[panic] page fault in tcp_timer_2msl_tw

[Pawel Worach]

Got this on a SMP (2 physical, HTT off) box during moderate tcp (http) 
load. Any ideas?

FreeBSD pxecmb3 5.4-RELEASE-p6 FreeBSD 5.4-RELEASE-p6 #0: Fri Jul 29 
19:57:15 CEST 2005     root at pxecma1:/usr/obj/usr/src/sys/PROXY  i386
SCHED_4BSD, ADAPTIVE_GIANT, mpsafenet=1

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xac
fault code              = supervisor write, page not present
instruction pointer     = 0x8:0xc057a8f9
stack pointer           = 0x10:0xe4cf7c34
frame pointer           = 0x10:0xe4cf7c58
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 63 (swi5: clock sio)

db> tr
Tracing pid 63 tid 100063 td 0xc1f0d480
tcp_timer_2msl_tw(0,c04e3a90,c0684660,c06848e0,0) at tcp_timer_2msl_tw+0x49
tcp_slowtimo(c1f0ba98,e4cf7cd4,c04d7a79,246,e) at tcp_slowtimo+0x6c
pfslowtimo(0,0,e4cf7cb8,418700,32ccaeb3) at pfslowtimo+0x39
softclock(0,0,0,0,0) at softclock+0x34b
ithread_loop(c1f1bb80,e4cf7d48,0,0,0) at ithread_loop+0x1b8
fork_exit(c04b4be0,c1f1bb80,e4cf7d48) at fork_exit+0x80
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xe4cf7d7c, ebp = 0 ---
db> call doadump
Dumping 1023 MB
  16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 304 
320 336 352 368 384 400 416 432 448 464 480 496 512 528 544 560 576 592 
608 624 640 656 672 688 704 720 736 752 768 784 800 816 832 848 864 880 
896 912 928 944 960 976 992 1008
Dump complete
0xf

(kgdb) bt
...
#9  0xc061d1ca in calltrap () at /usr/src/sys/i386/i386/exception.s:140
#10 0x00000018 in ?? ()
#11 0x00000010 in ?? ()
---Type <return> to continue, or q <return> to quit---
#12 0xc1e70010 in ?? ()
#13 0xc06a8280 in twl_2msl ()
#14 0xc06a827c in twl_2msl ()
#15 0xe4cf7c58 in ?? ()
#16 0xe4cf7c20 in ?? ()
#17 0xc4a30118 in ?? ()
#18 0xc1f0d480 in ?? ()
#19 0x00000000 in ?? ()
#20 0x00000004 in ?? ()
#21 0x0000000c in ?? ()
#22 0x00000002 in ?? ()
#23 0xc057a8f9 in tcp_timer_2msl_tw (reuse=0) at atomic.h:154
#24 0xc057a29c in tcp_slowtimo () at /usr/src/sys/netinet/tcp_timer.c:136
#25 0xc050f379 in pfslowtimo (arg=0x0) at 
/usr/src/sys/kern/uipc_domain.c:245
#26 0xc04debcb in softclock (dummy=0x0) at 
/usr/src/sys/kern/kern_timeout.c:279
#27 0xc04b4d98 in ithread_loop (arg=0xc1f1bb80)
     at /usr/src/sys/kern/kern_intr.c:547
#28 0xc04b39b0 in fork_exit (callout=0xc04b4be0 <ithread_loop>, arg=0x0,
     frame=0x0) at /usr/src/sys/kern/kern_fork.c:791
#29 0xc061d22c in fork_trampoline () at 
/usr/src/sys/i386/i386/exception.s:209
(kgdb) frame 23
#23 0xc057a8f9 in tcp_timer_2msl_tw (reuse=0) at atomic.h:154
154     atomic.h: No such file or directory.
         in atomic.h
(kgdb) info loc
tw = (struct tcptw *) 0xc4a30118
tw_tail = (struct tcptw *) 0xc06a8280
twl = (struct twlist *) 0xc06a827c
i = 1
(kgdb) print *tw
$1 = {tw_inpcb = 0x0, snd_nxt = 438603527, rcv_nxt = 3383864561,
   iss = 438603320, irs = 3383863898, cc_recv = 0, cc_send = 0,
   last_win = 65534, tw_so_options = 4, tw_cred = 0x0, t_recent = 0,
   t_starttime = 4294952294, tw_time = 0, tw_2msl = {le_next = 0xc24680a8,
     le_prev = 0xc06a827c}}
(kgdb) print *tw_tail
$2 = {tw_inpcb = 0x0, snd_nxt = 0, rcv_nxt = 0, iss = 0, irs = 0, 
cc_recv = 0,
   cc_send = 0, last_win = 0, tw_so_options = 0, tw_cred = 0x0, t_recent 
= 0,
   t_starttime = 0, tw_time = 0, tw_2msl = {le_next = 0x0,
     le_prev = 0xc267d110}}
(kgdb) print *twl
$3 = {tw_list = {lh_first = 0xc4a30118}, tw_tail = {tw_inpcb = 0x0,
     snd_nxt = 0, rcv_nxt = 0, iss = 0, irs = 0, cc_recv = 0, cc_send = 0,
     last_win = 0, tw_so_options = 0, tw_cred = 0x0, t_recent = 0,
     t_starttime = 0, tw_time = 0, tw_2msl = {le_next = 0x0,
       le_prev = 0xc267d110}}}

/usr/src/sys/netinet/tcp_timer.c:
      $FreeBSD: src/sys/netinet/tcp_timer.c,v 1.66.2.6 2005/01/31 
23:26:37 imp Exp $

vmcore and kernel.debug saved if more info needed.

-- 
Pawel