From kargl@troutmask.apl.washington.edu Thu Mar 19 22:21:55 2009 Return-Path: Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 109BB106566B; Thu, 19 Mar 2009 22:21:55 +0000 (UTC) (envelope-from kargl@troutmask.apl.washington.edu) Received: from troutmask.apl.washington.edu (troutmask.apl.washington.edu [128.208.78.105]) by mx1.freebsd.org (Postfix) with ESMTP id E78108FC0A; Thu, 19 Mar 2009 22:21:54 +0000 (UTC) (envelope-from kargl@troutmask.apl.washington.edu) Received: from troutmask.apl.washington.edu (localhost.apl.washington.edu [127.0.0.1]) by troutmask.apl.washington.edu (8.14.3/8.14.3) with ESMTP id n2JMLsLR001452; Thu, 19 Mar 2009 15:21:54 -0700 (PDT) (envelope-from kargl@troutmask.apl.washington.edu) Received: (from kargl@localhost) by troutmask.apl.washington.edu (8.14.3/8.14.3/Submit) id n2JMLsXH001451; Thu, 19 Mar 2009 15:21:54 -0700 (PDT) (envelope-from kargl) Message-Id: <200903192221.n2JMLsXH001451@troutmask.apl.washington.edu> Date: Thu, 19 Mar 2009 15:21:54 -0700 (PDT) From: "Steven G. Kargl" Reply-To: "Steven G. Kargl" To: FreeBSD-gnats-submit@freebsd.org Cc: alc@freebsd.org Subject: panic: vm_page_free_toq: freeing mapped page X-Send-Pr-Version: 3.113 X-GNATS-Notify: >Number: 132827 >Category: kern >Synopsis: [vm] [panic] vm_page_free_toq: freeing mapped page >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: closed >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Mar 19 22:30:01 UTC 2009 >Closed-Date: Sat May 02 22:18:18 UTC 2009 >Last-Modified: Wed May 27 18:50:01 UTC 2009 >Originator: Steven G. Kargl >Release: FreeBSD 8.0-CURRENT amd64 >Organization: APL-UW >Environment: System: FreeBSD troutmask.apl.washington.edu 8.0-CURRENT FreeBSD 8.0-CURRENT #4: Mon Mar 16 15:46:09 PDT 2009 root@troutmask.apl.washington.edu:/usr/obj/usr/src/sys/SPEW amd64 >Description: panic: vm_page_free_toq: freeing mapped page 0xffffff01fe2bc980 cpuid = 1 Uptime: 2d0h34m41s Physical memory: 8117 MB Dumping 848 MB: 833 817 801 785 769 753 737 721 705 689 673 657 641 625 609 593 577 561 545 529 513 497 481 465 449 433 (CTRL-C to abort) 417 401 385 369 353 3 37 321 305 289 273 257 241 225 209 193 177 161 145 (CTRL-C to abort) 129 (CTRL- C to abort) 113 (CTRL-C to abort) 97 81 65 (CTRL-C to abort) 49 (CTRL-C to ab ort) (CTRL-C to abort) 33 17 (CTRL-C to abort) 1 #0 doadump () at pcpu.h:215 215 pcpu.h: No such file or directory. in pcpu.h (kgdb) bt #0 doadump () at pcpu.h:215 #1 0xffffffff802e9aea in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:420 #2 0xffffffff802e9f5c in panic (fmt=Variable "fmt" is not available.) at /usr/src/sys/kern/kern_shutdown.c:576 #3 0xffffffff804ccd5d in vm_page_free_toq (m=0xffffff01fe2bc980) at /usr/src/sys/vm/vm_page.c:1370 #4 0xffffffff804c9807 in vm_object_terminate (object=0xffffff017f6c0320) at /usr/src/sys/vm/vm_object.c:677 #5 0xffffffff804cb047 in vm_object_deallocate (object=0xffffff017f6c0320) at /usr/src/sys/vm/vm_object.c:589 #6 0xffffffff804c3700 in _vm_map_unlock (map=0xffffff012afaf180, file=Variable "file" is not available.) at /usr/src/sys/vm/vm_map.c:476 #7 0xffffffff804c3cbf in vm_map_remove (map=0xffffff012afaf180, start=Variable "start" is not available.) at /usr/src/sys/vm/vm_map.c:2596 #8 0xffffffff804c4b25 in vmspace_free (vm=0xffffff012afaf180) at /usr/src/sys/vm/vm_map.c:325 #9 0xffffffff804c5f26 in vmspace_exec (p=0xffffff000467b000, minuser=Variable "minuser" is not available.) at /usr/src/sys/vm/vm_map.c:3228 #10 0xffffffff802c5552 in exec_new_vmspace (imgp=0xffffffff23ff49f0, sv=0xffffffff8075d8c0) at /usr/src/sys/kern/kern_exec.c:1013 #11 0xffffffff8052ef1e in exec_elf32_imgact (imgp=0xffffffff23ff49f0) at imgact_elf.c:694 #12 0xffffffff802c59bb in kern_execve (td=0xffffff00046a06e0, args=0xffffffff23ff4af0, mac_p=Variable "mac_p" is not available.) at /usr/src/sys/kern/kern_exec.c:470 #13 0xffffffff802c681d in execve (td=0xffffff00046a06e0, uap=Variable "uap" is not available.) at /usr/src/sys/kern/kern_exec.c:203 #14 0xffffffff80502bed in syscall (frame=0xffffffff23ff4c80) at /usr/src/sys/amd64/amd64/trap.c:882 #15 0xffffffff804dfefb in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:338 #16 0x0000000200927c4c in ?? () >How-To-Repeat: Not sure how reproducible this problem is. It has occurred twice within the last 2 or 3 days. The 2nd panic occurred while I was in Xorg, running portupgrade on cmake, running an gmp/mpfr application, and *starting* linux's acroread. Perhaps, something is broken in the linuxalator. >Fix: >Release-Note: >Audit-Trail: From: "Steven G. Kargl" To: Alan Cox Cc: bug-followup@FreeBSD.org Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing mapped page Date: Fri, 1 May 2009 10:07:40 -0700 (PDT) Alan Cox wrote: > There has been no reported re-occurrence of this assertion failure since > the submitter removed ZERO_COPY_SOCKETS from his kernel configuration. Yes, that is correct. The panics stopped after removal of ZERO_COPY_SOCKETS. I'd suggest adding a big warning in the various NOTES files that ZERO_COPY_SOCKETS is broken. -- Steve http://troutmask.apl.washington.edu/~kargl/ From: Alan Cox To: bug-followup@FreeBSD.org, kargl@troutmask.apl.washington.edu Cc: Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing mapped page Date: Fri, 01 May 2009 11:46:44 -0500 There has been no reported re-occurrence of this assertion failure since the submitter removed ZERO_COPY_SOCKETS from his kernel configuration. From: Alan Cox To: "Steven G. Kargl" Cc: bug-followup@FreeBSD.org Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing mapped page Date: Fri, 01 May 2009 12:41:37 -0500 Steven G. Kargl wrote: > Alan Cox wrote: > >> There has been no reported re-occurrence of this assertion failure since >> the submitter removed ZERO_COPY_SOCKETS from his kernel configuration. >> > > Yes, that is correct. The panics stopped after removal of > ZERO_COPY_SOCKETS. I'd suggest adding a big warning in > the various NOTES files that ZERO_COPY_SOCKETS is broken. > > I will gladly commit appropriately frightening language. Send me a patch. :-) Alan State-Changed-From-To: open->closed State-Changed-By: alc State-Changed-When: Sat May 2 22:15:18 UTC 2009 State-Changed-Why: The crash was caused by the use of a buggy, experimental feature. http://www.freebsd.org/cgi/query-pr.cgi?pr=132827 From: "Steven G. Kargl" To: Alan Cox Cc: bug-followup@FreeBSD.org Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing mapped page Date: Wed, 27 May 2009 11:43:46 -0700 (PDT) Alan Cox wrote: > Steven G. Kargl wrote: > > Alan Cox wrote: > > > >> There has been no reported re-occurrence of this assertion failure since > >> the submitter removed ZERO_COPY_SOCKETS from his kernel configuration. > >> > > > > Yes, that is correct. The panics stopped after removal of > > ZERO_COPY_SOCKETS. I'd suggest adding a big warning in > > the various NOTES files that ZERO_COPY_SOCKETS is broken. > > > > > > I will gladly commit appropriately frightening language. Send me a > patch. :-) > Index: NOTES =================================================================== --- NOTES (revision 191256) +++ NOTES (working copy) @@ -930,7 +930,9 @@ # receiving data via a socket. The send side works for any type of NIC, # the receive side only works for NICs that support MTUs greater than the # page size of your architecture and that support header splitting. See -# zero_copy(9) for more details. +# zero_copy(9) for more details. This option is assocated with a rare, +# but possible, kernel panic in vm_page_free_toq(). See kern/132827 for +# additional details. options ZERO_COPY_SOCKETS -- Steve http://troutmask.apl.washington.edu/~kargl/ >Unformatted: