kern/118353: [panic] [ppp] repeatable kernel panic during ppp(4) session in 7.0-BETA3

[Eugene Grosbein]

The following reply was made to PR kern/118353; it has been noted by GNATS.

From: Eugene Grosbein <eugen at grosbein.pp.ru>
To: bug-followup at freebsd.org
Cc:  
Subject: Re: kern/118353: [panic] [ppp] repeatable kernel panic during ppp(4) session in 7.0-BETA3
Date: Fri, 30 Nov 2007 23:41:19 +0700

 Hi!
 
 Yesterday evening I had five crashes and have five crashdumps now.
 One of them looks better than others, here is backtrace:
 
 Script started on Thu Nov 29 23:05:25 2007
 [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so:=
  Undefined symbol "ps_pglobal_lookup"]
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain condition=
 s.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-marcel-freebsd".
 
 Unread portion of the kernel message buffer:
 
 
 #0  doadump () at pcpu.h:195
 195		__asm __volatile("movl %%fs:0,%0" : "=3Dr" (td));
 (kgdb) btr=08 =08
 #0  doadump () at pcpu.h:195
 #1  0xc057dd82 in boot (howto=3D260) at /usr/local/src/sys/kern/kern_shutdo=
 wn.c:409
 #2  0xc057e06f in panic (fmt=3DVariable "fmt" is not available.
 ) at /usr/local/src/sys/kern/kern_shutdown.c:563
 #3  0xc0780679 in trap_fatal (frame=3D0xe805b9cc, eva=3D8) at /usr/local/sr=
 c/sys/i386/i386/trap.c:872
 #4  0xc07808c9 in trap_pfault (frame=3D0xe805b9cc, usermode=3D0, eva=3D8) a=
 t /usr/local/src/sys/i386/i386/trap.c:785
 #5  0xc07811d6 in trap (frame=3D0xe805b9cc) at /usr/local/src/sys/i386/i386=
 /trap.c:463
 #6  0xc07686ab in calltrap () at /usr/local/src/sys/i386/i386/exception.s:1=
 39
 #7  0xc0502aff in uhci_device_bulk_done (xfer=3D0xc5ea9600) at /usr/local/s=
 rc/sys/dev/usb/uhci.c:1114
 #8  0xc050ef33 in usb_transfer_complete (xfer=3D0xc5ea9600) at /usr/local/s=
 rc/sys/dev/usb/usbdi.c:975
 #9  0xc0502da2 in uhci_transfer_complete (xfer=3D0xc5ea9600) at /usr/local/=
 src/sys/dev/usb/uhci.c:2109
 #10 0xc050353d in uhci_abort_xfer (xfer=3D0xc5ea9600, status=3D921) at /usr=
 /local/src/sys/dev/usb/uhci.c:2068
 #11 0xc0503587 in uhci_device_bulk_abort (xfer=3D0xc5ea9600) at /usr/local/=
 src/sys/dev/usb/uhci.c:1967
 #12 0xc050e9f9 in usbd_abort_pipe (pipe=3D0xc616f680) at /usr/local/src/sys=
 /dev/usb/usbdi.c:879
 #13 0xc04ff95f in ucomstopread (sc=3D0x399) at /usr/local/src/sys/dev/usb/u=
 com.c:861
 #14 0xc0500053 in ucomstop (tp=3D0xc56c1800, flag=3D3) at /usr/local/src/sy=
 s/dev/usb/ucom.c:633
 #15 0xc05bdf72 in ttyflush (tp=3D0xc56c1800, rw=3D3) at tty.h:408
 #16 0xc0623891 in pppclose (tp=3D0xc56c1800, flag=3D3) at /usr/local/src/sy=
 s/net/ppp_tty.c:250
 #17 0xc05c11fa in ttioctl (tp=3D0xc56c1800, cmd=3D2147775515, data=3D0xc59b=
 cac0, flag=3D3) at linedisc.h:93
 #18 0xc05c1af7 in ttyioctl (dev=3D0xc56be900, cmd=3D2147775515, data=3D0xc5=
 9bcac0 "", flag=3D3, td=3D0xc5c3c220)
     at /usr/local/src/sys/kern/tty.c:3285
 #19 0xc054c077 in giant_ioctl (dev=3D0xc56be900, cmd=3D2147775515, data=3D0=
 xc59bcac0 "", fflag=3D3, td=3D0xc5c3c220)
     at /usr/local/src/sys/kern/kern_conf.c:349
 #20 0xc05150f6 in devfs_ioctl_f (fp=3D0xc6020510, com=3D2147775515, data=3D=
 0xc59bcac0, cred=3D0xc626e300,=20
     td=3D0xc5c3c220) at /usr/local/src/sys/fs/devfs/devfs_vnops.c:494
 #21 0xc05afd15 in kern_ioctl (td=3D0xc5c3c220, fd=3D6, com=3D2147775515, da=
 ta=3D0xc59bcac0 "") at file.h:266
 #22 0xc05afe5a in ioctl (td=3D0xc5c3c220, uap=3D0xe805bcfc) at /usr/local/s=
 rc/sys/kern/sys_generic.c:570
 #23 0xc0780bfc in syscall (frame=3D0xe805bd38) at /usr/local/src/sys/i386/i=
 386/trap.c:1008
 #24 0xc0768710 in Xint0x80_syscall () at /usr/local/src/sys/i386/i386/excep=
 tion.s:196
 #25 0x00000033 in ?? ()
 Previous frame inner to this frame (corrupt stack?)
 (kgdb) frame 7
 #7  0xc0502aff in uhci_device_bulk_done (xfer=3D0xc5ea9600) at /usr/local/s=
 rc/sys/dev/usb/uhci.c:1114
 1114		pqh =3D uhci_find_prev_qh(sc->sc_bulk_start, sqh);
 (kgdb) p sc->sc_bulk_start
 $1 =3D (uhci_soft_qh_t *) 0xc5669fc0
 (kgdb) p pqh
 No symbol "pqh" in current context.
 (kgdb) p sqh
 No symbol "sqh" in current context.
 (kgdb) quit
 
 Script done on Thu Nov 29 23:06:00 2007