page fault in radix_mpath while kldunloading if_nfe

Hi.

It's CURRENT with RADIX_MPATH included from 2008/04/22
any ideas?

Unread portion of the kernel message buffer:
rlphy0: detached
miibus0: detached
nfe0: detached
Kernel page fault with the following non-sleepable locks held:
exclusive rw tcpinp r = 0 (0xc2daca74) locked _at_
/usr/src/sys/netinet/tcp_usrreq.c:783
KDB: stack backtrace:
db_trace_self_wrapper(c0730eea,d6007894,c0572ca7,c0731279,d60078a8,...)
at db_trace_self_wrapper+0x26
kdb_backtrace(c0731279,d60078a8,4,1,0,...) at kdb_backtrace+0x29
witness_warn(5,0,c0752e90,4,c,...) at witness_warn+0x1c7
trap(d6007934) at trap+0x116
calltrap() at calltrap+0x6
--- trap 0xc, eip = 0xc052cd06, esp = 0xd6007974, ebp = 0xd6007990 ---
_mtx_unlock_flags(60,0,c073becd,111,d6007a08,...) at _mtx_unlock_flags+0x46
rtalloc_mpath(d6007a08,30,c073d93c,85,c2fa9440,...) at rtalloc_mpath+0x76
ip_output(c2b78700,0,d6007a08,0,0,...) at ip_output+0x359
tcp_output(c2dae000,c2b78a00,30f,0,c2daca74,...) at tcp_output+0x114f
tcp_usr_send(c2db0c20,0,c2b78a00,0,0,...) at tcp_usr_send+0x214
sosend_generic(c2db0c20,0,d6007c60,0,0,...) at sosend_generic+0x529
sosend(c2db0c20,0,d6007c60,0,0,...) at sosend+0x54
soo_write(c2bb8888,d6007c60,c2f80400,0,c2fa9440,...) at soo_write+0x4a
dofilewrite(d6007c60,ffffffff,ffffffff,0,c2bb8888,...) at dofilewrite+0x95
kern_writev(c2fa9440,3,d6007c60,813e030,0,...) at kern_writev+0x58
write(c2fa9440,d6007cfc,c,c0733b70,c076a9c0,...) at write+0x4f
syscall(d6007d38) at syscall+0x2a3
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (4, FreeBSD ELF32, write), eip = 0x283f552b, esp =
0xbfbfe2dc, ebp = 0xbfbfe2f8 ---


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x70
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc052cd06
stack pointer           = 0x28:0xd6007974
frame pointer           = 0x28:0xd6007990
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 783 (sshd)
Physical memory: 503 MB
Dumping 46 MB: 31 15

#0  doadump () at pcpu.h:195
195     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc0453d69 in db_fncall (dummy1=1, dummy2=0, dummy3=-1065310528,
    dummy4=0xd6007758 "") at /usr/src/sys/ddb/db_command.c:516
#2  0xc04542ec in db_command (last_cmdp=0xc0795554, cmd_table=0x0, dopager=1)
    at /usr/src/sys/ddb/db_command.c:413
#3  0xc04543fa in db_command_loop () at /usr/src/sys/ddb/db_command.c:466
#4  0xc0455bfc in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_main.c:228
#5  0xc0563123 in kdb_trap (type=12, code=0, tf=0xd6007934)
    at /usr/src/sys/kern/subr_kdb.c:510
#6  0xc06f286f in trap_fatal (frame=0xd6007934, eva=112)
    at /usr/src/sys/i386/i386/trap.c:885
#7  0xc06f3154 in trap (frame=0xd6007934) at /usr/src/sys/i386/i386/trap.c:279
#8  0xc06db01b in calltrap () at /usr/src/sys/i386/i386/exception.s:146
#9  0xc052cd06 in _mtx_unlock_flags (m=0x60, opts=0,
    file=0xc073becd "/usr/src/sys/net/radix_mpath.c", line=273)
    at /usr/src/sys/kern/kern_mutex.c:192
#10 0xc05de9b6 in rtalloc_mpath (ro=0xd6007a08, hash=48)
    at /usr/src/sys/net/radix_mpath.c:273
#11 0xc05f4539 in ip_output (m=0xc2b78700, opt=0x0, ro=0xd6007a08, flags=0,
    imo=0x0, inp=0xc2dac9d8) at /usr/src/sys/netinet/ip_output.c:233
#12 0xc05fc12f in tcp_output (tp=0xc2dae000)
    at /usr/src/sys/netinet/tcp_output.c:1135
#13 0xc0605b14 in tcp_usr_send (so=0xc2db0c20, flags=0, m=0xc2b78a00, nam=0x0,
    control=0x0, td=0xc2fa9440) at tcp_offload.h:269
#14 0xc0596319 in sosend_generic (so=0xc2db0c20, addr=0x0, uio=0xd6007c60,
    top=0xc2b78a00, control=0x0, flags=0, td=0xc2fa9440)
    at /usr/src/sys/kern/uipc_socket.c:1240
#15 0xc0592c04 in sosend (so=0xc2db0c20, addr=0x0, uio=0xd6007c60, top=0x0,
    control=0x0, flags=0, td=0xc2fa9440)
    at /usr/src/sys/kern/uipc_socket.c:1286
#16 0xc057afda in soo_write (fp=0xc2bb8888, uio=0xd6007c60,
    active_cred=0xc2f80400, flags=0, td=0xc2fa9440)
    at /usr/src/sys/kern/sys_socket.c:104
#17 0xc05756c5 in dofilewrite (td=0xc2fa9440, fd=3, fp=0xc2bb8888,
    auio=0xd6007c60, offset=-1, flags=0) at file.h:231
#18 0xc0575958 in kern_writev (td=0xc2fa9440, fd=3, auio=0xd6007c60)
    at /usr/src/sys/kern/sys_generic.c:444
#19 0xc05759df in write (td=0xc2fa9440, uap=0xd6007cfc)
    at /usr/src/sys/kern/sys_generic.c:360
#20 0xc06f2d53 in syscall (frame=0xd6007d38)
    at /usr/src/sys/i386/i386/trap.c:1026
#21 0xc06db080 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:203
#22 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) f 10
#10 0xc05de9b6 in rtalloc_mpath (ro=0xd6007a08, hash=48)
    at /usr/src/sys/net/radix_mpath.c:273
273                     RT_UNLOCK(ro->ro_rt);
(kgdb) p *ro
$1 = {ro_rt = 0x0, ro_dst = {sa_len = 16 '\020', sa_family = 2 '\002',
    sa_data = "\000\000ю╗х╧\000\000\000\000\000\000\000"}}


wbr,
pluknet