Page fault in kernel mode; unable to dump core; reproducable

[Peter Schuller]

Hello,

i am experiencing a reproducable 'page fault while in kernel mode' with 
CURRENT (from a couple of weeks ago aswell as one cvsuped today). It happens 
extremely early during boot right after the root filesystem is mounted. This 
does not happen with 5.2.1-RELEASE.

I have tried setting 'dumpdev' appropriately (/dev/ad0s2b in my case), but no 
crash dumps are written (not automatically, and not in response to the 
'panic' command in the kernel debugger). What should I do in order to provide 
the necessary information about this bug?

The bug *may* be triggered by the fact that the root filesystem has been 
mounted read-write since the last crash that originally marked the file 
system dirty. I do this sometimes to get around the fact that the startup 
sequence won't defer the root fs for bgfsck until it's been mounted rw at 
least once since being marked dirty.

If I boot into single user mount it will survive mounting the root filesystem 
ro. It has also survived, at least once, remounting rw, but then crashed when 
I did a 'sync'. On another occasion, I let it boot to single user mode, 
mounting ro, after which it crashed when I did 'sysctl -a | grep dumpdev'.

So. I have kept the filesystem dirty, interrupting the bg fsck_ufs when 
booting with 5.2.1 in order to maintain the state which triggers the bug. I 
had meant to post a full stack trace but since I am unable to obtain a dump, 
I will at least include what's on the screen even though it's probably 
useless:

==
Memory modified after free 0xc1c08600(508) val=1000100 @ 0xc1c08600

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x1000120
fault code               = supervisor read, page not present
instruction pointer    = 0x8 :0xc063d63e
stack pointer           = 0x10 :0xd5469984
frame pointer          = 0x10 :0xd54699a0
code segment         = base 0x0, limit 0xfffff, type 0x1b
                             = DPL 0, pres 1, def32 1, gran 1
processor eflags      = interrupt enabled, resume, IOPL = 0
current process       = 64 (sh)
kernel: type 12 trap, code=0
Stopped at       mtrash_ctor+0x3a:     movl   0x20(%eax),%eax

 

-- 
/ Peter Schuller, InfiDyne Technologies HB

PGP userID: 0xE9758B7D or 'Peter Schuller <peter.schuller at infidyne.com>'
Key retrieval: Send an E-Mail to getpgpkey at scode.org
E-Mail: peter.schuller at infidyne.com Web: http://www.scode.org