Panic experienced in ng_snd_item

[Martha Pasikatan]

Hi,

The system panicked while I was running a program that uses netgraph heavily.  This is the panic that showed.

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x10
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xffffffff804fa6c4
stack pointer           = 0x10:0xffffffffa5641b30
frame pointer           = 0x10:0xffffffff9a6cb0a0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (swi4: clock sio)
trap number             = 12
panic: page fault


When I did list *0xffffffff804fa6c4, this is what appeared:
0xffffffff804fa6c4 is in ng_snd_item (/usr/src/sys/netgraph/ng_base.c:2172).
2167
2168    int
2169    ng_snd_item(item_p item, int flags)
2170    {
2171            hook_p hook = NGI_HOOK(item);
2172            node_p node = NGI_NODE(item);
2173            int queue, rw;
2174            struct ng_queue * ngq = &node->nd_input_queue;
2175            int error = 0;
2176

The backtrace shows
#0  doadump () at pcpu.h:172
#1  0x0000000000000004 in ?? ()
#2  0xffffffff804326f7 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#3  0xffffffff80432d91 in panic (fmt=0xffffff003dbbdbe0 "Xû=") at /usr/src/sys/kern/kern_shutdown.c:565
#4  0xffffffff8069726f in trap_fatal (frame=0xffffff003dbbdbe0, eva=18446742975233639256)
    at /usr/src/sys/amd64/amd64/trap.c:660
#5  0xffffffff8069758f in trap_pfault (frame=0xffffffffa5641a80, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:573
#6  0xffffffff80697843 in trap (frame=
      {tf_rdi = 0, tf_rsi = 0, tf_rdx = 582, tf_rcx = -1098475906080, tf_r8 = 1, tf_r9 = -1098475906080, tf_rax = 0, tf_rbx = 0, tf_rbp = -1704152928, tf_r10 = -2136924776, tf_r11 = 0, tf_r12 = 0, tf_r13 = 4, tf_r14 = 0, tf_r15 = -2142253296, tf_trapno = 12, tf_addr = 16, tf_flags = -1098475906080, tf_err = 0, tf_rip = -2142263612, tf_cs = 8, tf_rflags = 66178, tf_rsp = -1520166080, tf_ss = 0}) at /usr/src/sys/amd64/amd64/trap.c:352
#7  0xffffffff80682a2b in calltrap () at /usr/src/sys/amd64/amd64/exception.S:168
#8  0xffffffff804fa6c4 in ng_snd_item (item=0x0, flags=0) at /usr/src/sys/netgraph/ng_base.c:2170
#9  0xffffffff804423d5 in softclock (dummy=0x0) at /usr/src/sys/kern/kern_timeout.c:290
#10 0xffffffff80417e79 in ithread_loop (arg=0xffffff0000d0c960) at /usr/src/sys/kern/kern_intr.c:682
#11 0xffffffff80416617 in fork_exit (callout=0xffffffff80417d30 <ithread_loop>, arg=0xffffff0000d0c960, 
    frame=0xffffffffa5641c50) at /usr/src/sys/kern/kern_fork.c:821
#12 0xffffffff80682d8e in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:394

I was surprised to find the ng_send_item having a null item passed as a parameter.  I believe it can't have been a call from NG_FWD_ITEM because it checks for the validity of the parameters passed to it.  It is likely that the calling function was ng_callout_trampoline. 

Now, I'm at a loss as to where to proceed from here.  Does anyone have an idea or clue as to what is causing this?  Any help, suggestion, or advice is welcome.

Matt

       
---------------------------------
Be a better Globetrotter. Get better travel answers from someone who knows.
Yahoo! Answers - Check it out.