From delphij@frontfree.net  Tue Jan  4 05:34:32 2005
Return-Path: <delphij@frontfree.net>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1B51816A55D
	for <FreeBSD-gnats-submit@freebsd.org>; Tue,  4 Jan 2005 05:34:32 +0000 (GMT)
Received: from mail.freebsd.org.cn (dns3.freebsd.org.cn [61.129.66.75])
	by mx1.FreeBSD.org (Postfix) with SMTP id B5DE743D39
	for <FreeBSD-gnats-submit@freebsd.org>; Tue,  4 Jan 2005 05:34:22 +0000 (GMT)
	(envelope-from delphij@frontfree.net)
Received: (qmail 56387 invoked by uid 0); 4 Jan 2005 05:26:51 -0000
Received: from unknown (HELO beastie.frontfree.net) (219.239.99.7)
  by mail.freebsd.org.cn with SMTP; 4 Jan 2005 05:26:51 -0000
Received: from localhost (localhost.frontfree.net [127.0.0.1])
	by beastie.frontfree.net (Postfix) with ESMTP id 0376D1319C5;
	Tue,  4 Jan 2005 13:34:01 +0800 (CST)
Received: from beastie.frontfree.net ([127.0.0.1])
 by localhost (beastie.frontfree.net [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 01836-14; Tue,  4 Jan 2005 13:33:47 +0800 (CST)
Received: by beastie.frontfree.net (Postfix, from userid 1001)
	id A646A13195D; Tue,  4 Jan 2005 13:33:45 +0800 (CST)
Message-Id: <20050104053345.A646A13195D@beastie.frontfree.net>
Date: Tue,  4 Jan 2005 13:33:45 +0800 (CST)
From: hunreal@gmail.com
Reply-To: hunreal@gmail.com
To: FreeBSD-gnats-submit@freebsd.org
Cc: delphij@freebsd.org
Subject: [backtrace] [5.3R panic] under heavy load
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         75780
>Category:       kern
>Synopsis:       [panic] panic: vm_page_free: freeing wired page (with backtrace)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jan 04 05:40:21 GMT 2005
>Closed-Date:    Sun Mar 02 02:10:53 UTC 2008
>Last-Modified:  Sun Mar 02 02:10:53 UTC 2008
>Originator:     hunreal@gmail.com
>Release:        FreeBSD 5.3-RELEASE
>Organization:
>Environment:
System: FreeBSD hshh.org 5.3-RELEASE FreeBSD 5.3-RELEASE #0: Mon Jan  3 10:29:52 CST 2005     root@hshh.org:/usr/obj/usr/src/sys/hshh  i386

>Description:
	FreeBSD 5.3-RELEASE panics under heavy load (Under SMP case) with the following panic message:

panic: vm_page_free: freeing wired page
cpuid = 0
boot() called on cpu#0
>How-To-Repeat:
	I have installed Apache 1.3.33, MySQL 3.23.58, and PHP 4.3.10 from ports, and zeus.
	Not sure how to reproduce the issue.
>Fix:

	Notyet.

