Duplicate mbuf free panic in hme(4)

[John Baldwin]

On Tuesday 30 November 2004 10:35 am, John Baldwin wrote:
> I got the following panic on my ultra60 while the box was idle over the
> holidays:
>
> Nov 26 00:20:25 amd[293]: reload of map /etc/amd.map is not needed (in
> sync) Nov 26 01:24:26 amd[293]: reload of map /etc/amd.map is not needed
> (in sync) Nov 26 02:28:26 amd[293]: reload of map /etc/amd.map is not
> needed (in sync) Nov 26 03:32:26 amd[293]: reload of map /etc/amd.map is
> not needed (in sync) Slab at 0xfffff80085467ed8, freei 2 = 0.
> panic: Duplicate free of item 0xfffff80085466200 from zone
> 0xfffff80027ffd5c0 (Mbuf)
>
> cpuid = 0
> KDB: enter: panic
> [thread 100039]
> Stopped at      kdb_enter+0x38: ta              %xcc, 1
> db> tr
> panic() at panic+0x19c
> uma_dbg_free() at uma_dbg_free+0x138
> uma_zfree_arg() at uma_zfree_arg+0x1a4
> m_freem() at m_freem+0x4c
> hme_intr() at hme_intr+0x2d0
> psycho_intr_stub() at psycho_intr_stub+0x8
> ithread_loop() at ithread_loop+0x218
> fork_exit() at fork_exit+0x9c
> fork_trampoline() at fork_trampoline+0x8
> db>
>
> Perhaps this can also explain the memory used after free panics that myself
> and others see on our sparcs under load?

Slightly more info:

(gdb) l *hme_intr+0x2d0
0xc00bb4d0 is in hme_intr (../../../dev/hme/if_hme.c:1206).
1201                    bus_dmamap_sync(sc->sc_tdmatag, htx->htx_dmamap,
1202                        BUS_DMASYNC_POSTWRITE);
1203                    bus_dmamap_unload(sc->sc_tdmatag, htx->htx_dmamap);
1204
1205                    ifp->if_opackets++;
1206                    m_freem(htx->htx_m);
1207                    htx->htx_m = NULL;
1208                    STAILQ_REMOVE_HEAD(&sc->sc_rb.rb_txbusyq, htx_q);
1209                    STAILQ_INSERT_TAIL(&sc->sc_rb.rb_txfreeq, htx, htx_q);
1210                    htx = STAILQ_FIRST(&sc->sc_rb.rb_txbusyq);

> ident /sys/dev/hme/if_hme.c
/sys/dev/hme/if_hme.c:
     $FreeBSD: src/sys/dev/hme/if_hme.c,v 1.32 2004/11/22 06:46:30 yongari 
Exp$

-- 
John Baldwin <jhb at FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve"  =  http://www.FreeBSD.org