From frank@exit.com  Sat Nov  7 20:20:45 1998
Received: from cassiopeia.caprica.com ([207.137.48.14])
          by hub.freebsd.org (8.8.8/8.8.8) with SMTP id UAA25041
          for <FreeBSD-gnats-submit@freebsd.org>; Sat, 7 Nov 1998 20:20:44 -0800 (PST)
          (envelope-from frank@exit.com)
Received: from exit.com by cassiopeia.caprica.com (8.6.10/95022701)
	id SAA29832; Sat, 7 Nov 1998 18:46:25 -0800
Received: (from frank@localhost) by exit.com (8.8.8/8.7.3) id UAA00898; Sat, 7 Nov 1998 20:00:02 -0800 (PST)
Message-Id: <199811080400.UAA00898@exit.com>
Date: Sat, 7 Nov 1998 20:00:02 -0800 (PST)
From: frank@exit.com
Reply-To: frank@exit.com
To: FreeBSD-gnats-submit@freebsd.org
Subject: panic: page fault in div_input().
X-Send-Pr-Version: 3.2

>Number:         8596
>Category:       kern
>Synopsis:       panic: page fault while using ping's record-route option
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    ru
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Nov  7 20:30:01 PST 1998
>Closed-Date:    Tue Jan 11 08:18:23 PST 2000
>Last-Modified:  Tue Jan 11 08:19:59 PST 2000
>Originator:     Frank Mayhar
>Release:        FreeBSD 2.2.7-STABLE i386
>Organization:
N/A
>Environment:

	Pentium 133, 64MB memory, user PPP connection to provider.

	FreeBSD-stable with bits up to last week or so.

	dmesg output:

Copyright (c) 1992-1998 FreeBSD Inc.
Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.

FreeBSD 2.2.7-STABLE #0: Fri Oct 23 19:05:52 PDT 1998
    frank@exit.com:/usr/src/sys/compile/TINKER
CPU: Pentium/P54C (132.63-MHz 586-class CPU)
  Origin = "GenuineIntel"  Id = 0x52c  Stepping=12
  Features=0x1bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8>
real memory  = 67108864 (65536K bytes)
avail memory = 63639552 (62148K bytes)
Probing for devices on PCI bus 0:
chip0 <Intel 82437FX PCI cache memory controller> rev 2 on pci0:0:0
chip1 <Intel 82371FB PCI-ISA bridge> rev 2 on pci0:7:0
chip2 <Intel 82371FB IDE interface> rev 2 on pci0:7:1
vga0 <Display device> rev 0 on pci0:9:0
ahc0 <Adaptec 2940 SCSI host adapter> rev 0 int a irq 11 on pci0:12:0
ahc0: aic7870 Wide Channel, SCSI Id=7, 16 SCBs
ahc0 waiting for scsi devices to settle
(ahc0:0:0): "MAXTOR LXT-340S 6.74" type 0 fixed SCSI 1
sd0(ahc0:0:0): Direct-Access 324MB (665154 512 byte sectors)
(ahc0:1:0): "TOSHIBA MK538FB 6061" type 0 fixed SCSI 2
sd1(ahc0:1:0): Direct-Access 1170MB (2396970 512 byte sectors)
(ahc0:2:0): "QUANTUM FIREBALL1080S 1Q09" type 0 fixed SCSI 2
sd2(ahc0:2:0): Direct-Access 1042MB (2134305 512 byte sectors)
ahc0: target 8 Tagged Queuing Device
(ahc0:8:0): "IBM DORS-32160W   !# WA3E" type 0 fixed SCSI 2
sd3(ahc0:8:0): Direct-Access 2063MB (4226725 512 byte sectors)
ahc0: target 9 Tagged Queuing Device
(ahc0:9:0): "QUANTUM XP32275W LXY4" type 0 fixed SCSI 2
sd4(ahc0:9:0): Direct-Access 2170MB (4445380 512 byte sectors)
ahc0: target 10 Tagged Queuing Device
(ahc0:10:0): "QUANTUM XP32275W LXY4" type 0 fixed SCSI 2
sd5(ahc0:10:0): Direct-Access 2170MB (4445380 512 byte sectors)
Probing for devices on the ISA bus:
vt0 at 0x60-0x6f irq 1 on motherboard
vt0: unkown s3, 80 col, color, 4 scr, mf2-kbd, [R3.20-b24]
ed0 at 0x320-0x33f irq 10 on isa
ed0: address 00:40:05:11:b2:70, type NE2000 (16 bit) 
sio0 at 0x3f8-0x3ff irq 4 on isa
sio0: type 16550A
sio1 at 0x2f8-0x2ff irq 3 on isa
sio1: type 16550A
qcam0 not found at 0x278
fdc0 at 0x3f0-0x3f7 irq 6 drq 2 on isa
fdc0: FIFO enabled, 8 bytes threshold
fd0: 1.44MB 3.5in
fd1: 1.2MB 5.25in
npx0 on motherboard
npx0: INT 16 interface
Intel Pentium F00F detected, installing workaround
ccd0-15: Concatenated disk drivers
IP packet filtering initialized, divert enabled, logging disabled