--- bt begins here ---
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
doadump () at pcpu.h:159
(kgdb) bt full
#0  doadump () at pcpu.h:159
No locals.
#1  0xc04e121c in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:397
	first_buf_printf = 1
#2  0xc04e1614 in panic (fmt=0xc0678ea4 "vm_page_free: freeing wired page") at /usr/src/sys/kern/kern_shutdown.c:553
	td = (struct thread *) 0xc24fbaf0
	bootopt = 260
	newpanic = 0
	ap = 0xc24fbaf0 "\020|P\033"
	buf = "vm_page_free: freeing wired page", '\0' <repeats 223 times>
#3  0xc060334c in vm_page_free_toq (m=0xc1ae51a0) at /usr/src/sys/vm/vm_page.c:1042
	pq = (struct vpgqueues *) 0xc30d3630
	object = 0xc30d3630
#4  0xc06026b2 in vm_page_free (m=0xc1ae51a0) at /usr/src/sys/vm/vm_page.c:391
No locals.
#5  0xc060166c in vm_object_backing_scan (object=0xc3877420, op=4) at /usr/src/sys/vm/vm_object.c:1513
	pp = 0x0
	r = 1
	p = 0xc1ae51a0
	backing_object = 0xc30d3630
	backing_offset_index = 0
#6  0xc060190a in vm_object_collapse (object=0xc3877420) at /usr/src/sys/vm/vm_object.c:1623
	backing_object = 0xc30d3630
#7  0xc05ff2d8 in vm_object_deallocate (object=0xc3877420) at /usr/src/sys/vm/vm_object.c:532
	robject = 0xc3877420
	temp = 0xc3877420
#8  0xc05faf78 in vm_map_entry_delete (map=0xc4d95708, entry=0xc2663aa0) at /usr/src/sys/vm/vm_map.c:2203
	object = 0xc30d3630
	offidxstart = 0
	offidxend = 120
	count = 120
#9  0xc05fb1ec in vm_map_delete (map=0xc4d95708, start=3234030180, end=3217031168) at /usr/src/sys/vm/vm_map.c:2296
	next = 0xc0c36264
	entry = 0xc2663aa0
	first_entry = 0xc4d95708
#10 0xc05fb265 in vm_map_remove (map=0xc4d95708, start=0, end=3217031168) at /usr/src/sys/vm/vm_map.c:2315
	result = 0
#11 0xc04c4691 in exit1 (td=0xc24fbaf0, rv=0) at vm_map.h:211
	new_switchtime = {sec = 136577024, frac = 16651897980115834632}
	p = (struct proc *) 0xc27ce710
	nq = (struct proc *) 0xc06b42a0
	q = (struct proc *) 0xc4d95708
	tp = (struct tty *) 0xc20e6400
	ttyvp = (struct vnode *) 0xc20e6400
	vm = (struct vmspace *) 0xc4d95708
	vtmp = (struct vnode *) 0xc4d95708
	plim = (struct plimit *) 0xc4d95708
	refcnt = 0
#12 0xc04c3ebd in sys_exit (td=0x0, uap=0x0) at /usr/src/sys/kern/kern_exit.c:94
No locals.
#13 0xc0640ad0 in syscall (frame=
      {tf_fs = 137166895, tf_es = 47, tf_ds = 47, tf_edi = -1077942128, tf_esi = -1077942032, tf_ebp = 8, tf_isp = -417895052, tf_ebx = -1077942096, tf_edx = 675065880, tf_ecx = 6, tf_eax = 1, tf_trapno = 12, tf_err = 2, tf_eip = 673991608, tf_cs = 31, tf_eflags = 662, tf_esp = -1077942244, tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1001
	params = 0xbfbfe820 <Address 0xbfbfe820 out of bounds>
	callp = (struct sysent *) 0xc068e268
	td = (struct thread *) 0xc24fbaf0
	p = (struct proc *) 0xc27ce710
	orig_tf_eflags = 662
	sticks = 0
	error = 0
	narg = 1
	args = {0, 12, 0, 0, -1032001776, 671547904, -417895108, 0}
	code = 1
#14 0xc062b45f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:201
No locals.
#15 0x082d002f in ?? ()
No symbol table info available.
#16 0x0000002f in ?? ()
No symbol table info available.
#17 0x0000002f in ?? ()
No symbol table info available.
#18 0xbfbfe890 in ?? ()
No symbol table info available.
#19 0xbfbfe8f0 in ?? ()
No symbol table info available.
#20 0x00000008 in ?? ()
No symbol table info available.
#21 0xe7176d74 in ?? ()
No symbol table info available.
#22 0xbfbfe8b0 in ?? ()
No symbol table info available.
#23 0x283cb018 in ?? ()
No symbol table info available.
#24 0x00000006 in ?? ()
No symbol table info available.
#25 0x00000001 in ?? ()
No symbol table info available.
#26 0x0000000c in ?? ()
No symbol table info available.
#27 0x00000002 in ?? ()
No symbol table info available.
#28 0x282c4bb8 in ?? ()
No symbol table info available.
#29 0x0000001f in ?? ()
No symbol table info available.
#30 0x00000296 in ?? ()
No symbol table info available.
#31 0xbfbfe81c in ?? ()
No symbol table info available.
#32 0x0000002f in ?? ()
No symbol table info available.
#33 0x00000000 in ?? ()
No symbol table info available.
#34 0x00000000 in ?? ()
No symbol table info available.
#35 0x00000000 in ?? ()
No symbol table info available.
#36 0x00000000 in ?? ()
No symbol table info available.
#37 0x2863c000 in ?? ()
No symbol table info available.
#38 0xc27ce710 in ?? ()
No symbol table info available.
#39 0xc24fbaf0 in ?? ()
No symbol table info available.
#40 0xe7176ad0 in ?? ()
No symbol table info available.
#41 0xe7176ab4 in ?? ()
No symbol table info available.
#42 0xc1e78320 in ?? ()
No symbol table info available.
#43 0xc04f6010 in sched_switch (td=0xbfbfe8f0, newtd=0xbfbfe8b0, flags=) at /usr/src/sys/kern/sched_4bsd.c:865
	kg = (struct ksegrp *) 0x0
	p = (struct proc *) 0xbfbfe890
(kgdb) 
--- bt ends here ---


