From owner-freebsd-bugs Mon Dec 10 11:40:22 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 9826E37B41E for ; Mon, 10 Dec 2001 11:40:06 -0800 (PST) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id fBAJe6Y17898; Mon, 10 Dec 2001 11:40:06 -0800 (PST) (envelope-from gnats) Received: from mail.otelo.de (mail.otelo.de [195.50.151.2]) by hub.freebsd.org (Postfix) with ESMTP id C83BF37B416; Mon, 10 Dec 2001 11:37:34 -0800 (PST) Message-Id: <20011210193720.DF0CB1510@c4007380.vebacom.de> Date: Mon, 10 Dec 2001 20:37:20 +0100 (CET) From: Stefan Esser Reply-To: Stefan.Esser@Arcor.Net To: FreeBSD-gnats-submit@freebsd.org Cc: , stefan.esser@o-tel-o.de Subject: kern/32681: Reproducable PANIC in -stable and .current Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 32681 >Category: kern >Synopsis: Reproducable PANIC in -stable and .current >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Dec 10 11:40:01 PST 2001 >Closed-Date: >Last-Modified: >Originator: Stefan Esser >Release: FreeBSD 4.4-STABLE i386 / FreeBSD 5.0-CURRENT i386 >Organization: o.tel.o GmbH >Environment: System: FreeBSD current-host 5.0-CURRENT FreeBSD 5.0-CURRENT #1: Mon Dec 10 18:00:17 CET 2001 se@current-host:/usr/src/sys/i386/compile/TYAN i386 FreeBSD stable-host 4.4-STABLE FreeBSD 4.4-STABLE #6: Wed Dec 5 14:29:02 CET 2001 se@stable-host:/usr/src/sys/compile/TYAN i386 >Description: I've been suffering from panics during a security scan of a large company LAN. With nessus and 20 simultanous addresses being scanned, I get panics within minutes, which forced me to lower the parallelism to 5 addresses at a time (the whole network will be finished in about 4 years, at the current pace ;-) Since the operational system doing these scans is two hours of travel away, I decided to check, whether the same problem exists in -current on identical hardware at my location: it's there! Since I don't have access to the console of the remote -stable box, I did all my testing on a similar box running -current. The symptoms are identical: Trap 12 within minutes of running the latest nessus-devel (set to test 10 addresses in parallel). I've tried to identify the location of the fstatfs() call in nessusd, but did not find a single occurence. The source of problem appears to be a value of NULL resulting from: mp = ((struct vnode *)fp->f_data)->v_mount; which is dereferenced in the next progam line ... System log of the -current system (no SCSI drives, additional i4B, else identical to the -stable system): Copyright (c) 1992-2001 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 5.0-CURRENT #1: Mon Dec 10 18:00:17 CET 2001 se@server:/usr/src/sys/i386/compile/TYAN Preloaded elf kernel "/boot/kernel/kernel" at 0xc049d000. Timecounter "i8254" frequency 1193182 Hz CPU: Pentium II/Pentium II Xeon/Celeron (400.91-MHz 686-class CPU) Origin = "GenuineIntel" Id = 0x652 Stepping = 2 Features=0x183fbff real memory = 134217728 (131072K bytes) avail memory = 125427712 (122488K bytes) Programming 24 pins in IOAPIC #0 IOAPIC #0 intpin 2 -> irq 0 IOAPIC #0 intpin 16 -> irq 10 IOAPIC #0 intpin 18 -> irq 9 IOAPIC #0 intpin 19 -> irq 11 FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs cpu0 (BSP): apic id: 0, version: 0x00040011, at 0xfee00000 cpu1 (AP): apic id: 1, version: 0x00040011, at 0xfee00000 io0 (APIC): apic id: 2, version: 0x00170011, at 0xfec00000 Pentium Pro MTRR support enabled npx0: on motherboard npx0: INT 16 interface pcib0: at pcibus 0 on motherboard pci0: on pcib0 agp0: mem 0xf4000000-0xf7ffffff at device 0.0 on pci0 pcib1: at device 1.0 on pci0 pci1: on pcib1 pci1: at device 0.0 (no driver attached) isab0: at device 7.0 on pci0 isa0: on isab0 atapci0: port 0xffa0-0xffaf at device 7.1 on pci0 ata0: at 0x1f0 irq 14 on atapci0 ata1: at 0x170 irq 15 on atapci0 pci0: at device 7.2 (no driver attached) intpm0: port 0x440-0x44f irq 9 at device 7.3 on pci0 intpm0: I/O mapped 440 intpm0: intr IRQ 9 enabled revision 0 smbus0: on intsmb0 smb0: on smbus0 intpm0: PM I/O mapped 400 pcib2: at device 16.0 on pci0 pci2: on pcib2 fxp0: port 0xdf80-0xdf9f mem 0xfe600000-0xfe6fffff,0xf37ff000-0xf37fffff irq 9 at device 6.0 on pci2 fxp0: Ethernet address 00:90:27:14:c2:0d inphy0: on miibus0 inphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto isic0: port 0xdff4-0xdff7,0xdc00-0xdc7f mem 0xfe4fff80-0xfe4 fffff irq 11 at device 7.0 on pci2 isic0: passive stack unit 0 fxp1: port 0xef40-0xef5f mem 0xfea00000-0xfeafffff,0xfb8ff000-0xfb8fffff irq 11 at device 17.0 on pci0 fxp1: Ethernet address 00:e0:81:10:27:2a inphy1: on miibus1 inphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto ahc0: port 0xe400-0xe4ff mem 0xfebfe000-0xfebfefff irq 10 at device 18.0 on pci0 aic7895C: Ultra Wide Channel A, SCSI Id=7, 32/255 SCBs ahc1: port 0xe800-0xe8ff mem 0xfebff000-0xfebfffff irq 10 at device 18.1 on pci0 aic7895C: Ultra Wide Channel B, SCSI Id=7, 32/255 SCBs ata-: ata0 already exists, skipping it ata-: ata1 already exists, skipping it sc-: sc0 already exists, skipping it vga-: vga0 already exists, skipping it orm0: