[Bug 212168] [panic] [UFS] use-after-free panic (0xdeadc0dedeadc0de)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212168

--- Comment #6 from Peter Wemm <peter at FreeBSD.org> ---
It is very confusing as the compiler is doing extensive inlining.

As near as I can tell, the area you asked about is like this:

softdep_freefile():
                        handle_bufwait(inodedep, &freefile->fx_jwork);
7568                    clear_unlinked_inodedep(inodedep);

->
clear_unlinked_inodedep():
9685:           bwrite(bp);
                ACQUIRE_LOCK(ump);
-> 
bwrite():
393:      return (BO_WRITE(bp->b_bufobj, bp));
->
I'm confused after here.  The return address of the frame is
softdep_freefile+0x66c, which is the inlined sys/buf.h BO_WRITE macro.

I *think* the chain continues from BO_WRITE() -> ffs_bufwrite() -> bufwrite()
-> bstrategy()-> ffs_geom_strategy().

I am 100% confident that it is originating from clear_unlinked_inodedep().  99%
sure it is the first bwrite(), not the second one at line 9699.

Is this of any help?

-- 
You are receiving this mail because:
You are the assignee for the bug.