panic: vm_page_free: freeing free page

[Sergey Kandaurov]

Yep, this is quite old - 7.2-STABLE i386.
I got this panic after starting doing some Xorg activity,
otherwise system was idle for some hours.
I wonder if this is know/fixed in later versions.
If that's true then please just ignore this mail.

Unread portion of the kernel message buffer:
vm_page_free: pindex(0), busy(0), VPO_BUSY(0), hold(0)
panic: vm_page_free: freeing free page
cpuid = 0
Uptime: 7d1h47m51s

(kgdb) bt
#0  doadump () at pcpu.h:196
#1  0xc057ce07 in boot (howto=260)
    at /usr/home/pluknet/cvs-7/src/sys/kern/kern_shutdown.c:418
#2  0xc057d0d9 in panic (fmt=Variable "fmt" is not available.
)
    at /usr/home/pluknet/cvs-7/src/sys/kern/kern_shutdown.c:574
#3  0xc06da965 in vm_page_free_toq (m=0xc1c1edb8)
    at /usr/home/pluknet/cvs-7/src/sys/vm/vm_page.c:1375
#4  0xc06dab66 in vm_page_free (m=0xc1c1edb8)
    at /usr/home/pluknet/cvs-7/src/sys/vm/vm_page.c:506
#5  0xc06d9850 in vm_object_page_remove (object=0xc7bad300, start=0, end=256,
    clean_only=0) at /usr/home/pluknet/cvs-7/src/sys/vm/vm_object.c:1955
#6  0xc06d1756 in vm_map_delete (map=Variable "map" is not available.
)
    at /usr/home/pluknet/cvs-7/src/sys/vm/vm_map.c:2329
#7  0xc06d5287 in munmap (td=0xc5f0c240, uap=0xe8a01cfc)
    at /usr/home/pluknet/cvs-7/src/sys/vm/vm_mmap.c:582
#8  0xc071f375 in syscall (frame=0xe8a01d38)
    at /usr/home/pluknet/cvs-7/src/sys/i386/i386/trap.c:1101
#9  0xc0703a20 in Xint0x80_syscall ()
    at /usr/home/pluknet/cvs-7/src/sys/i386/i386/exception.s:262

(kgdb) up
#1  0xc057ce07 in boot (howto=260)
    at /usr/home/pluknet/cvs-7/src/sys/kern/kern_shutdown.c:418
418                     doadump();
(kgdb) up
#2  0xc057d0d9 in panic (fmt=Variable "fmt" is not available.
)
    at /usr/home/pluknet/cvs-7/src/sys/kern/kern_shutdown.c:574
574             boot(bootopt);
(kgdb) up
#3  0xc06da965 in vm_page_free_toq (m=0xc1c1edb8)
    at /usr/home/pluknet/cvs-7/src/sys/vm/vm_page.c:1375
warning: Source file is more recent than executable.

1375                    if (VM_PAGE_IS_FREE(m))
(kgdb) inspect *m
$1 = {pageq = {tqe_next = 0xc1c1ee48, tqe_prev = 0xc2c69328}, listq = {
    tqe_next = 0xc1c1ee48, tqe_prev = 0xc7bad32c}, left = 0x0,
  right = 0xc1b9f5d0, object = 0x0, pindex = 0, phys_addr = 691798016, md = {
    pat_mode = 6, pv_list = {tqh_first = 0x0, tqh_last = 0xc1c1ede4}},
  queue = 2 '\002', segind = 3 '\003', flags = 131, order = 11 '\v',
  pool = 0 '\0', cow = 0, wire_count = 0, hold_count = 0, oflags = 0,
  act_count = 5 '\005', busy = 0 '\0', valid = 0 '\0', dirty = 255 'Ъ'}
(kgdb) up
#4  0xc06dab66 in vm_page_free (m=0xc1c1edb8)
    at /usr/home/pluknet/cvs-7/src/sys/vm/vm_page.c:506
506             vm_page_free_toq(m);
(kgdb) up
#5  0xc06d9850 in vm_object_page_remove (object=0xc7bad300, start=0, end=256,
    clean_only=0) at /usr/home/pluknet/cvs-7/src/sys/vm/vm_object.c:1955
1955                    vm_page_free(p);
(kgdb) inspect *p
$2 = {pageq = {tqe_next = 0xc1c1ee48, tqe_prev = 0xc2c69328}, listq = {
    tqe_next = 0xc1c1ee48, tqe_prev = 0xc7bad32c}, left = 0x0,
  right = 0xc1b9f5d0, object = 0x0, pindex = 0, phys_addr = 691798016, md = {
    pat_mode = 6, pv_list = {tqh_first = 0x0, tqh_last = 0xc1c1ede4}},
  queue = 2 '\002', segind = 3 '\003', flags = 131, order = 11 '\v',
  pool = 0 '\0', cow = 0, wire_count = 0, hold_count = 0, oflags = 0,
  act_count = 5 '\005', busy = 0 '\0', valid = 0 '\0', dirty = 255 'Ъ'}
(kgdb) inspect *object
$3 = {mtx = {lock_object = {lo_name = 0xc0777524 "vm object",
      lo_type = 0xc077818b "standard object", lo_flags = 21168128,
      lo_witness_data = {lod_list = {stqe_next = 0x0}, lod_witness = 0x0}},
    mtx_lock = 3320889920, mtx_recurse = 0}, object_list = {
    tqe_next = 0xca3fa300, tqe_prev = 0xca632818}, shadow_head = {
    lh_first = 0x0}, shadow_list = {le_next = 0x0, le_prev = 0xc8c45a20},
  memq = {tqh_first = 0xc1c1edb8, tqh_last = 0xc23411a8}, root = 0xc2171ef8,
  size = 1024, generation = 2748, ref_count = 2, shadow_count = 0,
  type = 0 '\0', memattr = 6 '\006', flags = 12544, pg_color = 46848,
  paging_in_progress = 1, resident_page_count = 179, backing_object = 0x0,
  backing_object_offset = 0, pager_object_list = {tqe_next = 0x0,
    tqe_prev = 0x0}, rvq = {lh_first = 0x0}, cache = 0x0, handle = 0x0,
  un_pager = {vnp = {vnp_size = 0}, devp = {devp_pglist = {tqh_first = 0x0,
        tqh_last = 0x0}}, sgp = {sgp_pglist = {tqh_first = 0x0,
        tqh_last = 0x0}}, swp = {swp_bcount = 0}}}

-- 
wbr,
pluknet