Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 15 Jan 2005 00:38:47 -0800
From:      Kris Kennaway <kris@obsecurity.org>
To:        current@FreeBSD.org
Subject:   fstat triggered INVARIANTS panic in memrw()
Message-ID:  <20050115083847.GA47466@xor.obsecurity.org>

next in thread | raw e-mail | index | archive | help

--HlL+5n6rz5pIUxbD
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

The full panic string is

panic: vm_fault: fault on nofault entry, addr: deae2000

----- Forwarded message from Kris Kennaway <kris@obsecurity.org> -----

Date: Fri, 24 Dec 2004 17:42:08 -0800
From: Kris Kennaway <kris@obsecurity.org>
To: current@FreeBSD.org
Cc: phk@FreeBSD.org
Subject: fstat triggered INVARIANTS panic
User-Agent: Mutt/1.4.2.1i

I ran fstat | more on a SMP 6.0 machine with kernel from about a month
ago, which had a lot of files open.  It panicked with:

panic: vm_fault: fau

and got no further on the console, but I was able to break to DBB and
obtain the following traceback from fstat:

db> tr 94874
Tracing pid 94874 tid 100815 td 0xc9ec1780
sched_switch(c9ec1780,c34dc480,1,11a,88a1da96) at sched_switch+0x105
mi_switch(6,c34dc480,c06d4ca0,271,c34dc5d0) at mi_switch+0x1d3
maybe_preempt(c34dc480,1,c06d4c85,3d6,46) at maybe_preempt+0x11d
sched_add(c34dc480,4,c06d4ca0,1ce,c9ec1780,0,c06d11f3,197,197,c06d11f3) at =
sched_add+0x299
setrunqueue(c34dc480,4,c06d11f3,197,c077a900) at setrunqueue+0x109
ithread_schedule(c34d4380,0,eed96788,a0f1b,c9ec1780) at ithread_schedule+0x=
af
intr_execute_handlers(c34d2ea8,eed967b8,eed96810,c0686583,45) at intr_execu=
te_handlers+0x74
lapic_handle_intr(45) at lapic_handle_intr+0x2d
Xapic_isr2() at Xapic_isr2+0x33
--- interrupt, eip =3D 0xc0519495, esp =3D 0xeed967fc, ebp =3D 0xeed96810 -=
--
critical_exit(c0768120,0,c06ea261,a23,1) at critical_exit+0x75
siocnputc(c071b960,75,5,75,eed9696c) at siocnputc+0x9b
cnputc(75,10,1,0,c06d396c) at cnputc+0x65
putchar(75,eed9696c,c0524e6c,30,13) at putchar+0xa8
kvprintf(c06d3963,c0524780,eed9696c,a,eed96990) at kvprintf+0x87d
printf(c06d3963,c072c680,c06e688a,eed969bc,c9ec1780) at printf+0x54
panic(c06e688a,deae6000,1,eed96aa8,eed96a98) at panic+0xe1
vm_fault(c1059000,deae6000,1,0,c9ec1780) at vm_fault+0x1327
trap_pfault(deae6000,c9ec1780,eed96ba8,c050e2c3,deae6000) at trap_pfault+0x=
82
trap(c06e0018,10,c1050010,8058f20,deae5ffe) at trap+0x363
calltrap() at calltrap+0x5
--- trap 0xc, eip =3D 0xc0697f2a, esp =3D 0xeed96bcc, ebp =3D 0xeed96c04 ---
generic_copyout(deadc0de,7ab7037c,eed96c84,54,5964d000) at generic_copyout+=
0x36
memrw(c34fad00,eed96c84,0,398,7ab7037c) at memrw+0x18a
devfs_read_f(c51773b8,eed96c84,ca75c800,0,c9ec1780) at devfs_read_f+0x142
dofileread(4,804f000,7ab7037c,ffffffff,ffffffff) at dofileread+0x92
read(c9ec1780,eed96d14,c,3ff,3) at read+0x75
syscall(2f,2f,2f,7ab7037c,80b1078) at syscall+0x137
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (3, FreeBSD ELF32, read), eip =3D 0x280d347f, esp =3D 0xbfbfe34=
c, ebp =3D 0xbfbfe378 ---

Note the deadc0de in generic_copyout().

There seem to be several other bugs here that show off the well-known
brokenness of panic() and related code on SMP machines.

Kris



----- End forwarded message -----

--HlL+5n6rz5pIUxbD
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)

iD8DBQFB6NaXWry0BWjoQKURAkyXAKD2EMTQkTQ8xF1SwHsNG3iKy+ViJgCfWi6a
PkVx0rku0UlbyeUjU9zi2pM=
=j9bA
-----END PGP SIGNATURE-----

--HlL+5n6rz5pIUxbD--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050115083847.GA47466>