panic: vm_fault: fault on nofault entry, addr: fffffe00873d8000

[Konstantin Belousov]

On Sun, Dec 06, 2015 at 11:45:32AM +0100, Fabian Keil wrote:
> I got the following panic while trying to import a ZFS pool from a
> geli-encrypted memory disk backed by a file located on a msdosfs partition:
I smiled.

> 
> (kgdb) where
> #0  doadump (textdump=0) at pcpu.h:221
> #1  0xffffffff80314c1b in db_dump (dummy=<value optimized out>, dummy2=false, dummy3=0, dummy4=0x0) at /usr/src/sys/ddb/db_command.c:533
> #2  0xffffffff80314a0e in db_command (cmd_table=0x0) at /usr/src/sys/ddb/db_command.c:440
> #3  0xffffffff803147a4 in db_command_loop () at /usr/src/sys/ddb/db_command.c:493
> #4  0xffffffff803172ab in db_trap (type=<value optimized out>, code=0) at /usr/src/sys/ddb/db_main.c:251
> #5  0xffffffff805dfe33 in kdb_trap (type=3, code=0, tf=<value optimized out>) at /usr/src/sys/kern/subr_kdb.c:654
> #6  0xffffffff80879bc7 in trap (frame=0xfffffe009444a240) at /usr/src/sys/amd64/amd64/trap.c:549
> #7  0xffffffff8085eb77 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:234
> #8  0xffffffff805df51b in kdb_enter (why=0xffffffff8096c7fb "panic", msg=0x32 <Address 0x32 out of bounds>) at cpufunc.h:63
> #9  0xffffffff8059bbdf in vpanic (fmt=<value optimized out>, ap=<value optimized out>) at /usr/src/sys/kern/kern_shutdown.c:750
> #10 0xffffffff8059ba33 in panic (fmt=0x0) at /usr/src/sys/kern/kern_shutdown.c:688
> #11 0xffffffff8082ffb5 in vm_fault_hold (map=<value optimized out>, vaddr=<value optimized out>, fault_type=<value optimized out>, fault_flags=<value optimized out>, m_hold=<value optimized out>)
>     at /usr/src/sys/vm/vm_fault.c:332
> #12 0xffffffff8082de18 in vm_fault (map=0xfffff80002000000, vaddr=<value optimized out>, fault_type=2 '\002', fault_flags=0) at /usr/src/sys/vm/vm_fault.c:277
> #13 0xffffffff8087a33a in trap_pfault (frame=0xfffffe009444a8e0, usermode=0) at /usr/src/sys/amd64/amd64/trap.c:734
> #14 0xffffffff80879bde in trap (frame=0xfffffe009444a8e0) at /usr/src/sys/amd64/amd64/trap.c:435
> #15 0xffffffff8085eb77 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:234
> #16 0xffffffff80877d5a in bcopy () at /usr/src/sys/amd64/amd64/support.S:118
> #17 0xffffffff805f64e8 in uiomove_faultflag (cp=<value optimized out>, n=<value optimized out>, uio=0xfffffe009444aae0, nofault=<value optimized out>) at /usr/src/sys/kern/subr_uio.c:208
> #18 0xffffffff8046236f in msdosfs_read (ap=<value optimized out>) at /usr/src/sys/fs/msdosfs/msdosfs_vnops.c:596
> #19 0xffffffff808feb20 in VOP_READ_APV (vop=<value optimized out>, a=<value optimized out>) at vnode_if.c:930
> #20 0xffffffff8039bf3a in mdstart_vnode (sc=0xfffff8004c7ce000, bp=0xfffff80028fc81f0) at vnode_if.h:384
>From the frame 20, do 'p *bp' in kgdb and mail the result.  Do you have
any non-standard values for buffer cache knobs, esp. for MAXPHYS ?

> #21 0xffffffff8039a3cc in md_kthread (arg=0xfffff8004c7ce000) at /usr/src/sys/dev/md/md.c:979
> #22 0xffffffff8055978c in fork_exit (callout=0xffffffff8039a1a0 <md_kthread>, arg=0xfffff8004c7ce000, frame=0xfffffe009444ac00) at /usr/src/sys/kern/kern_fork.c:1011
> #23 0xffffffff8085f0ae in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:609
> #24 0x0000000000000000 in ?? ()
> Current language:  auto; currently minimal
> 
> This is the second time I've seen this, the first time was with a kernel
> based on r290573 in November, but as I wasn't able to intentionally reproduce
> it with a more recent kernel my assumption was that the problem had already
> been fixed.
> 
> Currently my kernel is based on r291706.
> 
> Any ideas?
> 
> Fabian