[Bug 213903] Kernel crashes from turnstile_broadcast (/usr/src/sys/kern/subr_turnstile.c:837)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213903

--- Comment #15 from Cassiano Peixoto <peixoto.cassiano at gmail.com> ---
(In reply to Franco Fichtner from comment #14)
Hi Franco,

Here it is:
FreeBSD 10.3-STABLE #4: Mon Feb  6 09:29:52 BRST 2017    
root at bgp.server.us:/usr/obj/usr/src/sys/GENERIC

My debug bellow:

# kgdb kernel.debug /var/crash/vmcore.last 
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 7; apic id = 0e
fault virtual address   = 0x30
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80b2b4fa
stack pointer           = 0x28:0xfffffe0237a4f450
frame pointer           = 0x28:0xfffffe0237a4f480
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = resume, IOPL = 0
current process         = 79530 (sh)
trap number             = 12
panic: page fault
cpuid = 7
KDB: stack backtrace:
#0 0xffffffff80b16230 at kdb_backtrace+0x60
#1 0xffffffff80ad7036 at vpanic+0x126
#2 0xffffffff80ad6f03 at panic+0x43
#3 0xffffffff80f810cd at trap_fatal+0x35d
#4 0xffffffff80f813e8 at trap_pfault+0x308
#5 0xffffffff80f80a2a at trap+0x47a
#6 0xffffffff80f661dc at calltrap+0x8
#7 0xffffffff80ad4d80 at __rw_wunlock_hard+0x90
#8 0xffffffff80dffd9a at vm_map_delete+0x33a
#9 0xffffffff80e01b47 at vm_map_remove+0x47
#10 0xffffffff80a96759 at exec_new_vmspace+0x1e9
#11 0xffffffff80a73284 at exec_elf64_imgact+0xa44
#12 0xffffffff80a94ec4 at kern_execve+0x7d4
#13 0xffffffff80a9438c at sys_execve+0x4c
#14 0xffffffff80f81b00 at amd64_syscall+0x450
#15 0xffffffff80f664cb at Xfast_syscall+0xfb
Uptime: 19h0m34s
Dumping 1063 out of 8149 MB: (CTRL-C to abort)
..2%..11%..22%..31%..41%..52%..61%..71%..82%..91%

Reading symbols from /boot/kernel.off/coretemp.ko.symbols...done.
Loaded symbols for /boot/kernel.off/coretemp.ko.symbols
Reading symbols from /boot/modules/plcm.ko...done.
Loaded symbols for /boot/modules/plcm.ko
#0  doadump (textdump=<value optimized out>) at pcpu.h:219
219     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) list *0xffffffff80b2b4fa
0xffffffff80b2b4fa is in turnstile_broadcast
(/usr/src/sys/kern/subr_turnstile.c:838).
833     
834             /*
835              * Transfer the blocked list to the pending list.
836              */
837             mtx_lock_spin(&td_contested_lock);
838             TAILQ_CONCAT(&ts->ts_pending, &ts->ts_blocked[queue],
td_lockq);
839             mtx_unlock_spin(&td_contested_lock);
840     
841             /*
842              * Give a turnstile to each thread.  The last thread gets
Current language:  auto; currently minimal
(kgdb) bt
#0  doadump (textdump=<value optimized out>) at pcpu.h:219
#1  0xffffffff80ad6c53 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:486
#2  0xffffffff80ad7075 in vpanic (fmt=<value optimized out>, ap=<value
optimized out>) at /usr/src/sys/kern/kern_shutdown.c:889
#3  0xffffffff80ad6f03 in panic (fmt=0x0) at
/usr/src/sys/kern/kern_shutdown.c:818
#4  0xffffffff80f810cd in trap_fatal (frame=<value optimized out>, eva=<value
optimized out>) at /usr/src/sys/amd64/amd64/trap.c:858
#5  0xffffffff80f813e8 in trap_pfault (frame=0xfffffe0237a4f3a0,
usermode=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:681
#6  0xffffffff80f80a2a in trap (frame=0xfffffe0237a4f3a0) at
/usr/src/sys/amd64/amd64/trap.c:447
#7  0xffffffff80f661dc in calltrap () at
/usr/src/sys/amd64/amd64/exception.S:238
#8  0xffffffff80b2b4fa in turnstile_broadcast (ts=0x0, queue=1) at
/usr/src/sys/kern/subr_turnstile.c:838
#9  0xffffffff80ad4d80 in __rw_wunlock_hard (c=0xfffff8013a3b5318, tid=1,
file=0xfffff80009947001 "8?\201????", line=1) at
/usr/src/sys/kern/kern_rwlock.c:1027
#10 0xffffffff80dffd9a in vm_map_delete (map=0xfffff8000c22b8c0, start=<value
optimized out>, end=140737488355328) at /usr/src/sys/vm/vm_map.c:2911
#11 0xffffffff80e01b47 in vm_map_remove (map=0xfffff8000c22b8c0,
start=140737488355328, end=1) at /usr/src/sys/vm/vm_map.c:3028
#12 0xffffffff80a96759 in exec_new_vmspace (imgp=0xfffffe0237a4f868,
sv=0xffffffff819858e8) at /usr/src/sys/kern/kern_exec.c:1084
#13 0xffffffff80a73284 in exec_elf64_imgact (imgp=0xfffffe0237a4f868) at
/usr/src/sys/kern/imgact_elf.c:881
#14 0xffffffff80a94ec4 in kern_execve (td=0xfffff80009947000,
args=0xfffffe0237a4fa78, mac_p=<value optimized out>) at
/usr/src/sys/kern/kern_exec.c:606
#15 0xffffffff80a9438c in sys_execve (td=0xfffff80009947000, uap=<value
optimized out>) at /usr/src/sys/kern/kern_exec.c:222
#16 0xffffffff80f81b00 in amd64_syscall (td=0xfffff80009947000, traced=0) at
subr_syscall.c:141
#17 0xffffffff80f664cb in Xfast_syscall () at
/usr/src/sys/amd64/amd64/exception.S:398
#18 0x0000000800d7a97a in ?? ()
Previous frame inner to this frame (corrupt stack?)

Thanks for your help.

-- 
You are receiving this mail because:
You are the assignee for the bug.