freebsd stable - Dec 2005 - panic logging out on serial console

Hi,

I had been logged in on serial console and typed 'exit' and the
RELENG_6 machine went *kaboom*. I hadn't seen sth like this befire on
any of my other machines:

i386/RELENG_6 from around 2005-11-17 11:00 UTC.

--- 8< 8< 8< ---
foo# exit
logout


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0x0
stack pointer           = 0x28:0xef699954
frame pointer           = 0x28:0xef699968
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 70703 (getty)
trap number             = 12
panic: page fault
Uptime: 5d21h1m43s
Dumping 1022 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 1023MB (261680 pages) 1007 991 975 959 943 927 911 895 879 863 847
83
1 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 527
303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15 ... ok

Dump complete
Automatic reboot in 15 seconds - press a key on the console to abort
Rebooting...
--- 8< 8< 8< ---


I have the core file and can save it for some days but it won't
help a lot unless someone tells me how I can skip the frame with
the null pointer in kgdb.


-- 
Bjoern A. Zeeb				bzeeb at Zabbadoz dot NeT

On Mon, 2005-12-05 at 11:47 +0000, Bjoern A. Zeeb wrote:
> I had been logged in on serial console and typed 'exit' and the
> RELENG_6 machine went *kaboom*. I hadn't seen sth like this befire on
> any of my other machines:
> 
> i386/RELENG_6 from around 2005-11-17 11:00 UTC.
> 
> --- 8< 8< 8< ---
> foo# exit
> logout
> 
> Fatal trap 12: page fault while in kernel mode
> fault virtual address   = 0x0
> fault code              = supervisor read, page not present
> instruction pointer     = 0x20:0x0
> stack pointer           = 0x28:0xef699954
> frame pointer           = 0x28:0xef699968
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                          = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 70703 (getty)
> trap number             = 12
> panic: page fault
> 
> I have the core file and can save it for some days but it won't
> help a lot unless someone tells me how I can skip the frame with
> the null pointer in kgdb.
I've never had a problem with backtraces (even when IP=0x0) but don't
forget you can always look at the stack with

(gdb) x/40xw 0xef699954

And then look for addresses that may be within the kernel (probably
start with 0xc)

I'd be interested to know if there is a possibilituy that your panic may
have anything to do with one that I saw
http://lists.freebsd.org/pipermail/freebsd-current/2004-December/043944.html
which seems to be a race in the tty closedown code (which I guess may
also be executed during a logout)

Gavin