>Description:

	I was doing a "ping -R www.mbtrading.com" when my system crashed.
	I saved a dump of the crash.  The backtrace is:

		IdlePTD 21a000
		current pcb at 1ffc74
		panic: page fault
		#0  0xf0114103 in boot ()
		(kgdb) bt
		#0  0xf0114103 in boot ()
		#1  0xf01143d2 in panic ()
		#2  0xf01c54fa in trap_fatal ()
		#3  0xf01c4fbc in trap_pfault ()
		#4  0xf01c4c47 in trap ()
		#5  0xf01526c9 in div_input ()
		#6  0xf01572c9 in ip_output ()
		#7  0xf0158950 in rip_output ()
		#8  0xf0158f25 in rip_usrreq ()
		#9  0xf012b475 in old_send ()
		#10 0xf01292ca in sosend ()
		#11 0xf012bdc1 in sendit ()
		#12 0xf012bea0 in sendto ()
		#13 0xf01c5793 in syscall ()
		#14 0x17895 in ?? ()
		#15 0x1f6c in ?? ()
		#16 0x107e in ?? ()

	I'll keep the dump for a while; let me know if you need more
	information.

>How-To-Repeat:

	I don't know if this is repeatable.
>Fix:
>Release-Note:
>Audit-Trail:

From: Yeasah Pell <yeasah@apocalypse.org>
To: freebsd-gnats-submit@freebsd.org, frank@exit.com
Cc:  
Subject: Re: kern/8596: panic: page fault while using ping's record-route option
Date: Thu, 17 Jun 1999 21:32:04 -0400

 I have observed this (repeatably) on FreeBSD 3.2-RELEASE on a 64MB Pentium
 133. It fails on ed0, but succeeds on de0. (ed0 is an "external" interface
 to a cable modem, while de0 is a small LAN). 'ping -R' to any non-local
 address will panic. There are NAT and firewall rules involved, as well;
 a variation on the rc.firewall 'simple' type with ed0 as the public
 interface.
 
