misc/103191: Unpredictable reboot

[Denis]

>Number:         103191
>Category:       misc
>Synopsis:       Unpredictable reboot
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Sep 12 14:10:21 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Denis
>Release:        6.1-RELEASE
>Organization:
ISP MainStream
>Environment:
FreeBSD main.nikopol.net 6.1-RELEASE FreeBSD 6.1-RELEASE #9: Sun Aug 27 14:01:09 EEST 2006     den at main.nikopol.net:/usr/src/sys/i386/compile/MS  i386
>Description:
Server is using MPD authorization, ipnat address translation; serves proxy, sendmail, popa3d, BIND and MySQL daemons.
Below I paste core debug information. I have two coredumps, but them seems to be the same.
Feel free to ask additional information, I have core dumps.


GNU gdb 6.1.1 [FreeBSD]

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0xc
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0555aa8
stack pointer           = 0x28:0xe252ba24
frame pointer           = 0x28:0xe252ba30
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (swi1: net)
trap number             = 12
panic: page fault
Uptime: 8d1h1m45s
Dumping 895 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 895MB (229120 pages) 880 864 848 832 816 800 784 768 752 736 720 704 688 672 656 640 624 608 592 576 560 544 528 512 496 480 464 448 432 416 400 384 368 352 336 320 304 288 272 25
6 240 224 208 192 176 160 144 128 112 96 80 64 48 32 16

#0  doadump () at pcpu.h:165
165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) list *0xc0555aa8
0xc0555aa8 is in m_copydata (libkern.h:56).
51      static __inline int imax(int a, int b) { return (a > b ? a : b); }
52      static __inline int imin(int a, int b) { return (a < b ? a : b); }
53      static __inline long lmax(long a, long b) { return (a > b ? a : b); }
54      static __inline long lmin(long a, long b) { return (a < b ? a : b); }
55      static __inline u_int max(u_int a, u_int b) { return (a > b ? a : b); }
56      static __inline u_int min(u_int a, u_int b) { return (a < b ? a : b); }
57      static __inline quad_t qmax(quad_t a, quad_t b) { return (a > b ? a : b); }
58      static __inline quad_t qmin(quad_t a, quad_t b) { return (a < b ? a : b); }
59      static __inline u_long ulmax(u_long a, u_long b) { return (a > b ? a : b); }
60      static __inline u_long ulmin(u_long a, u_long b) { return (a < b ? a : b); }
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc05201b9 in boot (howto=260) at ../../../kern/kern_shutdown.c:402
#2  0xc0520450 in panic (fmt=0xc0669cd5 "%s") at ../../../kern/kern_shutdown.c:558
#3  0xc0645944 in trap_fatal (frame=0xe252b9e4, eva=12) at ../../../i386/i386/trap.c:836
#4  0xc06456ab in trap_pfault (frame=0xe252b9e4, usermode=0, eva=12) at ../../../i386/i386/trap.c:744
#5  0xc0645309 in trap (frame=
      {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = 1, tf_esi = 0, tf_ebp = -497894864, tf_isp = -497894896, tf_ebx = -927408448, tf_edx = 0, tf_ecx = -927408480, tf_eax = 120, tf_trapno = 12
, tf_err = 0, tf_eip = -1068148056, tf_cs = 32, tf_eflags = 590338, tf_esp = -927408448, tf_ss = -927408381}) at ../../../i386/i386/trap.c:434
#6  0xc063516a in calltrap () at ../../../i386/i386/exception.s:139
#7  0xc0555aa8 in m_copydata (m=0x0, off=0, len=1,
    cp=0xc8b8df03 "r Timeout (300 seconds): closing control connection.\r\n\r\nm,&#1062;,\204\0021&#9576;\037&#9579;:\027Yo&#9560;J3&#9576;\204\2375&#9569;H\021\n&#1085;&#9572;F&#9557;&#1085;\220\200,&#9558;\a?&#9578;\016\002&#1082;\r\026\034aw&#9578;&#9564;>\004\237\\&#1042;&#1069;I\021\224
") at ../../../kern/uipc_mbuf.c:543
#8  0xc044fe7e in ippr_ftp_process (fin=0xe252bb6c, nat=0xc6e11400, ftp=0xc8b8de00, rv=1) at ip_ftp_pxy.c:1190
#9  0xc04501c2 in ippr_ftp_in (fin=0xe252bb6c, aps=0x78, nat=0xc6e11400) at ip_ftp_pxy.c:1356
#10 0xc0454945 in appr_check (fin=0xe252bb6c, nat=0xc6e11400) at ../../../contrib/ipfilter/netinet/ip_proxy.c:544
#11 0xc044d6e1 in fr_natin (fin=0xe252bb6c, nat=0xc6e11400, natadd=1, nflags=1) at ../../../contrib/ipfilter/netinet/ip_nat.c:4087
#12 0xc044d5b6 in fr_checknatin (fin=0xe252bb6c, passp=0xe252bb68) at ../../../contrib/ipfilter/netinet/ip_nat.c:4022
#13 0xc0441d59 in fr_check (ip=0x0, hlen=20, ifp=0x78, out=0, mp=0xe252bc54) at ../../../contrib/ipfilter/netinet/fil.c:2346
#14 0xc0445fd2 in fr_check_wrapper (arg=0x0, mp=0x0, ifp=0xc4883c00, dir=1) at ../../../contrib/ipfilter/netinet/ip_fil_freebsd.c:156
#15 0xc05974b3 in pfil_run_hooks (ph=0xc06e8b40, mp=0xe252bca8, ifp=0xc4883c00, dir=1, inp=0x0) at ../../../net/pfil.c:139
#16 0xc05b0fc7 in ip_input (m=0xc6050000) at ../../../netinet/ip_input.c:465
#17 0xc059605b in netisr_processqueue (ni=0xc06e7d38) at ../../../net/netisr.c:236
#18 0xc0596256 in swi_net (dummy=0x0) at ../../../net/netisr.c:349
#19 0xc050a9e5 in ithread_execute_handlers (p=0xc4767830, ie=0xc47ce300) at ../../../kern/kern_intr.c:684
#20 0xc050aafc in ithread_loop (arg=0xc474f680) at ../../../kern/kern_intr.c:767
#21 0xc0509954 in fork_exit (callout=0xc050aaa8 <ithread_loop>, arg=0xc474f680, frame=0xe252bd38) at ../../../kern/kern_fork.c:805
#22 0xc06351cc in fork_trampoline () at ../../../i386/i386/exception.s:208

>How-To-Repeat:
Turn ipnat address translation and place working server on load
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: