root@:/usr/obj/usr/src/sys/GENERIC # kgdb kernel.debug /var/crash/vmcore.1 GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty"for details. This GDB was configured as "amd64-marcel-freebsd"...
Unread portion of the kernel message buffer:
Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0x18 fault code = supervisor read data, page not present instruction pointer = 0x20:0xffffffff809959f0 stack pointer = 0x28:0xfffffe00003fd300 frame pointer = 0x28:0xfffffe00003fd340 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 0 (em0 taskq) trap number = 12 panic: page fault cpuid = 0 KDB: stack backtrace: #00xffffffff80963000 at kdb_backtrace+0x60 #10xffffffff80928125 at panic+0x155 #20xffffffff80d24f1f at trap_fatal+0x38f #30xffffffff80d25238 at trap_pfault+0x308 #40xffffffff80d2489a at trap+0x47a #50xffffffff80d0a782 at calltrap+0x8 #60xffffffff80b091ed at sctp6_ctlinput+0xbd #70xffffffff80ade0a5 at icmp6_input+0x1bf5 #80xffffffff80af2b0c at ip6_input+0x5cc #90xffffffff809f44e2 at netisr_dispatch_src+0x62 #100xffffffff809eb996 at ether_demux+0x126 #110xffffffff809ec63e at ether_nh_input+0x35e #120xffffffff809f44e2 at netisr_dispatch_src+0x62 #130xffffffff804de3d9 at lem_rxeof+0x489 #140xffffffff804ddbb1 at lem_handle_rxtx+0x31 #150xffffffff80971475 at taskqueue_run_locked+0xe5 #160xffffffff80971f08 at taskqueue_thread_loop+0xa8 #170xffffffff808f8b6a at fork_exit+0x9a Uptime: 53m18s Dumping 63 out of 232 MB:..26%..51%..76%
Reading symbols from /boot/kernel/uhid.ko.symbols...done. Loaded symbols for /boot/kernel/uhid.ko.symbols #0 doadump (textdump=<value optimized out>) at pcpu.h:219 219 __asm("movq %%gs:%1,%0" : "=r" (td) (kgdb)
(kgdb) bt #0 doadump (textdump=<value optimized out>) at pcpu.h:219 #10xffffffff80927da2 in kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:452 #20xffffffff80928164 in panic (fmt=<value optimized out>) at /usr/src/sys/kern/kern_shutdown.c:759 #30xffffffff80d24f1f in trap_fatal (frame=<value optimized out>, eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:865 #40xffffffff80d25238 in trap_pfault (frame=0xfffffe00003fd250, usermode=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:676 #50xffffffff80d2489a in trap (frame=0xfffffe00003fd250) at /usr/src/sys/amd64/amd64/trap.c:440 #60xffffffff80d0a782 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:232 #70xffffffff809959f0 in m_copydata (m=<value optimized out>, off=<value optimized out>, len=<value optimized out>, cp=<value optimized out>) at /usr/src/sys/kern/uipc_mbuf.c:884 #80xffffffff80b091ed in sctp6_ctlinput (cmd=8, pktdst=0xfffffe00003fd4f0, d=0xfffffe00003fd4a8) at /usr/src/sys/netinet6/sctp6_usrreq.c:409 #90xffffffff80ade0a5 in icmp6_input (mp=<value optimized out>, offp=<value optimized out>, proto=<value optimized out>) at /usr/src/sys/netinet6/icmp6.c:1176 #100xffffffff80af2b0c in ip6_input (m=0xfffff80002a61d00) at /usr/src/sys/netinet6/ip6_input.c:1019 #110xffffffff809f44e2 in netisr_dispatch_src (proto=<value optimized out>, source=<value optimized out>, m=0x0) at /usr/src/sys/net/netisr.c:972 #120xffffffff809eb996 in ether_demux (ifp=<value optimized out>, m=0xfffff80002a61d00) at /usr/src/sys/net/if_ethersubr.c:851 #130xffffffff809ec63e in ether_nh_input (m=<value optimized out>) at /usr/src/sys/net/if_ethersubr.c:646 #140xffffffff809f44e2 in netisr_dispatch_src (proto=<value optimized out>, source=<value optimized out>, m=0x0) at /usr/src/sys/net/netisr.c:972 #150xffffffff804de3d9 in lem_rxeof (count=<value optimized out>) at /usr/src/sys/dev/e1000/if_lem.c:3824 #160xffffffff804ddbb1 in lem_handle_rxtx (context=0xfffffe00007df000, pending=<value optimized out>) at /usr/src/sys/dev/e1000/if_lem.c:1440 #170xffffffff80971475 in taskqueue_run_locked (queue=0xfffff800023f0300) at /usr/src/sys/kern/subr_taskqueue.c:342 #180xffffffff80971f08 in taskqueue_thread_loop (arg=<value optimized out>) at /usr/src/sys/kern/subr_taskqueue.c:563 #190xffffffff808f8b6a in fork_exit (callout=0xffffffff80971e60 <taskqueue_thread_loop>, arg=0xfffffe00007e1830, frame=0xfffffe00003fdac0) at /usr/src/sys/kern/kern_fork.c:996 #200xffffffff80d0acbe in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:606 #210x0000000000000000 in ?? () Current language: auto; currently minimal (kgdb)
/* * Copy data from an mbuf chain starting "off" bytes from the beginning, * continuing for "len" bytes, into the indicated buffer. */ void m_copydata(conststruct mbuf *m, int off, int len, caddr_t cp) { u_int count;
KASSERT(off >= 0, ("m_copydata, negative off %d", off)); KASSERT(len >= 0, ("m_copydata, negative len %d", len)); while (off > 0) { KASSERT(m != NULL, ("m_copydata, offset > size of mbuf chain"));//第一个m的assert if (off < m->m_len) break; off -= m->m_len; m = m->m_next; } while (len > 0) { //884行 KASSERT(m != NULL, ("m_copydata, length > size of mbuf chain")); //885行 //这里以下不重要 //这里以下不重要 count = min(m->m_len - off, len); bcopy(mtod(m, caddr_t) + off, cp, count); len -= count; cp += count; off = 0; m = m->m_next; } }
(kgdb) f 8 #80xffffffff80b091ed in sctp6_ctlinput (cmd=8, pktdst=0xfffffe00003fd4f0, d=0xfffffe00003fd4a8) at /usr/src/sys/netinet6/sctp6_usrreq.c:409 409 m_copydata(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(sh),
if (pktdst->sa_family != AF_INET6 || pktdst->sa_len != sizeof(struct sockaddr_in6)) return;
if ((unsigned)cmd >= PRC_NCMDS) return; if (PRC_IS_REDIRECT(cmd)) { d = NULL; } elseif (inet6ctlerrmap[cmd] == 0) { return; } /* if the parameter is from icmp6, decode it. */ if (d != NULL) { ip6cp = (struct ip6ctlparam *)d; } else { ip6cp = (struct ip6ctlparam *)NULL; }
if (ip6cp) { /* * XXX: We assume that when IPV6 is non NULL, M and OFF are * valid. */ /* check if we can safely examine src and dst ports */ struct sctp_inpcb *inp = NULL; struct sctp_tcb *stcb = NULL; struct sctp_nets *net = NULL; struct sockaddr_in6 final;