 ------- dmesg -------
 
 Copyright (c) 1992-1999 FreeBSD Inc.
 Copyright (c) 1982, 1986, 1989, 1991, 1993
 	The Regents of the University of California. All rights reserved.
 FreeBSD 3.2-RELEASE #4: Thu Jun 10 19:08:36 EDT 1999
     root@zorak.d00d.net:/usr/src/sys/compile/ZORAK
 Timecounter "i8254"  frequency 1193182 Hz
 Timecounter "TSC"  frequency 133637059 Hz
 CPU: Pentium/P54C (133.64-MHz 586-class CPU)
   Origin = "GenuineIntel"  Id = 0x52c  Stepping=12
   Features=0x1bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8>
 real memory  = 67108864 (65536K bytes)
 avail memory = 62783488 (61312K bytes)
 Preloaded elf kernel "kernel" at 0xc0260000.
 Probing for devices on PCI bus 0:
 chip0: <Intel 82439TX System Controller (MTXC)> rev 0x01 on pci0.0.0
 chip1: <Intel 82371AB PCI to ISA bridge> rev 0x01 on pci0.7.0
 ide_pci0: <Intel PIIX4 Bus-master IDE controller> rev 0x01 on pci0.7.1
 chip2: <Intel 82371AB Power management controller> rev 0x01 on pci0.7.3
 de0: <Digital 21041 Ethernet> rev 0x11 int a irq 10 on pci0.17.0
 de0: 21041 [10Mb/s] pass 1.1
 de0: address 00:20:18:50:02:f5
 Probing for PnP devices:
 Probing for devices on the ISA bus:
 sc0 on isa
 sc0: MDA/Hercules <16 virtual consoles, flags=0x0>
 ed0 at 0x240-0x25f irq 5 on isa
 ed0: address 00:40:05:1b:b1:22, type NE2000 (16 bit) 
 atkbdc0 at 0x60-0x6f on motherboard
 atkbd0 irq 1 on isa
 psm0 not found
 sio0 at 0x3f8-0x3ff irq 4 flags 0x10 on isa
 sio0: type 16550A
 wdc0 at 0x1f0-0x1f7 irq 14 on isa
 wdc0: unit 0 (wd0): <ST32140A>
 wd0: 2015MB (4127760 sectors), 4095 cyls, 16 heads, 63 S/T, 512 B/S
 fdc0 at 0x3f0-0x3f7 irq 6 drq 2 on isa
 fdc0: FIFO enabled, 8 bytes threshold
 fd0: 1.44MB 3.5in
 ppc0 at 0x378 irq 7 flags 0x40 on isa
 ppc0: Generic chipset (EPP/NIBBLE) in COMPATIBLE mode
 ppb0: IEEE1284 device found /NIBBLE
 Probing for PnP devices on ppbus0:
 ppbus0: <Hewlett-Packard HP LaserJet 5L/0101.03> HP ENHANCED PCL5,PJL
 lpt0: <generic printer> on ppbus 0
 lpt0: Interrupt-driven port
 lpt0: <generic printer> on ppbus 0
 lpt0: Interrupt-driven port
 vga0 at 0x3b0-0x3bb maddr 0xb0000 msize 32768 on isa
 npx0 on motherboard
 npx0: INT 16 interface
 de0: enabling 10baseT port
 Intel Pentium detected, installing workaround for F00F bug
 IP packet filtering initialized, divert enabled, rule-based forwarding enabled, logging disabled
 DUMMYNET initialized (990504)
 changing root device to wd0s1a
 WARNING: / was not properly dismounted
 de0: enabling 10baseT port
 

From: Jasper Wallace <jasper@ivision.co.uk>
To: freebsd-gnats-submit@freebsd.org
Cc: sysadmin@ivision.co.uk
Subject: Re: kern/8596: panic: page fault while using ping's% record-route
 option
Date: Mon, 15 Nov 1999 19:08:19 +0000 (BST)

 I've seen this too with 3.3-RELEASE.
 
 Unfortunatly all the 3.3 boxes we have are in use, so i didn't spend any
 time trying to diagnose it.
 
 the box has ipfw and dummynet, ed and mx ethernet cards.
 
 If someone wants to spend some time looking at the problem, i can do more
 testing etc...
 
 -- 
 Internet Vision          Internet Consultancy           Tel: 0171 589 4500
 60 Albert Court            & Web development            Fax: 0171 589 4522
 Prince Consort Road                                   vision@ivision.co.uk
 London SW7 2BE                                   http://www.ivision.co.uk/
 
 
State-Changed-From-To: open->feedback 
State-Changed-By: ru 
State-Changed-When: Mon Jan 10 10:47:10 PST 2000 
State-Changed-Why:  
Fixed in 4.0-CURRENT (src/sys/netinet/ip_output.c,v 1.96). 


Responsible-Changed-From-To: freebsd-bugs->ru 
Responsible-Changed-By: ru 
Responsible-Changed-When: Mon Jan 10 10:47:10 PST 2000 
Responsible-Changed-Why:  
MFC reminder. 
State-Changed-From-To: feedback->closed 
State-Changed-By: ru 
State-Changed-When: Tue Jan 11 08:18:23 PST 2000 
State-Changed-Why:  
Fixed in 3.4-STABLE (src/sys/netinet/ip_output.c,v 1.85.2.5). 
>Unformatted:
