f6c <ithread_loop>,
                              arg=0xc11a6300, frame=0xcbdf9d38)
     at /freebsd/src/sys/kern/kern_fork.c:789
         p = (struct proc *) 0xc11a1624
         td = (struct thread *) 0xc166d800
#17 0xc063ac4c in fork_trampoline ()
     at /freebsd/src/sys/i386/i386/exception.s:208
No locals.