kern/137310: reproducable kernel panic: page fault FreeBSD
7.2-STABLE
Jamie Landeg Jones
jamie at bishopston.net
Fri Jul 31 17:20:06 UTC 2009
>Number: 137310
>Category: kern
>Synopsis: reproducable kernel panic: page fault FreeBSD 7.2-STABLE
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Fri Jul 31 17:20:04 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Jamie Landeg Jones
>Release: FreeBSD 7.2-STABLE i386
>Organization:
>Environment:
System: FreeBSD catflap.bishopston.net 7.2-STABLE FreeBSD 7.2-STABLE #0: Fri Jul 17 14:13:53 BST 2009 root at catflap.bishopston.net:/usr/obj/usr/src/sys/CATFLAP i386
7.2-Stable cvs'ed 17th July 2009.
>Description:
Exact same kernel panic as shown below everytime I start rsync. It also panics if rsync is run non-root.
rsync built from ports with:
| # No user-servicable parts inside!
| # Options for rsync-3.0.6
| _OPTIONS_READ=rsync-3.0.6
| WITHOUT_POPT_PORT=true
| WITH_SSH=true
| WITH_FLAGS=true
| WITHOUT_ATIMES=true
| WITH_ACL=true
| WITHOUT_ICONV=true
| WITHOUT_TIMELIMIT=true
offending line (within script) :
| /usr/local/bin/rsync --rsh="ssh -4p 9621" --timeout=1800 -rltHzxS --bwlimit=200 --delete --sparse --fake-super --partial --partial-dir==../../PARTIAL/ --temp-dir=../../TMP/ --compare-dest=../../TMP/ --exclude-from="/usr/catflap/data/do_remote_backup/$remote.exclude" --backup --stats --backup-dir=../../OLD/$date/$remote "$local" jamie at catnip.bishopston.net:/usr/users/jamie/CATFLAPBACKUPS/backup/$remote
same script worked with 6.2
>How-To-Repeat:
run rsync!
>Fix:
--- info.20090730 begins here ---
Dump header from device /dev/ad0s1b
Architecture: i386
Architecture Version: 2
Dump Length: 239001600B (227 MB)
Blocksize: 512
Dumptime: Thu Jul 30 14:40:19 2009
Hostname: catflap.bishopston.net
Magic: FreeBSD Kernel Dump
Version String: FreeBSD 7.2-STABLE #0: Fri Jul 17 14:13:53 BST 2009
root at catflap.bishopston.net:/usr/obj/usr/src/sys/CATFLAP
Panic String: page fault
Dump Parity: 3373992290
Bounds: 0
Dump Status: good
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...
Unread portion of the kernel message buffer:
kernel trap 12 with interrupts disabled
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x18
fault code = supervisor read, page not present
instruction pointer = 0x20:0xc055463c
stack pointer = 0x28:0xe659fa20
frame pointer = 0x28:0xe659fa2c
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = resume, IOPL = 0
current process = 907 (rsync)
trap number = 12
panic: page fault
Uptime: 17h34m28s
Physical memory: 1006 MB
Dumping 227 MB: 212 196 180 164 148 132 116 100 84 68 52 36 20 4
Reading symbols from /boot/kernel/acpi.ko...Reading symbols from /boot/kernel/acpi.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/acpi.ko
Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
Reading symbols from /boot/kernel/linprocfs.ko...Reading symbols from /boot/kernel/linprocfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linprocfs.ko
Reading symbols from /boot/kernel/linsysfs.ko...Reading symbols from /boot/kernel/linsysfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linsysfs.ko
Reading symbols from /usr/local/modules/rtc.ko...done.
Loaded symbols for /usr/local/modules/rtc.ko
#0 doadump () at pcpu.h:196
196 __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb)
(kgdb) list *0xc055463c
0xc055463c is in turnstile_broadcast (/usr/src/sys/kern/subr_turnstile.c:836).
831
832 /*
833 * Transfer the blocked list to the pending list.
834 */
835 mtx_lock_spin(&td_contested_lock);
836 TAILQ_CONCAT(&ts->ts_pending, &ts->ts_blocked[queue], td_lockq);
837 mtx_unlock_spin(&td_contested_lock);
838
839 /*
840 * Give a turnstile to each thread. The last thread gets
841 * this turnstile if the turnstile is empty.
842 */
843 TAILQ_FOREACH(td, &ts->ts_pending, td_lockq) {
844 if (LIST_EMPTY(&ts->ts_free)) {
845 MPASS(TAILQ_NEXT(td, td_lockq) == NULL);
846 ts1 = ts;
847 #ifdef TURNSTILE_PROFILING
848 tc->tc_depth--;
849 #endif
850 } else
851 ts1 = LIST_FIRST(&ts->ts_free);
852 MPASS(ts1 != NULL);
853 LIST_REMOVE(ts1, ts_hash);
854 td->td_turnstile = ts1;
855 }
856 }
857
858 /*
859 * Wakeup all threads on the pending list and adjust the priority of the
860 * current thread appropriately. This must be called with the turnstile
861 * chain locked.
862 */
863 void
864 turnstile_unpend(struct turnstile *ts, int owner_type)
865 {
866 TAILQ_HEAD( ,thread) pending_threads;
867 struct turnstile *nts;
868 struct thread *td;
869 u_char cp, pri;
870
871 MPASS(ts != NULL);
872 mtx_assert(&ts->ts_lock, MA_OWNED);
873 MPASS(ts->ts_owner == curthread ||
874 (owner_type == TS_SHARED_LOCK && ts->ts_owner == NULL));
875 MPASS(!TAILQ_EMPTY(&ts->ts_pending));
876
877 /*
878 * Move the list of pending threads out of the turnstile and
879 * into a local variable.
880 */
881 TAILQ_INIT(&pending_threads);
882 TAILQ_CONCAT(&pending_threads, &ts->ts_pending, td_lockq);
883 #ifdef INVARIANTS
884 if (TAILQ_EMPTY(&ts->ts_blocked[TS_EXCLUSIVE_QUEUE]) &&
885 TAILQ_EMPTY(&ts->ts_blocked[TS_SHARED_QUEUE]))
886 ts->ts_lockobj = NULL;
887 #endif
888 /*
889 * Adjust the priority of curthread based on other contested
890 * locks it owns. Don't lower the priority below the base
(kgdb) back
#0 doadump () at pcpu.h:196
#1 0xc05234da in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2 0xc05236d9 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:574
#3 0xc07795bc in trap_fatal (frame=0xe659f9e0, eva=24) at /usr/src/sys/i386/i386/trap.c:938
#4 0xc0779eb9 in trap (frame=0xe659f9e0) at /usr/src/sys/i386/i386/trap.c:319
#5 0xc076331b in calltrap () at /usr/src/sys/i386/i386/exception.s:166
#6 0xc055463c in turnstile_broadcast (ts=0x0, queue=0) at /usr/src/sys/kern/subr_turnstile.c:835
#7 0xc05143ca in _mtx_unlock_sleep (m=0xc3d91020, opts=0, file=0x0, line=0) at /usr/src/sys/kern/kern_mutex.c:619
#8 0xc04c469f in pfs_getextattr (va=0xe659fab4) at pseudofs_internal.h:110
#9 0xc078db53 in VOP_GETEXTATTR_APV (vop=0xc07dbda0, a=0xe659fab4) at vnode_if.c:2451
#10 0xc058ee7c in extattr_get_vp (vp=0xc80c9678, attrnamespace=1, attrname=0xe659fb29 "rsync.%stat", data=0xbfbfc080, nbytes=255, td=0xc4bb1460) at vnode_if.h:1327
#11 0xc058efec in extattr_get_link (td=0xc4bb1460, uap=0xe659fcfc) at /usr/src/sys/kern/vfs_extattr.c:495
#12 0xc0779b51 in syscall (frame=0xe659fd38) at /usr/src/sys/i386/i386/trap.c:1089
#13 0xc0763380 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:262
#14 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) [189C
15:03 (2) "crash" root at catflap# ^D
Script done on Thu Jul 30 15:03:59 2009
--- info.20090730 ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list