Fatal trap 12: page fault while in kernel mode (swi6: task queue)

[Barbara]

Can anyone help understanding the reason?

# uname -rsm
FreeBSD 6.4-STABLE i386


# kgdb kernel.debug /var/crash/vmcore.7 
GNU gdb 6.1.1 [FreeBSD]
Copyright 
2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU 
General Public License, and you are
welcome to change it and/or distribute 
copies of it under certain conditions.
Type "show copying" to see the 
conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for 
details.
This GDB was configured as "i386-marcel-freebsd"...

Unread portion of 
the kernel message buffer:
acd0: WARNING - PREVENT_ALLOW read data overrun 18>0

kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in 
kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x104
fault code		= 
supervisor read, page not present
instruction pointer	= 0x20:0xc0541da5
stack 
pointer	        = 0x28:0xe5928c00
frame pointer	        = 0x28:0xe5928c18
code 
segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 
1
processor eflags	= resume, IOPL = 0
current process		= 17 (swi6: task queue)

trap number		= 12
panic: page fault
cpuid = 0
Uptime: 4h16m22s
Physical memory: 
2031 MB
Dumping 204 MB: 189 173 157 141 125 109 93 77 61 45 29 13

Reading 
symbols from /boot/kernel/linux.ko...done.
Loaded symbols for 
/boot/kernel/linux.ko
Reading symbols from /boot/modules/nvidia.ko...done.

Loaded symbols for /boot/modules/nvidia.ko
Reading symbols from 
/boot/kernel/acpi.ko...done.
Loaded symbols for /boot/kernel/acpi.ko
Reading 
symbols from /boot/kernel/linprocfs.ko...done.
Loaded symbols for 
/boot/kernel/linprocfs.ko
Reading symbols from /boot/kernel/logo_saver.ko...
done.
Loaded symbols for /boot/kernel/logo_saver.ko
#0  doadump () at pcpu.h:
165
165		__asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt
#0  
doadump () at pcpu.h:165
#1  0xc054d7d9 in boot (howto=260) at 
/usr/src/sys/kern/kern_shutdown.c:410
#2  0xc054dba6 in panic (fmt=0xc0736cc9 "%
s") at /usr/src/sys/kern/kern_shutdown.c:566
#3  0xc071812c in trap_fatal 
(frame=0xe5928bc0, eva=0) at /usr/src/sys/i386/i386/trap.c:838
#4  0xc07177e4 
in trap (frame=
      {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -960560384, 
tf_esi = 4, tf_ebp = -443380712, tf_isp = -443380756, tf_ebx = -942867596, 
tf_edx = 6, tf_ecx = 4, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = 
-1068229211, tf_cs = 32, tf_eflags = 65538, tf_esp = -942867596, tf_ss = 0}) at 
/usr/src/sys/i386/i386/trap.c:270
#5  0xc06ff98a in calltrap () at 
/usr/src/sys/i386/i386/exception.s:139
#6  0xc0541da5 in _mtx_lock_sleep 
(m=0xc7ccfb74, tid=3334406912, opts=0, file=0x0, line=0) at 
/usr/src/sys/kern/kern_mutex.c:546
#7  0xc054ca79 in _sema_post 
(sema=0xc7ccfb74, file=0x0, line=0) at /usr/src/sys/kern/kern_sema.c:79
#8  
0xc04705e3 in ata_completed (context=0xc7ccfb28, dummy=1) at 
/usr/src/sys/dev/ata/ata-queue.c:481
#9  0xc057547d in taskqueue_run 
(queue=0xc6c8a000) at /usr/src/sys/kern/subr_taskqueue.c:257
#10 0xc0575793 in 
taskqueue_swi_run (dummy=0x0) at /usr/src/sys/kern/subr_taskqueue.c:299
#11 
0xc052ff1b in ithread_execute_handlers (p=0xc6bef860, ie=0xc6c44e80) at 
/usr/src/sys/kern/kern_intr.c:682
#12 0xc0530077 in ithread_loop 
(arg=0xc6c62510) at /usr/src/sys/kern/kern_intr.c:766
#13 0xc052e800 in 
fork_exit (callout=0xc0530010 <ithread_loop>, arg=0x1, frame=0x1) at 
/usr/src/sys/kern/kern_fork.c:788
#14 0xc06ff9ec in fork_trampoline () at 
/usr/src/sys/i386/i386/exception.s:208
(kgdb) frame 6
#6  0xc0541da5 in 
_mtx_lock_sleep (m=0xc7ccfb74, tid=3334406912, opts=0, file=0x0, line=0) at 
/usr/src/sys/kern/kern_mutex.c:546
546			owner = (struct thread *)(v & 
MTX_FLAGMASK);
(kgdb) list
541	#if defined(SMP) && !defined
(NO_ADAPTIVE_MUTEXES)
542			/*
543			 * If the current owner of the lock is 
executing on another
544			 * CPU, spin instead of blocking.
545			 */
546			
owner = (struct thread *)(v & MTX_FLAGMASK);
547	#ifdef ADAPTIVE_GIANT
548			if 
(TD_IS_RUNNING(owner)) {
549	#else
550			if (m != &Giant && TD_IS_RUNNING
(owner)) {