Memory modified after free: Most recently used by acpitask
nate at root.org
Wed Nov 24 10:28:13 PST 2004
Gavin Atkinson wrote:
> On Wed, 2004-11-24 at 16:49, Nate Lawson wrote:
>>Gavin Atkinson wrote:
>>># cp -Rp /usr/* /var/usr
>>>[about 10 minutes later]
>>>Memory modified after free 0xc44a8420(28) val=0 @ 0xc44a8434
>>>panic: Most recently used by acpitask
>>Unfortunately, the panic message doesn't tell you who modified it since
>>someone with a stray pointer (say, who allocated/freed it before acpi)
>>could overwrite it and it was only detected on the next malloc. The way
>>I've found these is to boot -d (into ddb) and type "watch 0xc44a8420".
>>Then hit "c" to continue the boot. Dump a "tr" any time the watchpoint
>>triggers and look for suspicious callers.
> Sadly, I suspect it's not going to be that easy. I've just had another
> panic, same trigger and symptoms but different memory address.
> Memory modified after free 0xc50441c0(28) val=0 @ 0xc50441d4
> panic: Most recently used by acpitask
> cpuid = 0
> KDB: enter: panic
> [thread 100111]
> Stopped at kdb_enter+0x2c: leave
> I'll try taking the box to top-of-tree current in case it has already
> been fixed - however that will probably have to wait until tomorrow now
> as this machine cannot reboot without physical help. Surely it seems
> like quite a coincidence that both times it was 20 bytes into memory
> once owned by acpitask, though?
The only coincidence is it's likely the same component causing this
problem. acpi is probably only a victim. FYI, in August I fixed an
overflow in ATA that had the same symptoms of overwriting an ACPI struct
(although that doesn't mean this is caused by ATA).
More information about the freebsd-acpi