HEAD/i386 r320212: three reproducible panics

From: Oleg V. Nauman <oleg_at_theweb.org.ua>
Date: Fri, 23 Jun 2017 19:42:55 +0300
 a) Panic on shutdown:


Fatal trap 1: privileged instruction fault while in kernel mode
cpuid = 1; apic id = 01
instruction pointer  = 0x20:0xc6be2023
stack pointer          = 0x28:0xe13c39f4
frame pointer          = 0x28:0xe13c3a20
code segment      = base 0x0, limit 0xfffff, type 0x1b
         = DPL 0, pres 1, def32 1, gran 1
processor eflags  = interrupt enabled, resume, IOPL = 0
current process      = 11 (swi1: netisr 0)
trap number    = 1
panic: privileged instruction fault
cpuid = 1
time = 1498206262
Uptime: 6m19s

 The trace is:

__curthread () at ./machine/pcpu.h:225
225      __asm("movl %%fs:%1,%0" : "=r" (td)
(kgdb) #0  __curthread () at ./machine/pcpu.h:225
#1  doadump (textdump=-968633472) at ../../../kern/kern_shutdown.c:318
#2  0xc06e88c4 in kern_reboot (howto=<optimized out>)
    at ../../../kern/kern_shutdown.c:386
#3  0xc06e8c5b in vpanic (fmt=<optimized out>,
    ap=0xe13c3874 "}\334\235\300H\254 \306\001")
    at ../../../kern/kern_shutdown.c:779
#4  0xc06e8b1b in panic (fmt=0xc092e18e "%s")
    at ../../../kern/kern_shutdown.c:710
#5  0xc08eed21 in trap_fatal (frame=0xe13c39b4, eva=<optimized out>)
    at ../../../i386/i386/trap.c:978
#6  0xc08eea38 in trap (frame=<optimized out>)
    at ../../../i386/i386/trap.c:704
#7  <signal handler called>
#8  0xc6be2023 in ?? ()
#9  0xc082ed53 in tcp_do_segment (m=<optimized out>, th=<optimized out>,
    so=<optimized out>, tp=<optimized out>, drop_hdrlen=<optimized out>,
    tlen=<optimized out>, iptos=<optimized out>,
    ti_locked=<error reading variable: Cannot access memory at address 0x1>)
    at ../../../netinet/tcp_input.c:2444
#10 0xc082c181 in tcp_input (mp=<optimized out>, offp=<optimized out>,
    proto=<optimized out>) at ../../../netinet/tcp_input.c:1191
#11 0xc0820878 in ip_input (m=0x0) at ../../../netinet/ip_input.c:823
#12 0xc07d5d0f in netisr_process_workstream_proto (nwsp=<optimized out>,
    proto=<optimized out>) at ../../../net/netisr.c:899
#13 swi_net (arg=<optimized out>) at ../../../net/netisr.c:946
#14 0xc06bb3c5 in intr_event_execute_handlers (p=0x109, ie=<optimized out>)
    at ../../../kern/kern_intr.c:1336
#15 0xc06bb5f0 in ithread_execute_handlers (ie=<optimized out>,
    p=<optimized out>) at ../../../kern/kern_intr.c:1349
#16 ithread_loop (arg=0xc60e6d00) at ../../../kern/kern_intr.c:1430
#17 0xc06b8a76 in fork_exit (callout=0xc06bb560 <ithread_loop>,
    arg=<optimized out>, frame=<optimized out>)
    at ../../../kern/kern_fork.c:1038
#18 <signal handler called>
(kgdb)

b) Panic on accepting incoming SSH connection:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xa4c6f47f
fault code     = supervisor read, page not present
instruction pointer  = 0x20:0xc6bd0418
stack pointer          = 0x28:0xea66b6a4
frame pointer          = 0x28:0xea66b6d0
code segment      = base 0x0, limit 0xfffff, type 0x1b
         = DPL 0, pres 1, def32 1, gran 1
processor eflags  = interrupt enabled, resume, IOPL = 0
current process      = 0 (ath0 taskq)
trap number    = 12
panic: page fault
cpuid = 0
time = 1498233591
Uptime: 1m2s

 The trace is:

__curthread () at ./machine/pcpu.h:225
225      __asm("movl %%fs:%1,%0" : "=r" (td)
(kgdb) #0  __curthread () at ./machine/pcpu.h:225
#1  doadump (textdump=-968633856) at ../../../kern/kern_shutdown.c:318
#2  0xc06e88c4 in kern_reboot (howto=<optimized out>)
    at ../../../kern/kern_shutdown.c:386
#3  0xc06e8c5b in vpanic (fmt=<optimized out>,
    ap=0xea66b504 "\353\334\235\300H<?\306\001")
    at ../../../kern/kern_shutdown.c:779
#4  0xc06e8b1b in panic (fmt=0xc092e18e "%s")
    at ../../../kern/kern_shutdown.c:710
#5  0xc08eed21 in trap_fatal (frame=0xea66b664, eva=<optimized out>)
    at ../../../i386/i386/trap.c:978
#6  0xc08eee5d in trap_pfault (frame=0xea66b664, usermode=0,
    eva=<optimized out>) at ../../../i386/i386/trap.c:786
#7  0xc08ee48e in trap (frame=<optimized out>)
    at ../../../i386/i386/trap.c:512
#8  <signal handler called>
#9  0xc6bd0418 in ?? ()
#10 0xc082ed53 in tcp_do_segment (m=<optimized out>, th=<optimized out>,
    so=<optimized out>, tp=<optimized out>, drop_hdrlen=<optimized out>,
    tlen=<optimized out>, iptos=<optimized out>,
    ti_locked=<error reading variable: Cannot access memory at address 0x1>)
    at ../../../netinet/tcp_input.c:2444
#11 0xc082c181 in tcp_input (mp=<optimized out>, offp=<optimized out>,
    proto=<optimized out>) at ../../../netinet/tcp_input.c:1191
#12 0xc0820878 in ip_input (m=0x0) at ../../../netinet/ip_input.c:823
#13 0xc07d55bb in netisr_dispatch_src (proto=<optimized out>,
    source=<optimized out>, m=0xc6bd0418) at ../../../net/netisr.c:1120
#14 0xc07d5880 in netisr_dispatch (proto=1, m=0xc6cc6000)
    at ../../../net/netisr.c:1211
#15 0xc07c7292 in ether_demux (ifp=0xc6860800, m=0x0)
    at ../../../net/if_ethersubr.c:848
#16 0xc07c7f20 in ether_input_internal (ifp=0xc6860800, m=0xc6bd0418)
    at ../../../net/if_ethersubr.c:637
#17 ether_nh_input (m=<optimized out>) at ../../../net/if_ethersubr.c:667
#18 0xc07d55bb in netisr_dispatch_src (proto=<optimized out>,
    source=<optimized out>, m=0xc6bd0418) at ../../../net/netisr.c:1120
#19 0xc07d5880 in netisr_dispatch (proto=5, m=0xc6cc6000)
    at ../../../net/netisr.c:1211
#20 0xc07c751a in ether_input (ifp=0xc6860800, m=0x0)
    at ../../../net/if_ethersubr.c:757
#21 0xc07efc2e in ieee80211_deliver_data (vap=0xc6a97000, ni=<optimized out>,
    m=0xc6cc6000) at ../../../net80211/ieee80211_input.c:291
#22 0xc08070e5 in sta_input (ni=<optimized out>, m=0xc6cc6000,
    rxs=<optimized out>, rssi=<optimized out>, nf=<optimized out>)
    at ../../../net80211/ieee80211_sta.c:891
#23 0xc07ef824 in ieee80211_input_mimo (ni=0x0, m=<optimized out>)
    at ../../../net80211/ieee80211_input.c:99
#24 0xc053439a in ath_rx_pkt (sc=<optimized out>, rs=<optimized out>,
    status=<optimized out>, tsf=<optimized out>, nf=<optimized out>,
    qtype=<optimized out>, bf=<optimized out>, m=<optimized out>)
    at ../../../dev/ath/if_ath_rx.c:950
#25 0xc05350f5 in ath_rx_proc (sc=0xc63f9000, resched=1)
    at ../../../dev/ath/if_ath_rx.c:1150
#26 0xc07359cc in taskqueue_run_locked (queue=0xc63d3b80)
    at ../../../kern/subr_taskqueue.c:454
#27 0xc07368b7 in taskqueue_thread_loop (arg=0xc63ffee8)
    at ../../../kern/subr_taskqueue.c:746
#28 0xc06b8a76 in fork_exit (callout=0xc0736810 <taskqueue_thread_loop>,
    arg=<optimized out>, frame=<optimized out>)
    at ../../../kern/kern_fork.c:1038
#29 <signal handler called>
(kgdb)

c) Panic on 'polkit-auth' application invocation:

Fatal trap 10: trace trap while in kernel mode
cpuid = 1; apic id = 01
instruction pointer  = 0x20:0xc6bcda1b
stack pointer          = 0x28:0xefd5c8b8
frame pointer          = 0x28:0xefd5c904
code segment      = base 0x0, limit 0xfffff, type 0x1b
         = DPL 0, pres 1, def32 1, gran 1
processor eflags  = interrupt enabled, IOPL = 0
current process      = 1646 (polkit-auth)
trap number    = 10
panic: trace trap
cpuid = 1
time = 1498205821
Uptime: 2m1s

 The trace is:

__curthread () at ./machine/pcpu.h:225
225      __asm("movl %%fs:%1,%0" : "=r" (td)
(kgdb) #0  __curthread () at ./machine/pcpu.h:225
#1  doadump (textdump=-968633856) at ../../../kern/kern_shutdown.c:318
#2  0xc06e88c4 in kern_reboot (howto=<optimized out>)
    at ../../../kern/kern_shutdown.c:386
#3  0xc06e8c5b in vpanic (fmt=<optimized out>,
    ap=0xefd5c73c "\340\334\235\300\310\370\266\306\001")
    at ../../../kern/kern_shutdown.c:779
#4  0xc06e8b1b in panic (fmt=0xc092e18e "%s")
    at ../../../kern/kern_shutdown.c:710
#5  0xc08eed21 in trap_fatal (frame=0xefd5c878, eva=<optimized out>)
    at ../../../i386/i386/trap.c:978
#6  0xc08eea38 in trap (frame=<optimized out>)
    at ../../../i386/i386/trap.c:704
#7  <signal handler called>
#8  0xc6bcda1b in ?? ()
#9  0xc0770281 in unp_connect2 (so=<optimized out>, so2=<optimized out>,
    req=<optimized out>) at ../../../kern/uipc_usrreq.c:1497
#10 0xc076ff17 in unp_connectat (fd=<optimized out>, so=<optimized out>,
    nam=<optimized out>, td=<optimized out>)
    at ../../../kern/uipc_usrreq.c:1446
#11 0xc076d510 in unp_connect (so=0xc71c9400, nam=0xc662d500,
    td=<optimized out>) at ../../../kern/uipc_usrreq.c:1310
#12 uipc_connect (so=0xc71c9400, nam=0xc662d500, td=<optimized out>)
    at ../../../kern/uipc_usrreq.c:587
#13 0xc076a042 in kern_connectat (td=<optimized out>, dirfd=-100,
    fd=<optimized out>, sa=0xc662d500) at ../../../kern/uipc_syscalls.c:505
#14 0xc0769f49 in sys_connect (td=0xc6bcda18, uap=0xc6b6f988)
    at ../../../kern/uipc_syscalls.c:470
#15 0xc08ef679 in syscallenter (td=<optimized out>)
    at ../../../i386/i386/../../kern/subr_syscall.c:132
#16 syscall (frame=<optimized out>) at ../../../i386/i386/trap.c:1103
#17 <signal handler called>
#18 0x283a4747 in ?? ()
Backtrace stopped: Cannot access memory at address 0xbfbfe794
(kgdb)
Received on Fri Jun 23 2017 - 14:58:07 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:12 UTC