From owner-freebsd-current@FreeBSD.ORG Tue Dec 9 10:44:27 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9F6DD16A4CE for ; Tue, 9 Dec 2003 10:44:27 -0800 (PST) Received: from mail2.speakeasy.net (mail2.speakeasy.net [216.254.0.202]) by mx1.FreeBSD.org (Postfix) with ESMTP id 63D1243D2C for ; Tue, 9 Dec 2003 10:44:26 -0800 (PST) (envelope-from jhb@FreeBSD.org) Received: (qmail 9956 invoked from network); 9 Dec 2003 18:44:24 -0000 Received: from unknown (HELO server.baldwin.cx) ([216.27.160.63]) (envelope-sender )encrypted SMTP for ; 9 Dec 2003 18:44:24 -0000 Received: from laptop.baldwin.cx (gw1.twc.weather.com [216.133.140.1]) by server.baldwin.cx (8.12.9/8.12.9) with ESMTP id hB9IiLie069344; Tue, 9 Dec 2003 13:44:21 -0500 (EST) (envelope-from jhb@FreeBSD.org) Message-ID: X-Mailer: XFMail 1.5.4 on FreeBSD X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <3FD508A7.3010901@isometry.net> Date: Tue, 09 Dec 2003 13:44:22 -0500 (EST) From: John Baldwin To: Robin Breathe X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) cc: current@freebsd.org Subject: Re: Fatal trap 12: page fault while in kernel mode (subr_turnstile.c) w/ trace X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Dec 2003 18:44:27 -0000 On 08-Dec-2003 Robin Breathe wrote: > John Baldwin wrote: >> On 08-Dec-2003 Robin Breathe wrote: >>>I've been experiencing the following repeatable panic on recent >>>-CURRENT. This one is against RELENG_5_2, as of around 18:00 U‎T today. >>>Until now I've not been able to get a dump, but thankfully one's finally >>>come :) >> >> If you can reproduce the panic with INVARIANTS, it would be very useful >> to know which, if any, assertions it trips. > > Here's the output from DDB with INVARIANTS enabled, does it contain what > you need? > > I think I spotted the error in my ways on failing to use previous forced > dumps (it won't dump itself without my doing a 'call doadump' manually), > so I have both DDB and GDB output. Oof, you seem to have possibly hit a corrupted thread object. > (kgdb) l *0xc0537aa6 > 0xc0537aa6 is in turnstile_wait (/usr/src/sys/kern/subr_turnstile.c:439). > 434 td = curthread; > 435 tc = TC_LOOKUP(lock); > 436 mtx_assert(&tc->tc_lock, MA_OWNED); > 437 MPASS(td->td_turnstile != NULL); > 438 MPASS(owner != NULL); > 439 MPASS(owner->td_proc->p_magic == P_MAGIC); > 440 > 441 /* If the passed in turnstile is NULL, use this thread's > turnstile. */ > 442 if (ts == NULL) { > 443 ts = td->td_turnstile; > (kgdb) owner is not NULL, but it blew up trying to read owner->td_proc. Hmm, actually then, I think the owner pointer is bad. There was a while after one of the KSE commits when people would get panics with a thread whose td_proc was NULL, but I don't know if that bug was ever figured out or fixed. For owner to be wrong though, mtx_lock in the relevant mutex must have been corrupted somehow. -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve!" - http://www.FreeBSD.org/