From owner-freebsd-bugs@FreeBSD.ORG Sat Jan 27 10:40:22 2007 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 78EA516A4CC for ; Sat, 27 Jan 2007 10:40:22 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id 5719913C4AE for ; Sat, 27 Jan 2007 10:40:19 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l0RAeJ73020680 for ; Sat, 27 Jan 2007 10:40:19 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l0RAeJZx020676; Sat, 27 Jan 2007 10:40:19 GMT (envelope-from gnats) Resent-Date: Sat, 27 Jan 2007 10:40:19 GMT Resent-Message-Id: <200701271040.l0RAeJZx020676@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Konrad Rybacki Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id CE81316A400 for ; Sat, 27 Jan 2007 10:33:48 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [69.147.83.33]) by mx1.freebsd.org (Postfix) with ESMTP id B241413C4A3 for ; Sat, 27 Jan 2007 10:33:48 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l0RAXmF6005566 for ; Sat, 27 Jan 2007 10:33:48 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id l0RAXmTg005565; Sat, 27 Jan 2007 10:33:48 GMT (envelope-from nobody) Message-Id: <200701271033.l0RAXmTg005565@www.freebsd.org> Date: Sat, 27 Jan 2007 10:33:48 GMT From: Konrad Rybacki To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.0 Cc: Subject: kern/108418: Kernel panic after killing kdm. X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jan 2007 10:40:22 -0000 >Number: 108418 >Category: kern >Synopsis: Kernel panic after killing kdm. >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Jan 27 10:40:18 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Konrad Rybacki >Release: 6.2-STABLE >Organization: >Environment: FreeBSD 6.2-STABLE FreeBSD 6.2-STABLE #1: Sat Jan 27 09:31:21 UTC 2007 konrad@stacja:/usr/obj/usr/src/sys/BIURKO.DEBUG i386 >Description: Kernel crashes after killing kdm or kdeinit (for example when logging out of kde or sutting down the system). This problem appears only when kdm was invoked from /etc/ttys. When kdm is invoked from command line, everything seems to be ok. dmesg: Copyright (c) 1992-2007 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD is a registered trademark of The FreeBSD Foundation. FreeBSD 6.2-STABLE #1: Sat Jan 27 09:31:21 UTC 2007 konrad@stacja:/usr/obj/usr/src/sys/BIURKO.DEBUG module_register: module uhub/ums already exists! Module uhub/ums failed to register: 17 Timecounter "i8254" frequency 1193182 Hz quality 0 CPU: Intel(R) Pentium(R) 4 CPU 3.00GHz (3006.83-MHz 686-class CPU) Origin = "GenuineIntel" Id = 0xf34 Stepping = 4 Features=0xbfebfbff Features2=0x441d> real memory = 1073676288 (1023 MB) avail memory = 1041682432 (993 MB) ACPI APIC Table: ioapic0 irqs 0-23 on motherboard ath_hal: 0.9.17.2 (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413) acpi0: on motherboard acpi0: Power Button (fixed) Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000 acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0 cpu0: on acpi0 acpi_button0: on acpi0 pcib0: port 0xcf8-0xcff on acpi0 pci0: on pcib0 agp0: mem 0xd8000000-0xdfffffff at device 0.0 on pci0 pcib1: at device 1.0 on pci0 pci1: on pcib1 pci1: at device 0.0 (no driver attached) pci1: at device 0.1 (no driver attached) pcib2: at device 3.0 on pci0 pci2: on pcib2 pci2: at device 1.0 (no driver attached) uhci0: port 0xbc00-0xbc1f irq 16 at device 29.0 on pci0 uhci0: [GIANT-LOCKED] usb0: on uhci0 usb0: USB revision 1.0 uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub0: 2 ports with 2 removable, self powered uhci1: port 0xb000-0xb01f irq 19 at device 29.1 on pci0 uhci1: [GIANT-LOCKED] usb1: on uhci1 usb1: USB revision 1.0 uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub1: 2 ports with 2 removable, self powered uhci2: port 0xb400-0xb41f irq 18 at device 29.2 on pci0 uhci2: [GIANT-LOCKED] usb2: on uhci2 usb2: USB revision 1.0 uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub2: 2 ports with 2 removable, self powered uhci3: port 0xb800-0xb81f irq 16 at device 29.3 on pci0 uhci3: [GIANT-LOCKED] usb3: on uhci3 usb3: USB revision 1.0 uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub3: 2 ports with 2 removable, self powered ehci0: mem 0xf4200000-0xf42003ff irq 23 at device 29.7 on pci0 ehci0: [GIANT-LOCKED] usb4: EHCI version 1.0 usb4: companion controllers, 2 ports each: usb0 usb1 usb2 usb3 usb4: on ehci0 usb4: USB revision 2.0 uhub4: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1 uhub4: 8 ports with 8 removable, self powered pcib3: at device 30.0 on pci0 pci3: on pcib3 pci3: at device 2.0 (no driver attached) atapci0: port 0x7000-0x7007,0x7400-0x7403,0x7800-0x7807,0x7c00-0x7c03,0x8000-0x800f mem 0xf3015000-0xf30151ff irq 19 at device 3.0 on pci3 ata2: on atapci0 ata3: on atapci0 ath0: mem 0xf3000000-0xf300ffff irq 20 at device 4.0 on pci3 ath0: Ethernet address: 00:30:4f:4b:69:dd ath0: mac 7.9 phy 4.5 radio 5.6 wi0: mem 0xf4100000-0xf4100fff irq 21 at device 5.0 on pci3 wi0: using RF:PRISM2.5 MAC:ISL3874A(Mini-PCI) wi0: Intersil Firmware: Primary (1.1.1), Station (1.8.0) wi0: Ethernet address: 00:30:4f:24:aa:f1 emu10kx0: port 0x8400-0x841f irq 23 at device 7.0 on pci3 pcm0: on emu10kx0 pcm0: pci3: at device 7.1 (no driver attached) isab0: at device 31.0 on pci0 isa0: on isab0 atapci1: port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xf000-0xf00f at device 31.1 on pci0 ata0: on atapci1 ata1: on atapci1 atapci2: port 0xc000-0xc007,0xc400-0xc403,0xc800-0xc807,0xcc00-0xcc03,0xd000-0xd00f irq 18 at device 31.2 on pci0 ata4: on atapci2 ata5: on atapci2 pci0: at device 31.3 (no driver attached) pcm1: port 0xd800-0xd8ff,0xdc00-0xdc3f mem 0xf4201000-0xf42011ff,0xf4202000-0xf42020ff irq 17 at device 31.5 on pci0 pcm1: acpi_tz0: on acpi0 fdc0: port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0 fdc0: [FAST] fd0: <1440-KB 3.5" drive> on fdc0 drive 0 sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0 sio0: type 16550A ppc0: port 0x378-0x37f,0x778-0x77b irq 7 on acpi0 ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode ppbus0: on ppc0 plip0: on ppbus0 lpt0: on ppbus0 lpt0: Interrupt-driven port ppi0: on ppbus0 atkbdc0: port 0x60,0x64 irq 1 on acpi0 atkbd0: irq 1 on atkbdc0 kbd0 at atkbd0 atkbd0: [GIANT-LOCKED] pmtimer0 on isa0 orm0: at iomem 0xc0000-0xcbfff on isa0 sc0: at flags 0x100 on isa0 sc0: VGA <16 virtual consoles, flags=0x300> vga0: at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0 sio1: configured irq 3 not in bitmap of probed irqs 0 sio1: port may not be enabled ums0: Logitech USB-PS/2 Optical Mouse, rev 2.00/20.00, addr 2, iclass 3/1 ums0: 3 buttons and Z dir. Timecounter "TSC" frequency 3006831105 Hz quality 800 Timecounters tick every 1.000 msec ad0: 39205MB at ata0-master UDMA100 acd0: CDRW at ata1-master UDMA33 acd1: CDROM at ata1-slave PIO4 ad8: 152627MB at ata4-master SATA150 ad10: 238475MB at ata5-master SATA150 cd0 at ata1 bus 0 target 0 lun 0 cd0: Removable CD-ROM SCSI-0 device cd0: 33.000MB/s transfers cd0: Attempt to query device size failed: NOT READY, Medium not present cd1 at ata1 bus 0 target 1 lun 0 cd1: Removable CD-ROM SCSI-0 device cd1: 16.000MB/s transfers cd1: Attempt to query device size failed: NOT READY, Medium not present Trying to mount root from ufs:/dev/ad10s1a drm0: port 0xa000-0xa0ff mem 0xe0000000-0xe7ffffff,0xf1000000-0xf100ffff irq 16 at device 0.0 on pci1 info: [drm] AGP at 0xd8000000 128MB info: [drm] Initialized radeon 1.24.0 20060225 info: [drm] Setting GART location based on old memory map info: [drm] Loading R200 Microcode info: [drm] writeback test succeeded in 1 usecs kgdb output kgdb: kvm_nlist(_stopped_cpus): kgdb: kvm_nlist(_stoppcbs): [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"] GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd". Unread portion of the kernel message buffer: Fatal trap 12: page fault while in kernel mode fault virtual address = 0xf7468080 fault code = supervisor read, page not present instruction pointer = 0x20:0xc06cbca9 stack pointer = 0x28:0xf73feb7c frame pointer = 0x28:0xf73feb94 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 1113 (kdm-bin_greet) panic: from debugger Uptime: 6m18s Dumping 1023 MB (2 chunks) chunk 0: 1MB (159 pages) ... ok chunk 1: 1023MB (261872 pages) 1007 991 975 959 943 927 911 895 879 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15 #0 doadump () at pcpu.h:165 165 __asm __volatile("movl %%fs:0,%0" : "=r" (td)); (kgdb) backtrace #0 doadump () at pcpu.h:165 #1 0xc0517322 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409 #2 0xc0517656 in panic (fmt=0xc06fb601 "from debugger") at /usr/src/sys/kern/kern_shutdown.c:565 #3 0xc0453d0b in db_panic (addr=-1066615639, have_addr=0, count=-1, modif=0xf73fe988 "") at /usr/src/sys/ddb/db_command.c:438 #4 0xc0453c84 in db_command (last_cmdp=0xc0758e84, cmd_table=0x0, aux_cmd_tablep=0xc072434c, aux_cmd_tablep_end=0xc0724350) at /usr/src/sys/ddb/db_command.c:350 #5 0xc0453d75 in db_command_loop () at /usr/src/sys/ddb/db_command.c:458 #6 0xc0455cbd in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_main.c:222 #7 0xc05344ef in kdb_trap (type=0, code=0, tf=0xf73feb3c) at /usr/src/sys/kern/subr_kdb.c:473 #8 0xc06d1477 in trap_fatal (frame=0xf73feb3c, eva=0) at /usr/src/sys/i386/i386/trap.c:828 #9 0xc06d1198 in trap_pfault (frame=0xf73feb3c, usermode=0, eva=4148592768) at /usr/src/sys/i386/i386/trap.c:745 #10 0xc06d0d26 in trap (frame= {tf_fs = -986841080, tf_es = -986841048, tf_ds = -146866136, tf_edi = 2, tf_esi = -986246384, tf_ebp = -146805868, tf_isp = -146805912, tf_ebx = 32, tf_edx = -986800128, tf_ecx = -986800128, tf_eax = -146374656, tf_trapno = 12, tf_err = 0, tf_eip = -1066615639, tf_cs = 32, tf_eflags = 2163202, tf_esp = -1772630016, tf_ss = -985862976}) at /usr/src/sys/i386/i386/trap.c:435 #11 0xc06bd41a in calltrap () at /usr/src/sys/i386/i386/exception.s:139 #12 0xc06cbca9 in pmap_allocpte (pmap=0xc5371310, va=4148592640, flags=2) at /usr/src/sys/i386/i386/pmap.c:1201 #13 0xc06ccc2f in pmap_enter (pmap=0xc5371310, va=134848512, m=0xc1c2bc38, prot=7 '\a', wired=0) at /usr/src/sys/i386/i386/pmap.c:1900 #14 0xc0677a24 in vm_fault (map=0xc5371250, vaddr=134848512, fault_type=2 '\002', fault_flags=8) at /usr/src/sys/vm/vm_fault.c:904 #15 0xc06d1091 in trap_pfault (frame=0xf73fed38, usermode=1, eva=134849552) at /usr/src/sys/i386/i386/trap.c:722 #16 0xc06d0bfb in trap (frame= {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = -1077943376, tf_esi = 1145, tf_ebp = -1077943640, tf_isp = -146805404, tf_ebx = 688756692, tf_edx = 0, tf_ecx = 0, tf_eax = 0, tf_trapno = 12, tf_err = 7, tf_eip = 688703985, tf_cs = 51, tf_eflags = 2163270, tf_esp = -1077943640, tf_ss = 59}) at /usr/src/sys/i386/i386/trap.c:334 #17 0xc06bd41a in calltrap () at /usr/src/sys/i386/i386/exception.s:139 #18 0x290cc9f1 in ?? () Previous frame inner to this frame (corrupt stack?) >How-To-Repeat: Set up kdm in /etc/ttys. In kde (or kdm greet menu) try to logout, shutdown or reboot the system. >Fix: >Release-Note: >Audit-Trail: >Unformatted: