panic in rtsock.c

[Yuriy Tsibizov]

I'm getting repeatable panic with kernel & userland from yesterday evening 
when I try to connect to Internet using bluetooth to connect to my phone:
"rfcomm_pppd -a e60 -c -C dun -l mts".

Everything works well with kernel from last weekend. With yesterday kernel 
it always panic.

Unread portion of the kernel message buffer:
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex radix node head r = 0 (0xc30bc37c) locked @ /usr/src/sys/net/rtsock.c:1258
KDB: stack backtrace:
db_trace_self_wrapper(c0923433) at db_trace_self_wrapper+0x25
kdb_backtrace(1,c350b240,c,d61c1a5c,d61c1a50,...) at kdb_backtrace+0x29
witness_warn(5,0,c0933ff7) at witness_warn+0x192
trap(d61c1a5c) at trap+0x10b
calltrap() at calltrap+0x6
--- trap 0xc, eip = 0xc074a451, esp = 0xd61c1a9c, ebp = 0xd61c1adc ---
sysctl_dumpentry(c324ebb8,d61c1b28) at sysctl_dumpentry+0x65
rn_walktree(c30bc300,c074a3ec,d61c1b28,c30bc37c,0,...) at rn_walktree+0x7a
sysctl_rtsock(c0a05060,d61c1c20,4,d61c1b98,c0a05060,...) at sysctl_rtsock+0x10a
sysctl_root(0,d61c1c18,6,d61c1b98) at sysctl_root+0x12f
userland_sysctl(c3255000,d61c1c18,6,0,bfbfdedc,0,0,0,d61c1c14,0,c0a51808,0,c09605c8,51e) at userland_sysctl+0xf4
__sysctl(c3255000,d61c1d00) at __sysctl+0x77
syscall(d61c1d38) at syscall+0x252
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (202, FreeBSD ELF32, __sysctl), eip = 0x2830a027, esp = 0xbfbfde6c, ebp = 0xbfbfdea8 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x0
fault code		= supervisor read, page not present
instruction pointer	= 0x20:0xc074a451
stack pointer	        = 0x28:0xd61c1a9c
frame pointer	        = 0x28:0xd61c1adc
code segment		= base 0x0, limit 0xfffff, type 0x1b
 			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 963 (ppp)
trap number		= 12
panic: page fault
cpuid = 0

-->bt
#0  doadump () at pcpu.h:172
#1  0xc06c2d74 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc06c307e in panic (fmt=0xc0904aff "%s")
     at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc08c04da in trap_fatal (frame=0xd61c1a5c, eva=0)
     at /usr/src/sys/i386/i386/trap.c:868
#4  0xc08bfb1f in trap (frame=0xd61c1a5c) at /usr/src/sys/i386/i386/trap.c:276
#5  0xc08a9ebb in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#6  0xc074a451 in sysctl_dumpentry (rn=0xc324ebb8, vw=0xd61c1b28)
     at /usr/src/sys/net/rtsock.c:1091
#7  0xc074696e in rn_walktree (h=0xc356c494, f=0xc074a3ec <sysctl_dumpentry>,
     w=0xd61c1b28) at /usr/src/sys/net/radix.c:1083
#8  0xc074a9aa in sysctl_rtsock (oidp=0xc0a05060, arg1=0xd61c1c20, arg2=4,
     req=0xc30bc300) at /usr/src/sys/net/rtsock.c:1259
#9  0xc06caf0f in sysctl_root (oidp=0x0, arg1=0xd61c1c20, arg2=4,
     req=0xd61c1b98) at /usr/src/sys/kern/kern_sysctl.c:1282
#10 0xc06cb0e0 in userland_sysctl (td=0xc356c494, name=0xd61c1c18, namelen=6,
     old=0xd61c1b98, oldlenp=0xbfbfdedc, inkernel=0, new=0x0,
     newlen=3277243540, retval=0xd61c1c14, flags=-1017723756)
     at /usr/src/sys/kern/kern_sysctl.c:1377
#11 0xc06caf97 in __sysctl (td=0xc3255000, uap=0xd61c1d00)
     at /usr/src/sys/kern/kern_sysctl.c:1312
#12 0xc08c07b2 in syscall (frame=0xd61c1d38)
     at /usr/src/sys/i386/i386/trap.c:1010
#13 0xc08a9f20 in Xint0x80_syscall ()
     at /usr/src/sys/i386/i386/exception.s:196
#14 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
-->f 6
#6  0xc074a451 in sysctl_dumpentry (rn=0xc324ebb8, vw=0xd61c1b28)
     at /usr/src/sys/net/rtsock.c:1091
1091			info.rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr;
-->p *rt
$1 = {rt_nodes = {{rn_mklist = 0x0, rn_parent = 0xc324ebd0, rn_bit = -97,
       rn_bmask = 0 '\0', rn_flags = 5 '\005', rn_u = {rn_leaf = {
           rn_Key = 0xc352a600 "\034\034",
           rn_Mask = 0xc3233cb0 "\f", 'Ъ' <repeats 11 times>,
           rn_Dupedkey = 0x0}, rn_node = {rn_Off = -1017993728,
           rn_L = 0xc3233cb0, rn_R = 0x0}}}, {rn_mklist = 0x0,
       rn_parent = 0xc324ee28, rn_bit = 93, rn_bmask = 4 '\004',
       rn_flags = 4 '\004', rn_u = {rn_leaf = {
           rn_Key = 0xb <Address 0xb out of bounds>, rn_Mask = 0xc324ee88 "",
           rn_Dupedkey = 0xc324ebb8}, rn_node = {rn_Off = 11,
           rn_L = 0xc324ee88, rn_R = 0xc324ebb8}}}}, rt_gateway = 0xc352a61c,
   rt_flags = 8388867, rt_ifp = 0xc30c0000, rt_ifa = 0x0, rt_rmx = {
     rmx_mtu = 1500, rmx_expire = 0, rmx_pksent = 0}, rt_refcnt = 0,
   rt_genmask = 0x0, rt_llinfo = 0x0, rt_gwroute = 0x0, rt_parent = 0x0,
   rt_mtx = {lock_object = {lo_name = 0xc0924097 "rtentry",
       lo_type = 0xc0924097 "rtentry", lo_flags = 21168128, lo_witness_data = {
         lod_list = {stqe_next = 0xc0a621d0}, lod_witness = 0xc0a621d0}},
     mtx_lock = 4, mtx_recurse = 0}}