3.0 kernel crash (network related)

[Toni Mueller <openbsd-tech@oeko.net>]

Hello,

I tried to rsync the OBSD CVS tree to a new box. This froze the box
after about a minute or so, dropping it into ddb. It also happened
after a fresh reboot. So this imho accounts for reproducability.
Other than that I don't quite know where to look. Anyway, here is
what I scribbled off the screen:


panic: pool_get: mbpl: page empty
Stopped at _Debugger+0x4: leave

ddb> trace
_Debugger(0,e0595cb0,80,210,1401a8c0,e0901138,e9f25c18,e01b273f,e0162437,e01c3ddd,e0901100,e9r25c2c,90,e089be40,80,e9f25c3c,e01c8e6b,e0901154,e9f25c48,e014f257,e0595cb0,0,e08f2200,e9f25cec,e089fd00,e089be40,e962b800,e9f25cec,e02215fa,e0901100,e9f25c98,e014e6b8,e088a000,e089fd00,e962e824,4,e0867aa0,e0595cb0,e08f2200,e0863100,e088a040,800,e9f25c98,e0168ee7,40881000,e962b806,0,1,e088a040,e088a000,e9f25ca0,e0101a1d,e088a000,80,10,e0900010,e08f2200,e0959cb0,e9f25cf8,e089d700,10) at _Debugger+0x4
_panic(e01b2437,e01c3ddd,e0901100,e9f25c2c,90) at _panic+0x81
_pool_get(e0595cb0,0,e08f2200,e9f25cec,e089fd00) AT _pool_get+0x223
_fxp_add_rfabuf(e088a000,e089fd00,e962e824,4) at fxp_add_rfabuf+0x33
_fxp_intr(e088a000) at _fxp_intr+0x1e0
_Xrecurse10() at _Xrecurse10+0x79
---interrupt---
_pool_get(e0595cb0,0,80,4,e090b800) at _pool_get+0x2c6
_tcp_output(e08f2200,1,e9e77870,e9f25f24) at _tcp_output+0x8ef
_tcp_userreq(e0901100,8,0,e0863100,e9f25ed8,e01b93ee) at _tcp_userreq+0x46e
_soreceive(e0901100,0,e9f25ed8,0,0) at _soreceive+0xa80
_soo_read(e9e58738,e9e58754,e9f25ed8,e0882600,e9f25f88) at _soo_read+0x1f
_dofileread(e9e778870,5,e9e58738,dfbf9378,4000) at _dofileread+0x7d
_sys_read(e9e77870,e9f25f88,e9f25f80,400000c0,0) at _sys_read+0x44
_syscall() at _syscall+0x242
---syscall (number 3)---
0x401fcae7


ddb> ps
   PID  PPID   PGRP  UID S    FLAGS  WAIT      COMMAND
  4421 23731  23731    0 3   0x4084 select    rsync
 23731 28369  23731    0 3   0x4084 pause     sh
*28369  8134   8134    0 3      0x4           sshd
 31958 19435  31958 1000 3   0x4086 ttyin     sh
 19435  8134   8134    0 3    0x184 select    sshd
  1791  7526   1791    0 3   0x4086 ttyin     sh
  7526  8134   8134    0 3    0x184 select    sshd
 30379 14691  30371    0 3   0x4086 ttyin     sh
 14691  8134   8134    0 3    0x184 select    sshd
 23787     1  23787    0 3   0x4086 ttyin     getty
  3456     1   3456    0 3   0x4086 ttyin     getty
 19340     1  19340    0 3   0x4086 ttyin     getty
  3470     1   3470    0 3   0x4086 ttyin     getty
  2564     1   2564    0 3   0x4086 ttyin     getty
  3040     1   3040    0 3     0x84 nanosleep cron
  8134     1   8134    0 3     0x84 select    sshd
 29881     1  29881    0 2     0x84           syslogd
   920     1    920    0 3     0x84 poll      dhclient
     9     0      0    0 3 0x100204 usbevt    usb0
     8     0      0    0 3 0x100204 apmev     apm0
     7     0      0    0 3 0x100204 crypto_wa crypto
     6     0      0    0 3 0x100204 aiodoned  aiodoned
     5     0      0    0 3 0x100204 syncer    update
     4     0      0    0 3 0x100204 cleaner   cleaner
     3     0      0    0 3 0x100204 reaper    reaper
     2     0      0    0 3 0x100204 pgdaemon  pagedaemon
     1     0      1    0 3   0x4084 wait      init
     0    -1      0    0 3  0x80204 scheduler swapper
 25155  3040   3040    0 5   0x2000           cron



Phew! I should have been able to glean this from gdb and the
core instead of having to type until my hands hurt. If anyone
has some tips on how to do this (I was able to get a nice
collection of cores in the meantime :} ) please let me know.
(And hopefully I didn't mistype anything :|)

Thank you!

I also saw uvm_fault() crashes, also in poll_free(), in the
meantime, too...


Best,
--Toni++