>Release-Note:
>Audit-Trail:

From: Unreal HSHH <hunreal@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Cc:  
Subject: Re: kern/75780: [backtrace] [5.3R panic] panic: vm_page_free: freeing wired page
Date: Fri, 18 Feb 2005 13:10:00 +0800

 It must be cause by Zeus Web Server+php+mysql.
 But all work fine in 5.2.1 Box,only panic in 5.3R or 5-STABLE.

From: Kris Kennaway <kris@obsecurity.org>
To: freebsd-gnats-submit@FreeBSD.org
Cc:  
Subject: Re: kern/75780: [backtrace] [5.3R panic] panic: vm_page_free: freeing wired page
Date: Fri, 8 Apr 2005 18:05:42 -0700

 Adding to audit trail
 
 ----- Forwarded message from Unreal HSHH <hunreal@gmail.com> -----
 
 X-Original-To: kkenn@localhost
 Delivered-To: kkenn@localhost.obsecurity.org
 Delivered-To: kris@freebsd.org
 Date: Mon, 28 Feb 2005 14:06:05 +0800
 From: Unreal HSHH <hunreal@gmail.com>
 Subject: Re: kern/75780: [backtrace] [5.3R panic] panic: vm_page_free: freeing
  wired page
 In-reply-to: <20050219024736.GB86942@xor.obsecurity.org>
 To: Kris Kennaway <kris@obsecurity.org>
 Cc: delphij@delphij.net, freebsd-bugs@freebsd.org
 Reply-To: Unreal HSHH <hunreal@gmail.com>
 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;        s=beta; d=gmail.com;
  h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references;
  b=KwUKqbKRgziZtlVDYqC6WKBvHLl3MhM6BDfpAqhuc7zcSd2Ri3kLsXariyzEBMWGc7G674DzQHAS8JW3t3cdzFXWsY8qTC2X1vh764innxpzTI3mDdoJe0+yPp7v0JeH4dK9vdhSmFv123Lg/CAXr7NHy5VPTWdqVb99ZDrRxOA=
 X-UIDL: >29"!I6<"!W7S"!h$i"!
 X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=0.92.8
 
 Hi,
 I tried disable mpsafenet and SACK, but the panic still apear.
 
 
 On Fri, 18 Feb 2005 18:47:36 -0800, Kris Kennaway <kris@obsecurity.org> wrote:
 > On Fri, Feb 18, 2005 at 02:59:15PM +0800, Unreal HSHH wrote:
 > > yes, I am sure the problem exists with the latest 5-STABLE (make
 > > world/kernel on the day before yesterday).
 > > All settings are keep default.
 > 
 > What about when you disable mpsafenet and SACK, as suggested?
 > 
 > In /boot/loader.conf:
 > 
 > debug.mpsafenet=0
 > net.inet.tcp.sack.enable=0
 > 
 > Kris
 > 
 > 
 >
 
 
 ----- End forwarded message -----
State-Changed-From-To: open->feedback 
State-Changed-By: kmacy 
State-Changed-When: Mon Nov 19 08:21:55 UTC 2007 
State-Changed-Why:  

Does this occur with RELENG_6/7? Were you using ZERO_COPY_SOCKETS? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=75780 
State-Changed-From-To: feedback->closed 
State-Changed-By: linimon 
State-Changed-When: Sun Mar 2 02:10:37 UTC 2008 
State-Changed-Why:  
Feedback timeout (> 6 months). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=75780 
>Unformatted:
