kern/40407: panic: PG_ZERO page isn't zero-filled

[spz%NetBSD.org@localhost]

>Number:         40407
>Category:       kern
>Synopsis:       panic: PG_ZERO page isn't zero-filled
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jan 15 22:35:00 +0000 2009
>Originator:     S.P.Zeidler
>Release:        NetBSD 5.0_BETA 20090107
>Organization:
        TNF
>Environment:
System: NetBSD pkgbuild.netbsd.org 5.0_BETA NetBSD 5.0_BETA (PKGBUILD.SCHED_M2) 
#5: Thu Jan 15 15:08:51 UTC 2009 
spz@ADMIN:/chroots/netbsd-5/src/sys/arch/amd64/compile/obj/PKGBUILD.SCHED_M2 
amd64
Architecture: x86_64
Machine: amd64
>Description:
panic: PG_ZERO page isn't zero-filled
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80501105 cs 8 rflags 246 cr2  7f7ffd866000 cpl 6 
rsp ffff800070485910
Stopped in pid 1233.1 (pwd) at  netbsd:breakpoint+0x5:  leave

db{2}> bt
breakpoint() at netbsd:breakpoint+0x5
cpu_Debugger() at netbsd:cpu_Debugger+0x9
panic() at netbsd:panic+0x260
uvm_pagezerocheck() at netbsd:uvm_pagezerocheck+0x80
uvm_pagefree() at netbsd:uvm_pagefree+0x38c
pmap_update() at netbsd:pmap_update+0x75
pmap_destroy() at netbsd:pmap_destroy+0x16f
uvmspace_free() at netbsd:uvmspace_free+0xcc
uvm_proc_exit() at netbsd:uvm_proc_exit+0x9e
exit1() at netbsd:exit1+0x1c3
sys_exit() at netbsd:sys_exit+0x53
syscall() at netbsd:syscall+0xb6

db{2}> show page
PAGE 0xffffffff80501105:
  flags=8e00, pqflags=66d0<PRIVATE2,PRIVATE3,PRIVATE6,PRIVATE7>, wire_count=3654
4, pa=0x4850086a58906666
  uobject=0x10ff88948906666, uanon=0xc3c486f889906666, offset=0x10b89001eb10 loa
n_count=36568
  [page ownership tracking disabled]

db{2}> sh reg
ds          0x58e0
es          0x7
fs          0x8
gs          0x58ae
rdi         0x6
rsi         0x3f8
rbp         0xffff800070485910
rbx         0xffff800070485930
rdx         0x8
rcx         0x6
rax         0x1
r8          0xffffffff809d2eea  copyright+0x887aa
r9          0x1
r10         0xffff800070485840
r11         0x8
r12         0x100
r13         0xffffffff80985c30  copyright+0x3b4f0
r14         0x1
r15         0x1
rip         0xffffffff80501105  breakpoint+0x5
cs          0x8
rflags      0x246
rsp         0xffff800070485910
ss          0x10
netbsd:breakpoint+0x5:  leave

db{2}> mach cpu 0
using CPU 0
db{2}> bt
_kernel_lock() at netbsd:_kernel_lock+0x135
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x16
Xintr_ioapic_level1() at netbsd:Xintr_ioapic_level1+0xf7
--- interrupt ---
_kernel_lock() at netbsd:_kernel_lock+0x13c
biodone2() at netbsd:biodone2+0x7b
biointr() at netbsd:biointr+0x3c
softint_dispatch() at netbsd:softint_dispatch+0xd3
DDB lost frame for netbsd:Xsoftintr+0x50, trying 0xffff80006c8cfd70
Xsoftintr() at netbsd:Xsoftintr+0x50
--- interrupt ---
0:
db{2}> sh reg
ds          0
es          0
fs          0
gs          0
rdi         0x6
rsi         0xffffffff804ecb66  intr_biglock_wrapper+0x16
rbp         0xffff80006c8cfb58
rbx         0x5fde13
rdx         0x6
rcx         0
rax         0
r8          0
r9          0
r10         0xffff80006c8cfc80
r11         0x8
r12         0x1
r13         0xffffffff80bbfcc0  cpu_info_primary
r14         0x6
r15         0xffff80006c34a3e0
rip         0xffffffff80409ec5  _kernel_lock+0x135
cs          0x8
rflags      0x297
rsp         0xffff80006c8cfb18
ss          0x10
netbsd:_kernel_lock+0x135:      movzbl  0x8808f4(%rip),%eax

db{2}> mach cpu 1
using CPU 1
db{2}> bt
splraise() at netbsd:splraise+0x8
ltsleep() at netbsd:ltsleep+0x70
rf_RaidIOThread() at netbsd:rf_RaidIOThread+0x16a
db{2}> sh reg
ds          0
es          0
fs          0
gs          0
rdi         0x8
rsi         0
rbp         0xffff80006ec4abd0
rbx         0
rdx         0xffffffff80955de0  copyright+0xb6a0
rcx         0
rax         0
r8          0xffff800007d29108
r9          0x1
r10         0
r11         0x8
r12         0
r13         0
r14         0x10
r15         0xffff800007d29108
rip         0xffffffff801157f8  splraise+0x8
cs          0x8
rflags      0x282
rsp         0xffff80006ec4aba8
ss          0
netbsd:splraise+0x8:    cmpl    %edi,%eax

db{2}> mach cpu 3
using CPU 3
db{2}> bt
uvm_pagealloc_strat() at netbsd:uvm_pagealloc_strat+0x16
uvmfault_promote() at netbsd:uvmfault_promote+0xfd
uvm_fault_internal() at netbsd:uvm_fault_internal+0x99e
trap() at netbsd:trap+0x875
uvm_fault(0xffffffff80c8bde0, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff80502feb cs 8 rflags 10247 cr2  b8 cpl 8 rsp 
ffff800070485300
kernel: page fault trap, code=0
Faulted in DDB; continuing...

There may be a dump soon.

>How-To-Repeat:
>Fix: