>Number:         342
>Category:       kern
>Synopsis:       kernel panic after long ftp over ppp line
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    gnats-admin (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 17 02:05:07 1994
>Originator:     Martin Husemann
>Organization:
private
>Release:        
>Environment:
-current from a sup at about  Sat Jul 16 13:00 MET DST 1994
>System: NetBSD euterpe.owl.de 1.0-ALPHA NetBSD 1.0-ALPHA (EUTERPE) #0: Sat Jul 16 18:04:54 MET DST 1994 root@euterpe.owl.de:/usr/src/sys/arch/i386/compile/EUTERPE i386
	My kernel config:

NetBSD 1.0-ALPHA (EUTERPE) #0: Sat Jul 16 18:04:54 MET DST 1994
    root@euterpe.owl.de:/usr/src/sys/arch/i386/compile/EUTERPE
CPU: i486DX (486-class CPU)
real mem  = 16384000
avail mem = 14082048
using 225 buffers containing 921600 bytes of memory
vt0 at isa0 port 0x60-0x6f irq 1: et4000, 80/132 col, color, 8 scr, mf2-kbd, [R3.00]
com0 at isa0 port 0x3f8-0x3ff irq 4: ns82450 or ns16450, no fifo
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
lpt0 at isa0 port 0x378-0x37f: polled
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
fd0 at fdc0 drive 0: 1.44MB 80 cyl, 2 head, 18 sec
ahb0 at isa0 port 0x1000-0x1fff irq 11: model 1740 or 1742, revision 2
scsibus1 at ahb0
ahb0 targ 0 lun 0: <QUANTUM LPS525S         3100> SCSI2 direct fixed
sd0 at scsibus1: 501MB, 2448 cyl, 6 head, 69 sec, 512 bytes/sec
ahb0 targ 3 lun 0: <CALIPER CP150           1.17> SCSI1 sequential removable
st0 at scsibus1: drive empty
ed0 at isa0 port 0x300-0x31f iomem 0xd0000-0xd3fff irq 10: address 00:00:c0:11:48:2d, type WD8013EP (16-bit) bnc
npx0 at isa0 port 0xf0-0xff: using exception 16
biomask 840 netmask 41a ttymask 1a
lpt0: out of paper

>Description:
	After a long ftp session a kernel panic occurs. Syslog notes anomalies:

Jul 17 04:17:25 euterpe pppd[158]: pppd 2.1.1 started by root, uid 0
Jul 17 04:18:01 euterpe pppd[159]: Connect: ppp0 <--> /dev/tty01
Jul 17 04:18:04 euterpe pppd[159]: local  IP address 129.70.36.1
Jul 17 04:18:04 euterpe pppd[159]: remote IP address 129.70.4.16
Jul 17 06:08:00 euterpe /netbsd: mb_map full
Jul 17 06:08:00 euterpe pppd[159]: input: Unknown protocol (2d) received!
Jul 17 06:08:01 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:08:01 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0d80 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:08:01 euterpe pppd[159]: input: Unknown protocol (ad2d) received!
Jul 17 06:08:13 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0a00 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:08:30 euterpe pppd[159]: input: Unknown protocol (2d) received!
Jul 17 06:08:30 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:08:31 euterpe pppd[159]: input: Unknown protocol (ad2d) received!
Jul 17 06:08:31 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:08:31 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0100 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:08:32 euterpe pppd[159]: input: Unknown protocol (2d) received!
Jul 17 06:08:37 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0700 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:08:37 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:09:20 euterpe last message repeated 2 times
Jul 17 06:10:00 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0c00 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:10:17 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0480 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:10:17 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:12:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:14:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:16:11 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0a00 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:16:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0400 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:16:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:18:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:20:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:22:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0b80 size 128 previous type zombie (0xde0003ff != 0xdeadbeef)
Jul 17 06:22:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:24:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:26:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:26:11 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0c00 size 128 previous type routetbl (0xde0003ff != 0xdeadbeef)
Jul 17 06:28:11 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0b00 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:28:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:30:11 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0900 size 128 previous type exec (0xde0003ff != 0xdeadbeef)
Jul 17 06:30:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:32:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:32:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0880 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:34:11 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0200 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:34:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:36:11 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:38:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:40:00 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0b00 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:40:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:42:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:44:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0300 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:44:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:44:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0280 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:46:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:46:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0080 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:48:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:48:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0700 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:50:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:50:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0c00 size 128 previous type routetbl (0xde0003ff != 0xdeadbeef)
Jul 17 06:52:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0200 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:52:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:54:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:54:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0980 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 06:56:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 06:58:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:00:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:08:12 euterpe last message repeated 4 times
Jul 17 07:09:08 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0780 size 104 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:10:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:12:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a1b00 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:12:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:14:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:16:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0b00 size 128 previous type zombie (0xde0003ff != 0xdeadbeef)
Jul 17 07:16:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0400 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:16:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:18:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:20:00 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a1e00 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:20:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:22:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0880 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:22:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:24:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:26:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:26:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a1800 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:28:12 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a1a80 size 128 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:28:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:30:00 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a0300 size 76 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:30:00 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a1300 size 72 previous type mbuf (0xde0003ff != 0xdeadbeef)
Jul 17 07:30:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:32:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:34:12 euterpe pppd[159]: input: Unknown protocol (2f) received!
Jul 17 07:35:08 euterpe /netbsd: Data modified on freelist: word 2 of object 0xf87a1b00 size 104 previous type routetbl (0xde0003ff != 0xdeadbeef)

And then the kernel panics:

vm_fault(f8254000,f87a2000,3,0) -> 1
kernel: page fault trap, code=0
Stopped at _pppinput+0x376: movb $0xff,0(%eax)
db> trace
_pppinput(2f,f86f5800) at _pppinput+0x376
_comintr(f86a3e80) at _comintr+x0fc
_Xintr3(f86e2780,41a,f8720378,100,f7bffdbc) at _Xintr3+0x55
bpendtsleep(f86e2780,11e,f818e73e,19) at bpendtsleep
_lptopen(1080,2,2000,f8747f00,0) at _lptopen+0x11a
_spec_open(f7bffe20,0,14000,f878ae80,2) at _spec_open+0x135
_vn_open(f7bffe0,2,5,f7bfdd28,f778ae80,2) at _vn_open+0x342
_open(f8747f00,f7bfff94,f7bfff8c,0,20) at _open+0x93
_syscall() at _syscall+0x1ab
--- syscall(number 5) ---
0x10063378:
db>

>How-To-Repeat:
	A quiet system, connected via a 14k4 ppp link to an Annex terminal
	server. Try to ftp a *big* file (I used postgres-v4r2.tar.gz).
	From the expected 6 MB I got this far:

	-rw-rw-r--  1 root  wheel  1424896 Jul 17 06:08 postgres-v4r2.tar.gz

	I can reproduce this, the bytecount is not always the same, but I 
	never got beyound 2 MB.
>Fix:
>Audit-Trail:
>Unformatted:


------------------------------------------------------------------------------