kern/97095: page fault on 6.1-RC2 ip_ctloutput

[Nick Wood]

>Number:         97095
>Category:       kern
>Synopsis:       page fault on 6.1-RC2 ip_ctloutput
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 10 17:00:42 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Nick Wood
>Release:        6.1-RC2
>Organization:
ProHosting
>Environment:
FreeBSD mail-da-5.... 6.1-RC2 FreeBSD 6.1-RC2 #0: Fri May  5 07:27:28 MDT 2006     nwood at mail-da-5....:/usr/obj/usr/src/sys/LOCAL  i386
>Description:
Several busy qmail servers are crashing on a regular basis - 1 to 3 times a day.

The running process has usually been tcpserver from the ucspi-tcp-0.88_2 port.  It has been cmd5checkpw (pop authentication) once.

Differences from GENERIC
----------------------
#cpu            I486_CPU
#cpu            I586_CPU
cpu             I686_CPU
ident           MAIL_6_1

# PH Options
options         SUIDDIR
options         QUOTA
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=10
options         NMBCLUSTERS=65536
options         KVA_PAGES="640"
options         VM_KMEM_SIZE_MAX=(512*1048576)
options         VM_KMEM_SIZE_SCALE=2

options         ASR_COMPAT

options         SHMMAXPGS=131072
options         SEMMNI=128
options         SEMMNS=512
options         SEMUME=100
options         SEMMNU=256
----------------------

Backtrace
----------------------
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0x6064e239 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:402
#2  0x6064e4d0 in panic (fmt=0x60894857 "%s") at /usr/src/sys/kern/kern_shutdown.c:558
#3  0x608496d4 in trap_fatal (frame=0x9c8f7ad8, eva=172) at /usr/src/sys/i386/i386/trap.c:836
#4  0x6084943b in trap_pfault (frame=0x9c8f7ad8, usermode=0, eva=172) at /usr/src/sys/i386/i386/trap.c:744
#5  0x60849079 in trap (frame=
      {tf_fs = 1619263496, tf_es = 1627652136, tf_ds = 40, tf_edi = 55, tf_esi = 0, tf_ebp = -1668318412, tf_isp = -1668318460, tf_ebx = -1668318064, tf_edx = 1738397568, tf_ecx = 0, tf_eax = 4, tf_trapno = 12, tf_err = 2, tf_eip = 1617891744, tf_cs = 32, tf_eflags = 66182, tf_esp = 1835631104, tf_ss = 0})
    at /usr/src/sys/i386/i386/trap.c:434
#6  0x6083890a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0x606f11a0 in ip_ctloutput (so=0x4, sopt=0x9c8f7c90) at atomic.h:146
#8  0x6070123b in tcp_ctloutput (so=0x66b34858, sopt=0x9c8f7c90) at /usr/src/sys/netinet/tcp_usrreq.c:1038
#9  0x60687c04 in sosetopt (so=0x66b34858, sopt=0x9c8f7c90) at /usr/src/sys/kern/uipc_socket.c:1560
#10 0x6068ce95 in kern_setsockopt (td=0x679dd780, s=0, level=4, name=4, val=0x679dd780, valseg=UIO_USERSPACE,
    valsize=0) at /usr/src/sys/kern/uipc_syscalls.c:1351
#11 0x6068cdc6 in setsockopt (td=0x679dd780, uap=0x4) at /usr/src/sys/kern/uipc_syscalls.c:1307
#12 0x608499eb in syscall (frame=
      {tf_fs = 1606352955, tf_es = 59, tf_ds = 1606352955, tf_edi = 1606413432, tf_esi = 3, tf_ebp = 1606413224, tf_isp = -1668317852, tf_ebx = 0, tf_edx = 2, tf_ecx = 134545464, tf_eax = 105, tf_trapno = 12, tf_err = 2, tf_eip = 672065711, tf_cs = 51, tf_eflags = 514, tf_esp = 1606413180, tf_ss = 59})
    at /usr/src/sys/i386/i386/trap.c:981
#13 0x6083895f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
#14 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
----------------------
>How-To-Repeat:
Run a busy qmail server on FreeBSD 6.1...
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: