[Bug 296761] panic: vm_fault_lookup: fault on nofault entry - via zdb, lio_listio and geom_zero related
[email protected] Mon, 13 Jul 2026 22:37:16 +0000
| Newsgroups | gmane.os.freebsd.bugs |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296761
Bug ID: 296761
Summary: panic: vm_fault_lookup: fault on nofault entry - via
zdb, lio_listio and geom_zero related
Product: Base System
Version: 15.1-RELEASE
Hardware: amd64
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
FreeBSD 15.1-RELEASE-p1 releng/15.1-0f691888dc56
calling (as root) zdb -d zroot/whatever causes immediate kernel panic
#0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
#1 doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:399
#2 0xffffffff80bd3fe9 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:519
#3 0xffffffff80bd44f7 in vpanic (fmt=0xffffffff8123e88d "%s: fault on nofault
entry, addr: %#lx", ap=ap@entry=0xfffffe0089c0a700) at
/usr/src/sys/kern/kern_shutdown.c:974
#4 0xffffffff80bd4323 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:887
#5 0xffffffff80fb6f7e in vm_fault_lookup (fs=0xfffffe0089c0a7c0) at
/usr/src/sys/vm/vm_fault.c:953
#6 vm_fault (map=<optimized out>, vaddr=18446741876997402624, fault_type=1
'\001', fault_flags=<optimized out>, m_hold=m_hold@entry=0x0) at
/usr/src/sys/vm/vm_fault.c:1721
#7 0xffffffff80fb5581 in vm_fault_trap (map=<optimized out>, vaddr=<optimized
out>, fault_type=<optimized out>, fault_flags=<unavailable>,
fault_flags@entry=0, signo=0x0, ucode=0x0) at /usr/src/sys/vm/vm_fault.c:753
#8 0xffffffff81129e4c in trap_pfault (frame=0xfffffe0089c0a950,
usermode=false, signo=<unavailable>, ucode=<unavailable>) at
/usr/src/sys/amd64/amd64/trap.c:916
#9 <signal handler called>
#10 memmove_std () at /usr/src/sys/amd64/amd64/support.S:533
#11 0xffffffff8112b485 in uiomove_fromphys (ma=0xfffff80164241408,
offset=offset@entry=0, n=n@entry=4096, uio=uio@entry=0xfffffe0089c0aa98) at
/usr/src/sys/amd64/amd64/uio_machdep.c:117
#12 0xffffffff80b426c0 in g_zero_fill_pages (bp=0xfffff8000a2724e0) at
/usr/src/sys/geom/zero/g_zero.c:107
#13 g_zero_start (bp=0xfffff8000a2724e0) at /usr/src/sys/geom/zero/g_zero.c:124
#14 0xffffffff80adc4ec in g_io_request (bp=0xfffff8000a2724e0,
cp=0xfffff80004422e80) at /usr/src/sys/geom/geom_io.c:590
#15 0xffffffff80c9856f in aio_qbio (p=<optimized out>, job=0xfffff8007a378228)
at /usr/src/sys/kern/vfs_aio.c:1362
#16 aio_queue_file (fp=<optimized out>, job=job@entry=0xfffff8007a378228) at
/usr/src/sys/kern/vfs_aio.c:1792
#17 0xffffffff80c95e0e in aio_aqueue (td=td@entry=0xfffff8009efa7780,
ujob=0x3c7e7e86c930, lj=lj@entry=0xfffff8007a37b110, type=type@entry=0,
ops=ops@entry=0xffffffff81aecbf8 <aiocb_ops>) at
/usr/src/sys/kern/vfs_aio.c:1701
#18 0xffffffff80c964d5 in kern_lio_listio (td=td@entry=0xfffff8009efa7780,
mode=1, uacb_list=<optimized out>, acb_list=acb_list@entry=0xfffff8008b663920,
nent=nent@entry=4, sig=sig@entry=0x0, ops=0xffffffff81aecbf8 <aiocb_ops>) at
/usr/src/sys/kern/vfs_aio.c:2328
#19 0xffffffff80c9690a in sys_lio_listio (td=<optimized out>,
uap=0xfffff8009efa7ba8) at /usr/src/sys/kern/vfs_aio.c:2449
#20 0xffffffff8112a606 in syscallenter (td=0xfffff8009efa7780) at
/usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:193
#21 amd64_syscall (td=0xfffff8009efa7780, traced=0) at
/usr/src/sys/amd64/amd64/trap.c:1267
#22 <signal handler called>
#23 0x00003c7e4a7bfe7a in ?? ()
---
relevant full parts:
#10 memmove_std () at /usr/src/sys/amd64/amd64/support.S:533
No locals.
#11 0xffffffff8112b485 in uiomove_fromphys (ma=0xfffff80164241408,
offset=offset@entry=0, n=n@entry=4096, uio=uio@entry=0xfffffe0089c0aa98) at
/usr/src/sys/amd64/amd64/uio_machdep.c:117
vaddr = 18446735285212418048
td = 0xfffff8009efa7780
error = 0
save = <optimized out>
mapped = false
cp = <optimized out>
iov = <optimized out>
cnt = 4096
page_offset = <optimized out>
#12 0xffffffff80b426c0 in g_zero_fill_pages (bp=0xfffff8000a2724e0) at
/usr/src/sys/geom/zero/g_zero.c:107
i = 1
aiovec = {iov_base = 0xffffffff81d91f30 <gpp>, iov_len = 0}
auio = {uio_iov = 0xfffffe0089c0aa98, uio_iovcnt = 0, uio_offset =
4096, uio_resid = 4096, uio_segflg = UIO_SYSSPACE, uio_rw = UIO_WRITE, uio_td =
0xfffff8009efa7780}
offset = 0
length = 4096
i = <optimized out>
#13 g_zero_start (bp=0xfffff8000a2724e0) at /usr/src/sys/geom/zero/g_zero.c:124
error = <optimized out>
#14 0xffffffff80adc4ec in g_io_request (bp=0xfffff8000a2724e0,
cp=0xfffff80004422e80) at /usr/src/sys/geom/geom_io.c:590
pp = 0xfffff8000417d700
direct = 1
error = <optimized out>
first = <optimized out>
cmd = <optimized out>
#15 0xffffffff80c9856f in aio_qbio (p=<optimized out>, job=0xfffff8007a378228)
at /usr/src/sys/kern/vfs_aio.c:1362
dev = 0xfffff8000442d400
ref = 1
bios = 0xfffff80078069810
cb = 0xfffff8007a3782c8
fp = <optimized out>
opcode = <optimized out>
vp = <optimized out>
iovcnt = 1
i = 0
offset = 131072
csw = 0xffffffff81ab4380 <g_dev_cdevsw>
ki = <optimized out>
use_unmapped = true
error = 14
pbuf = <optimized out>
poff = <optimized out>
bio_cmd = <optimized out>
prot = <optimized out>
destroy_bios = <optimized out>
_tid = <optimized out>
_v = <optimized out>
_v = <optimized out>
_v = <optimized out>
_size = <optimized out>
_malloc_item = <optimized out>
buf = <optimized out>
nbytes = <optimized out>
bp = <optimized out>
pages = <optimized out>
npages = <optimized out>
_size = <optimized out>
_malloc_item = <optimized out>
#16 aio_queue_file (fp=<optimized out>, job=job@entry=0xfffff8007a378228) at
/usr/src/sys/kern/vfs_aio.c:1792
ki = <optimized out>
error = <optimized out>
safe = <optimized out>
vp = <optimized out>
mp = <optimized out>
job2 = <optimized out>
#17 0xffffffff80c95e0e in aio_aqueue (td=td@entry=0xfffff8009efa7780,
ujob=0x3c7e7e86c930, lj=lj@entry=0xfffff8007a37b110, type=type@entry=0,
ops=ops@entry=0xffffffff81aecbf8 <aiocb_ops>) at
/usr/src/sys/kern/vfs_aio.c:1701
fp = 0xfffff8009ee7d5a0
kev = {ident = 18446735280282523040, filter = 30592, flags = 40698,
fflags = 4294965248, data = 1074291841, udata = 0xfffffe0089c0ac40, ext =
{18446744071572627931, 18446735280283744128, 4294967296, 18446735277688017920}}
p = 0xfffffe00806da040
ki = 0xfffff8020ddc5340
job = 0xfffff8007a378228
error = <optimized out>
opcode = 2
fd = <optimized out>
evflags = <optimized out>
kqfd = <optimized out>
#18 0xffffffff80c964d5 in kern_lio_listio (td=td@entry=0xfffff8009efa7780,
mode=1, uacb_list=<optimized out>, acb_list=acb_list@entry=0xfffff8008b663920,
nent=nent@entry=4, sig=sig@entry=0x0, ops=0xffffffff81aecbf8 <aiocb_ops>) at
/usr/src/sys/kern/vfs_aio.c:2328
kev = {ident = 0, filter = 336, flags = 0, fflags = 0, data =
-2196712149808, udata = 0xffffffff80a1282e <devfs_ioctl_f+30>, ext = {0, 9,
18446741876997401920, 18446744071574938726}}
p = <optimized out>
ki = 0xfffff8020ddc5340
lj = 0xfffff8007a37b110
error = <optimized out>
nagain = 0
nerror = 0
i = 0
job = 0xfffffe0089c0b000
#19 0xffffffff80c9690a in sys_lio_listio (td=<optimized out>,
uap=0xfffff8009efa7ba8) at /usr/src/sys/kern/vfs_aio.c:2449
sig = {sigev_notify = 0, sigev_signo = 0, sigev_value = {sival_int = 0,
sival_ptr = 0x0, sigval_int = 0, sigval_ptr = 0x0}, _sigev_un = {_threadid = 0,
_sigev_thread = {_function = 0x0, _attribute = 0x1000}, _kevent_flags = 0,
__spare__ = {0, 4096, 0, 0, 0, 0, 0, 0}}}
nent = 4
error = -994045952
sigp = 0x0
acb_list = 0xfffff8008b663920
--
You are receiving this mail because:
You are the assignee for the bug.