Panic on SMP machine.

[Pawel Jakub Dawidek]

Hello.

While building world I get this panic:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic.id = 00000000
fault virtual address   = 24
[...]
instruction pointer     = 0x8:0xc01a405b
[...]
current process         = 23 (irq10: atapi1+)
kernel: type 12 trap, code=0
Stopped at      propagate_priority+0x8b:       cmpl    0x24(%ebx),%ecx
db> trace
propagate_priority+0x8b
_mtx_lock_sleep+0x209
ithread_loop+0x1cc
fork_exit+0xb0
fork_trampoline+0x1a

According to instruction pointer panic is here:
c01a4049:       e8 c2 fe 01 00          call   c01c3f10 <sched_prio>
c01a404e:       eb 75                   jmp    c01a40c5 <propagate_priority+0xf5>
c01a4050:       89 f0                   mov    %esi,%eax
c01a4052:       88 81 dd 00 00 00       mov    %al,0xdd(%ecx)
c01a4058:       8b 59 5c                mov    0x5c(%ecx),%ebx
c01a405b:       3b 4b 24                cmp    0x24(%ebx),%ecx
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
c01a405e:       74 90                   je     c01a3ff0 <propagate_priority+0x20>
c01a4060:       8b 79 24                mov    0x24(%ecx),%edi
c01a4063:       8b 47 04                mov    0x4(%edi),%eax
c01a4066:       8b 10                   mov    (%eax),%edx
c01a4068:       0f b6 82 dd 00 00 00    movzbl 0xdd(%edx),%eax

IMHO it is here (from /sys/kern/kern_mutex.c):

166:		/*
167:		 * Pick up the mutex that td is blocked on.
168:		 */
169:		m = td->td_blocked;
170:		MPASS(m != NULL);
171:
172:		/*
173:		 * Check if the thread needs to be moved up on
174:		 * the blocked chain
175:		 */
176:		if (td == TAILQ_FIRST(&m->mtx_blocked)) {
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
177:			continue;
178:		}

So it looks like 'm' was NULL.

-- 
Pawel Jakub Dawidek                       pawel at dawidek.net
UNIX Systems Programmer/Administrator     http://garage.freebsd.pl
Am I Evil? Yes, I Am!                     http://cerber.sourceforge.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 305 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20030709/a2d52f26/attachment.bin