panic: bufwrite: buffer is not busy???

[Gleb Smirnoff]

On Wed, Feb 02, 2011 at 12:30:20AM +0600, Eugene Grosbein wrote:
E> On 31.01.2011 14:20, Julian Elischer wrote:
E> 
E> > replace with:
E> > 
E> > 3504            if ((hook == NULL) ||
E> > 3505                NG_HOOK_NOT_VALID(hook) ||
E> >                      ((peer = NG_HOOK_PEER(hook)) == NULL) ||
E> > 3506                NG_HOOK_NOT_VALID(peer) ||
E> >                      ((peernode = NG_PEER_NODE(hook)) == NULL) ||
E> > 3507                NG_NODE_NOT_VALID(peernode)) {
E> >                          if (peer)
E> >                                kassert((peernode != NULL), ("peer node NULL wile peer hook exists"));
E> > 3508                    NG_FREE_ITEM(item);
E> 
E> This day I have updated panicing router to RELENG_8 and combined changes supposed
E> by Julian and Gleb. After 8 hours it has just paniced again and could not finish
E> to write crashdump again:
E> 
E> Fatal trap 12: page fault while in kernel mode
E> cpuid = 3; apic id = 06
E> fault virtual address   = 0x63
E> fault code              = supervisor read data, page not present
E> instruction pointer     = 0x20:0xffffffff803d4ccd
E> stack pointer           = 0x28:0xffffff80ebffc600
E> frame pointer           = 0x28:0xffffff80ebffc680
E> code segment            = base 0x0, limit 0xfffff, type 0x1b
E>                         = DPL 0, pres 1, long 1, def32 0, gran 1
E> processor eflags        = interrupt enabled, resume, IOPL = 0
E> current process         = 2390 (mpd5)
E> trap number             = 12
E> panic: page fault
E> cpuid = 3
E> Uptime: 8h3m51s
E> Dumping 4087 MB (3 chunks)
E>   chunk 0: 1MB (150 pages) ... ok
E>   chunk 1: 3575MB (915088 pages) 3559 3543panic: bufwrite: buffer is not busy???
E> cpuid = 3
E> Uptime: 8h3m52s
E> Automatic reboot in 15 seconds - press a key on the console to abort
E> 
E> # gdb kernel
E> GNU gdb 6.1.1 [FreeBSD]
E> Copyright 2004 Free Software Foundation, Inc.
E> GDB is free software, covered by the GNU General Public License, and you are
E> welcome to change it and/or distribute copies of it under certain conditions.
E> Type "show copying" to see the conditions.
E> There is absolutely no warranty for GDB.  Type "show warranty" for details.
E> This GDB was configured as "amd64-marcel-freebsd"...
E> (gdb) l *0xffffffff803d4ccd
E> 0xffffffff803d4ccd is in ng_pppoe_disconnect (netgraph.h:191).
E> 186                                     int line);
E> 187
E> 188     static __inline void
E> 189     _chkhook(hook_p hook, char *file, int line)
E> 190     {
E> 191             if (hook->hk_magic != HK_MAGIC) {
E> 192                     printf("Accessing freed hook ");
E> 193                     dumphook(hook, file, line);
E> 194             }
E> 195             hook->lastline = line;
E> (gdb) x/i 0xffffffff803d4ccd
E> 0xffffffff803d4ccd <ng_pppoe_disconnect+301>:   cmpl   $0x78573011,0x64(%rbx)

This looks like ng_pppoe_disconnect() was called with NULL argument.

Can you add KDB_TRACE option to kernel? Your boxes for some reason can't
dump core, but with this option we will have at least trace.

-- 
Totus tuus, Glebius.