kern/124280: FreeBSD 7/amd64 STABLE crash (nfsd)

[Attila Nagy]

>Number:         124280
>Category:       kern
>Synopsis:       FreeBSD 7/amd64 STABLE crash (nfsd)
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 04 19:10:03 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Attila Nagy
>Release:        FreeBSD 7.0-STABLE #0: Wed May 28 17:02:56 CEST 2008
>Organization:
>Environment:
FreeBSD boot00a 7.0-STABLE FreeBSD 7.0-STABLE #0: Wed May 28 17:02:56 CEST 2008     root at boot00a:/usr/obj/usr/src/sys/BOOTSRV  amd64
>Description:
HP BL25p, two mirrored SCSI disks hooked up to ciss (HP SmartArray 6i), doing NFS serving via bge interfaces on multiple tagged VLANs with CARP.
The filesystem which is exported via nfs is read only, but occasionally (during the crash it is for sure) is remounted to read write (mount -o rw -u), doing some svn updates and after that a remount to read only (mount -o ro -u).
The filesystem in question is mounted asynchronously.

boot00a# kgdb /usr/obj/usr/src/sys/BOOTSRV/kernel.debug vmcore.6 
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x258
fault code              = supervisor read data, page not present
instruction pointer     = 0x8:0xffffffff8048a2ed
stack pointer           = 0x10:0xffffffffae5c8450
frame pointer           = 0x10:0xffffff000147a000
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1426 (nfsd)
trap number             = 12
panic: page fault
cpuid = 0
Uptime: 6d16h24m24s
Physical memory: 2035 MB
Dumping 297 MB: 282 266 250 234 218 202 186 170 154 138 122 106 90 74 58 42 26 10

Reading symbols from /boot/kernel/if_vlan.ko...Reading symbols from /boot/kernel/if_vlan.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/if_vlan.ko
#0  doadump () at pcpu.h:194
194     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:194
#1  0x0000000000000004 in ?? ()
#2  0xffffffff80496509 in boot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:418
#3  0xffffffff8049690d in panic (fmt=0x104 <Address 0x104 out of bounds>)
    at /usr/src/sys/kern/kern_shutdown.c:572
#4  0xffffffff8078b7b4 in trap_fatal (frame=0xffffff000147a000, 
    eva=18446742974219371624) at /usr/src/sys/amd64/amd64/trap.c:724
#5  0xffffffff8078bb85 in trap_pfault (frame=0xffffffffae5c83a0, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:641
#6  0xffffffff8078c4c8 in trap (frame=0xffffffffae5c83a0)
    at /usr/src/sys/amd64/amd64/trap.c:410
#7  0xffffffff80771fbe in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:169
#8  0xffffffff8048a2ed in _mtx_lock_sleep (m=0xffffff00260c02f0, 
    tid=18446742974219395072, opts=Variable "opts" is not available.
) at /usr/src/sys/kern/kern_mutex.c:335
#9  0xffffffff805053ba in vfs_stdcheckexp (mp=0xffffff0001450000, 
    nam=0xffffff000138ca30, extflagsp=0xffffffffae5c850c, 
    credanonp=0xffffffffae5c8500) at /usr/src/sys/kern/vfs_export.c:401
#10 0xffffffff80659ab1 in nfsrv_fhtovp (fhp=0xffffffffae5c8960, lockflag=0, 
    vpp=0xffffffffae5c8600, vfslockedp=0xffffffffae5c8608, 
---Type <return> to continue, or q <return> to quit---  
    cred=0xffffff0001cf4300, slp=Variable "slp" is not available.
)
    at /usr/src/sys/nfsserver/nfs_srvsubs.c:1108
#11 0xffffffff80659dad in nfs_namei (ndp=0xffffffffae5c88c0, 
    fhp=0xffffffffae5c8960, len=Variable "len" is not available.
) at /usr/src/sys/nfsserver/nfs_srvsubs.c:669
#12 0xffffffff8065148a in nfsrv_lookup (nfsd=0xffffff000150e400, 
    slp=0xffffff000173c600, td=0xffffff000147a000, mrq=0xffffffffae5c8af0)
    at /usr/src/sys/nfsserver/nfs_serv.c:505
#13 0xffffffff8065ae2d in nfssvc (td=Variable "td" is not available.
)
    at /usr/src/sys/nfsserver/nfs_syscalls.c:461
#14 0xffffffff8078be07 in syscall (frame=0xffffffffae5c8c70)
    at /usr/src/sys/amd64/amd64/trap.c:852
#15 0xffffffff807721cb in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:290
#16 0x000000080068779c in ?? ()
Previous frame inner to this frame (corrupt stack?)
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: