From owner-freebsd-bugs@FreeBSD.ORG Thu Apr 3 20:00:16 2008 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 028301065672 for ; Thu, 3 Apr 2008 20:00:16 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id CADF38FC1D for ; Thu, 3 Apr 2008 20:00:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m33K0Fgs031296 for ; Thu, 3 Apr 2008 20:00:15 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m33K0FLK031295; Thu, 3 Apr 2008 20:00:15 GMT (envelope-from gnats) Resent-Date: Thu, 3 Apr 2008 20:00:15 GMT Resent-Message-Id: <200804032000.m33K0FLK031295@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Charlie & Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E388C1065672 for ; Thu, 3 Apr 2008 19:50:13 +0000 (UTC) (envelope-from root@koellers.net) Received: from dolly.dts-online.net (dolly.dts-online.net [87.245.1.125]) by mx1.freebsd.org (Postfix) with ESMTP id 215E48FC14 for ; Thu, 3 Apr 2008 19:50:13 +0000 (UTC) (envelope-from root@koellers.net) Received: from door.koellers.net (static-87-245-36-131.teleos-web.de [87.245.36.131]) by dolly.dts-online.net (Postfix) with ESMTP id AA7A29A2EFE for ; Thu, 3 Apr 2008 21:50:11 +0200 (CEST) Received: from door.koellers.net (localhost [127.0.0.1]) by door.koellers.net (8.14.2/8.13.8) with ESMTP id m33JoAia002592; Thu, 3 Apr 2008 21:50:10 +0200 (CEST) (envelope-from root@door.koellers.net) Received: (from root@localhost) by door.koellers.net (8.14.2/8.14.2/Submit) id m33JoAu5002591; Thu, 3 Apr 2008 21:50:10 +0200 (CEST) (envelope-from root) Message-Id: <200804031950.m33JoAu5002591@door.koellers.net> Date: Thu, 3 Apr 2008 21:50:10 +0200 (CEST) From: Charlie & To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: lars@koellers.net Subject: kern/122427: apm and mDNSResponder cause panic during shutdown (multicast) X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Charlie & List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Apr 2008 20:00:16 -0000 >Number: 122427 >Category: kern >Synopsis: apm and mDNSResponder cause panic during shutdown (multicast) >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Apr 03 20:00:10 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Lars Koeller >Release: FreeBSD 6.3-RELEASE-p1 i386 >Organization: Computing Center, University of Bielefeld, Germany >Environment: System: FreeBSD door.koellers.net 6.3-RELEASE-p1 FreeBSD 6.3-RELEASE-p1 #1: Tue Feb 19 20:02:44 CET 2008 root@door.koellers.net:/backup/obj/usr/src/sys/DOOR i386 >Description: A kernel panic occurs when mDNSResponder was started, apm is configured and then machins shuts down. Seems to be a problem with removind multicast address records. Googling leads me to sone related problems with Apple OS. If APM is disabled or mDNSResponder not starting, this panic does not occur. Details: ======== Kernel is compiled with apm system is running without problems. apm is enables: APM version: 1.2 APM Management: Disabled AC Line status: on-line Battery Status: unknown Remaining battery life: unknown Remaining battery time: unknown Number of batteries: 0 Resume timer: disabled Resume on ring indicator: disabled APM Capabilities: global standby state global suspend state resume timer from standby resume timer from suspend ONLY when mDNSResponder was started/running and you type shutdown now or shutdown -p now the system panics: System shutdown time has arrived Stopping cron. Stopping lighttpd. Stopping mdnsresponder. Stopping sshd. Stopping bacula_fd. Waiting for PIDS: 1442. Stopping cyrus_imapd. Stopping saslauthd. Stopping ntpddcf. Waiting for PIDS: 1381. Stopping gkrellmd. Stopping apache. Waiting for PIDS: 1361. Stopping smartd. Stopping smbd. Stopping nmbd. Shutting down local daemons:. Stopping apcupsd. Waiting for PIDS: 1090. Writing entropy file:. Terminated . Fatal trap 12: page fault while in kernel mode fault virtual address = 0x302d5a fault code = supervisor read, page not present instruction pointer = 0x20:0xc075f1ff stack pointer = 0x28:0xcdb2fad8 frame pointer = 0x28:0xcdb2fae0 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 1716 (mt-daapd) trap number = 12 panic: page fault Uptime: 5m54s Dumping 255 MB (2 chunks) chunk 0: 1MB (159 pages) ... ok chunk 1: 255MB (65264 pages) 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15 ... ok KGDB Output: ============ 7 : kgdb kernel.debug /var/crash/freenas-apm-panic/vmcore.2 kgdb: kvm_nlist(_stopped_cpus): kgdb: kvm_nlist(_stoppcbs): [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"] GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd". Unread portion of the kernel message buffer: <118>Terminated <118>. Fatal trap 12: page fault while in kernel mode fault virtual address = 0x302d5a fault code = supervisor read, page not present instruction pointer = 0x20:0xc075f1ff stack pointer = 0x28:0xcdb2fad8 frame pointer = 0x28:0xcdb2fae0 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 1716 (mt-daapd) trap number = 12 panic: page fault Uptime: 5m54s Dumping 255 MB (2 chunks) chunk 0: 1MB (159 pages) ... ok chunk 1: 255MB (65264 pages) 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15 #0 doadump () at pcpu.h:165 165 __asm __volatile("movl %%fs:0,%0" : "=r" (td)); (kgdb) list *0xc075f1ff 0xc075f1ff is in in_delmulti (../../../netinet/in.c:1064). 1059 register struct in_multi *inm; 1060 { 1061 struct ifnet *ifp; 1062 1063 ifp = inm->inm_ifp; 1064 IFF_LOCKGIANT(ifp); 1065 IN_MULTI_LOCK(); 1066 in_delmulti_locked(inm, 0); 1067 IN_MULTI_UNLOCK(); 1068 IFF_UNLOCKGIANT(ifp); (kgdb) 1069 } 1070 1071 /* 1072 * Delete all multicast address records associated with the ifp. 1073 */ 1074 void 1075 in_delmulti_ifp(ifp) 1076 register struct ifnet *ifp; 1077 { 1078 struct in_multi *inm; (kgdb) backtrace #0 doadump () at pcpu.h:165 #1 0xc06c0b0e in boot (howto=260) at ../../../kern/kern_shutdown.c:409 #2 0xc06c0da4 in panic (fmt=0xc09ae2f9 "%s") at ../../../kern/kern_shutdown.c:565 #3 0xc093ca94 in trap_fatal (frame=0xcdb2fa98, eva=3157338) at ../../../i386/i386/trap.c:838 #4 0xc093c7fb in trap_pfault (frame=0xcdb2fa98, usermode=0, eva=3157338) at ../../../i386/i386/trap.c:745 #5 0xc093c439 in trap (frame= {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -1062467392, tf_esi = -1031682144, tf_ebp = -843908384, tf_isp = -843908412, tf_ebx = 3157248, tf_edx = -1031050624, tf_ecx = 4, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1066012161, tf_cs = 32, tf_eflags = 66050, tf_esp = 0, tf_ss = -1032105472}) at ../../../i386/i386/trap.c:435 #6 0xc092d71a in calltrap () at ../../../i386/i386/exception.s:139 #7 0xc075f1ff in in_delmulti (inm=0xc281c7a0) at ../../../netinet/in.c:1063 #8 0xc0767d9d in ip_freemoptions (imo=0xc27b5200) at ../../../netinet/ip_output.c:2064 #9 0xc0760454 in in_pcbdetach (inp=0xc2860bf4) at ../../../netinet/in_pcb.c:718 #10 0xc0779076 in udp_detach (so=0x1) at ../../../netinet/udp_usrreq.c:1071 #11 0xc06fa558 in soclose (so=0xc2916858) at ../../../kern/uipc_socket.c:459 #12 0xc06e9cdb in soo_close (fp=0xc28deaf8, td=0xc28b6a80) at ../../../kern/sys_socket.c:317 #13 0xc06a12dc in fdrop_locked (fp=0xc28deaf8, td=0xc28b6a80) at file.h:296 #14 0xc06a1205 in fdrop (fp=0xc28deaf8, td=0xc28b6a80) at ../../../kern/kern_descrip.c:2113 #15 0xc069f833 in closef (fp=0xc28deaf8, td=0xc28b6a80) at ../../../kern/kern_descrip.c:1933 #16 0xc069e84b in fdfree (td=0xc28b6a80) at ../../../kern/kern_descrip.c:1651 #17 0xc06a7e20 in exit1 (td=0xc28b6a80, rv=15) at ../../../kern/kern_exit.c:273 #18 0xc06c513b in sigexit (td=0xc28b6a80, sig=15) at ../../../kern/kern_sig.c:2459 #19 0xc06c4e45 in postsig (sig=15) at ../../../kern/kern_sig.c:2334 #20 0xc06e1942 in ast (framep=0xcdb2fd38) at ../../../kern/subr_trap.c:270 #21 0xc092dbed in doreti_ast () at ../../../i386/i386/exception.s:293 #22 0xcdb2fd38 in ?? () #23 0x0000003b in ?? () #24 0x0000003b in ?? () #25 0x0000003b in ?? () #26 0x08091000 in ?? () #27 0xbfbfeb38 in ?? () >How-To-Repeat: >Fix: >Release-Note: >Audit-Trail: >Unformatted: