misc/137014: panic: vm_page_free_toq: freeing mapped page 0xc34f9978

[Barbara]

>Number:         137014
>Category:       misc
>Synopsis:       panic: vm_page_free_toq: freeing mapped page 0xc34f9978
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 22 21:50:04 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Barbara
>Release:        8-CURRENT
>Organization:
>Environment:
FreeBSD satanasso.local.net 8.0-BETA2 FreeBSD 8.0-BETA2 #0: Sun Jul 19 03:02:38 CEST 2009     root at satanasso.local.net:/usr/obj/usr/src/sys/SATANASSO  i386
>Description:
This happened while portupgrading x11-toolkits/gtk20 with no other user activities.
Unfortunately I have no clue with the debugger.



Unread portion of the kernel message buffer:
panic: vm_page_free_toq: freeing mapped page 0xc34f9978
cpuid = 0
KDB: enter: panic
panic: from debugger
cpuid = 0
Uptime: 29m45s
Physical memory: 2031 MB
Dumping 180 MB: 165 149 133 117 101 85 69 53 37 21 5

Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
Reading symbols from /boot/modules/nvidia.ko...done.
Loaded symbols for /boot/modules/nvidia.ko
Reading symbols from /boot/kernel/linprocfs.ko...Reading symbols from /boot/kernel/linprocfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linprocfs.ko
Reading symbols from /boot/kernel/daemon_saver.ko...Reading symbols from /boot/kernel/daemon_saver.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/daemon_saver.ko
#0  doadump () at pcpu.h:246
246     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:246
#1  0xc060f39c in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:419
#2  0xc060f675 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:575
#3  0xc049c2d7 in db_panic (addr=Could not find the frame base for "db_panic".
) at /usr/src/sys/ddb/db_command.c:478
#4  0xc049c901 in db_command (last_cmdp=0xc096fafc, cmd_table=0x0, dopager=1) at /usr/src/sys/ddb/db_command.c:445
#5  0xc049ca5a in db_command_loop () at /usr/src/sys/ddb/db_command.c:498
#6  0xc049e90c in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:229
#7  0xc063ef15 in kdb_trap (type=3, code=0, tf=0xeb23595c) at /usr/src/sys/kern/subr_kdb.c:534
#8  0xc087c9de in trap (frame=0xeb23595c) at /usr/src/sys/i386/i386/trap.c:685
#9  0xc085fa6b in calltrap () at /usr/src/sys/i386/i386/exception.s:165
#10 0xc063f09a in kdb_enter (why=0xc08e211b "panic", msg=0xc08e211b "panic") at cpufunc.h:71
#11 0xc060f656 in panic (fmt=0xc09054bf "vm_page_free_toq: freeing mapped page %p") at /usr/src/sys/kern/kern_shutdown.c:558
#12 0xc082d160 in vm_page_free_toq (m=0xc34f9978) at /usr/src/sys/vm/vm_page.c:1379
#13 0xc082d396 in vm_page_free (m=0xc34f9978) at /usr/src/sys/vm/vm_page.c:517
#14 0xc082963f in vm_object_terminate (object=0xc7bb6ee0) at /usr/src/sys/vm/vm_object.c:725
#15 0xc082b51d in vm_object_deallocate (object=0xc7bb6ee0) at /usr/src/sys/vm/vm_object.c:623
#16 0xc0822336 in _vm_map_unlock (map=0xc18902bc, file=0xc0903f32 "/usr/src/sys/vm/vm_kern.c", line=471) at /usr/src/sys/vm/vm_map.c:480
#17 0xc081f955 in kmem_free_wakeup (map=0xc18902bc, addr=3804733440, size=267264) at /usr/src/sys/vm/vm_kern.c:471
#18 0xc05e1128 in exec_free_args (args=0xeb235c58) at /usr/src/sys/kern/kern_exec.c:1155
#19 0xc05e2bfc in kern_execve (td=0xc6750d80, args=0xeb235c58, mac_p=0x0) at /usr/src/sys/kern/kern_exec.c:895
#20 0xc05e2dec in execve (td=0xc6750d80, uap=0xeb235cf8) at /usr/src/sys/kern/kern_exec.c:202
#21 0xc087c103 in syscall (frame=0xeb235d38) at /usr/src/sys/i386/i386/trap.c:1073
#22 0xc085fad0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:261
#23 0x00000033 in ?? ()
(kgdb) frame 12
#12 0xc082d160 in vm_page_free_toq (m=0xc34f9978) at /usr/src/sys/vm/vm_page.c:1379
1379            KASSERT(!pmap_page_is_mapped(m),
(kgdb) list
1374    vm_page_free_toq(vm_page_t m)
1375    {
1376    
1377            if (VM_PAGE_GETQUEUE(m) != PQ_NONE)
1378                    mtx_assert(&vm_page_queue_mtx, MA_OWNED);
1379            KASSERT(!pmap_page_is_mapped(m),
1380                ("vm_page_free_toq: freeing mapped page %p", m));
1381            PCPU_INC(cnt.v_tfree);
1382    
1383            if (m->busy || VM_PAGE_IS_FREE(m)) {
(kgdb) up
#13 0xc082d396 in vm_page_free (m=0xc34f9978) at /usr/src/sys/vm/vm_page.c:517
517             vm_page_free_toq(m);
(kgdb) list
512     void
513     vm_page_free(vm_page_t m)
514     {
515     
516             m->flags &= ~PG_ZERO;
517             vm_page_free_toq(m);
518     }
519     
520     /*
521      *      vm_page_free_zero:

>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: