[PANIC]: rw_lock panic in in_pcballoc() in r185864

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x1a4
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0528cc9
stack pointer           = 0x28:0xc3e77ba8
frame pointer           = 0x28:0xc3e77bcc
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 160 (ifconfig)
Physical memory: 978 MB
Dumping 46 MB: 31 15

Reading symbols from /boot/kernel/snd_hda.ko...Reading symbols from /boot/kernel
/snd_hda.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/snd_hda.ko
Reading symbols from /boot/kernel/sound.ko...Reading symbols from /boot/kernel/s
ound.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/sound.ko
Reading symbols from /boot/modules/nvidia.ko...done.
Loaded symbols for /boot/modules/nvidia.ko
#0  doadump () at pcpu.h:246
246     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:246
#1  0xc045c834 in db_fncall (dummy1=-1008240272, dummy2=0, dummy3=0,
    dummy4=0xc3e7793c "\001") at ../../../ddb/db_command.c:548
#2  0xc045cbaf in db_command (last_cmdp=0xc076765c, cmd_table=0x0, dopager=1)
    at ../../../ddb/db_command.c:445
#3  0xc045ce36 in db_command_loop () at ../../../ddb/db_command.c:498
#4  0xc045ec9f in db_trap (type=12, code=0) at ../../../ddb/db_main.c:229
#5  0xc055966a in kdb_trap (type=12, code=0, tf=0xc3e77b68)
    at ../../../kern/subr_kdb.c:534
#6  0xc06d7a1a in trap_fatal (frame=0xc3e77b68, eva=420)
    at ../../../i386/i386/trap.c:920
#7  0xc06d7daa in trap_pfault (frame=0xc3e77b68, usermode=0, eva=420)
    at ../../../i386/i386/trap.c:842
#8  0xc06d883c in trap (frame=0xc3e77b68) at ../../../i386/i386/trap.c:522
#9  0xc06bd28b in calltrap () at ../../../i386/i386/exception.s:165
#10 0xc0528cc9 in _rw_wlock_hard (rw=0xc45a00a4, tid=3293569600, file=0x0,
    line=0) at ../../../kern/kern_rwlock.c:616
#11 0xc05eae42 in in_pcballoc (so=0xc459e000, pcbinfo=0xc0794b40)
    at ../../../netinet/in_pcb.c:238
#12 0xc060b403 in udp_attach (so=0xc459e000, proto=0, td=0xc44fe240)
    at ../../../netinet/udp_usrreq.c:1131
#13 0xc0586df5 in socreate (dom=2, aso=0xc3e77c6c, type=2, proto=0,
#14 0xc058d974 in socket (td=0xc44fe240, uap=0xc3e77cf8)
---Type <return> to continue, or q <return> to quit---Dec 10 17:29:23 witten log
in: ROOT LOGIN (root) ON ttyv1

    at ../../../kern/uipc_syscalls.c:178
#15 0xc06d8010 in syscall (frame=0xc3e77d38) at ../../../i386/i386/trap.c:1076
#16 0xc06bd320 in Xint0x80_syscall () at ../../../i386/i386/exception.s:261
#17 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

(kgdb) p *pcbinfo
$2 = {ipi_listhead = 0xc0794b24, ipi_count = 1, ipi_hashbase = 0xc42fe000,
  ipi_hashmask = 127, ipi_porthashbase = 0xc42fce00, ipi_porthashmask = 127,
  ipi_lastport = 0, ipi_lastlow = 0, ipi_lasthi = 0, ipi_zone = 0xc1471360,
  ipi_gencnt = 0, ipi_lock = {lock_object = {lo_name = 0xc0713b87 "udp",
      lo_flags = 69926928, lo_data = 0, lo_witness = 0x0},
    rw_lock = 3293569600}, ipi_pspare = {
(kgdb) p *pcbinfo->ipi_zone
$4 = {uz_name = 0xc0716712 "udpcb", uz_lock = 0xc147ed88,
  uz_keg = 0xc147ed80, uz_link = {le_next = 0x0, le_prev = 0xc147eda8},
  uz_full_bucket = {lh_first = 0x0}, uz_free_bucket = {lh_first = 0x0},
  uz_ctor = 0, uz_dtor = 0, uz_init = 0, uz_fini = 0, uz_allocs = 0,
  uz_frees = 0, uz_fails = 0, uz_fills = 0, uz_count = 23, uz_cpu = {{
      uc_freebucket = 0x0, uc_allocbucket = 0x0, uc_allocs = 0,
      uc_frees = 0}}}

the code tries to rw_rwlock() the inp->inp_lock, the inp is allocated
from an UMA zone which has no constructor and in the in_pcballoc() 
the rwlock is never initialized. I believe that's why it crashes

can someone confirm/fix that?

thnx

roman