tcp_sack related panic

[Peter Avalos]

Fatal trap 12: page fault while in kernel mode
mp_lock = 00000000; cpuid = 0; lapic.id = 00000000
fault virtual address   = 0x4
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc0233d36
stack pointer           = 0x10:0xdaa45a70
frame pointer           = 0x10:0xdaa45a80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = Idle
current thread          = pri 12 
 <- SMP: XXX
trap number             = 12
panic: page fault
mp_lock = 00000000; cpuid = 0
boot() called on cpu#0
Uptime: 3d11h5m38s

dumping to dev #da/0x20001, blockno 378927

(kgdb) bt
#0  dumpsys () at ./machine/thread.h:83
#1  0xc01a2ea9 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:375
#2  0xc01a316c in panic (fmt=0xc033781c "%s") at /usr/src/sys/kern/kern_shutdown.c:800
#3  0xc0310a61 in trap_fatal (frame=0xdaa45a28, eva=<value optimized out>) at /usr/src/sys/platform/pc32/i386/trap.c:1102
#4  0xc0310b9b in trap_pfault (frame=0xdaa45a28, usermode=0, eva=4) at /usr/src/sys/platform/pc32/i386/trap.c:1003
#5  0xc0311198 in trap (frame=0xdaa45a28) at /usr/src/sys/platform/pc32/i386/trap.c:686
#6  0xc02fe396 in calltrap () at /usr/src/sys/platform/pc32/i386/exception.s:783
#7  0xc0233d36 in sack_block_lookup (scb=0xdace6b0c, seq=1554912228, sb=0xdaa45a90) at /usr/src/sys/netinet/tcp_sack.c:128
#8  0xc0233eda in tcp_sack_nextseg (tp=0xdace6a20, nextrexmt=0xdaa45ad0, plen=0xdaa45ad4, lostdup=0xdaa45acc) at /usr/src/sys/netinet/tcp_sack.c:496
#9  0xc022f603 in tcp_sack_rexmt (tp=0xdace6a20, th=<value optimized out>) at /usr/src/sys/netinet/tcp_input.c:3154
#10 0xc0231aca in tcp_input (m=0xee2c5a00) at /usr/src/sys/netinet/tcp_input.c:1981
#11 0xc0229ae2 in transport_processing_oncpu (m=0xee2c5a00, hlen=20, ip=<value optimized out>, nexthop=0x0) at /usr/src/sys/netinet/ip_input.c:391
#12 0xc022bae0 in ip_input (m=0xee2c5a00) at /usr/src/sys/netinet/ip_input.c:1092
#13 0xc022bbb4 in ip_input_handler (msg0=0xee2c5a18) at /usr/src/sys/netinet/ip_input.c:421
#14 0xc0235653 in tcpmsg_service_loop (dummy=0x0) at /usr/src/sys/netinet/tcp_subr.c:385
#15 0xc01a9fa5 in lwkt_deschedule_self (td=Cannot access memory at address 0x8
) at /usr/src/sys/kern/lwkt_thread.c:214
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

# uname -a
DragonFly ylem.theshell.com 1.11.0-DEVELOPMENT DragonFly 1.11.0-DEVELOPMENT #11: Mon Jan 28 18:13:59 EST 2008     root at ylem.theshell.com:/usr/obj/usr/src/sys/YLEM  i386

Attachment:
pgp00000.pgp
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pgp00000.pgp
Type: application/octet-stream
Size: 197 bytes
Desc: "Description: PGP signature"
URL: <http://lists.dragonflybsd.org/pipermail/bugs/attachments/20080202/8fdbfafa/attachment-0021.obj>