kern/143069: Xen Kernel Panic - Memory modified after free (8.0-RELEASE)

Steve fbsdpr at
Thu Jan 21 21:30:06 UTC 2010

>Number:         143069
>Category:       kern
>Synopsis:       Xen Kernel Panic - Memory modified after free (8.0-RELEASE)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jan 21 21:30:04 UTC 2010
>Originator:     Steve
>Release:        8.0-RELEASE
FreeBSD io 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Thu Jan 21 20:30:21 EST 2010     root at build:/usr/obj/usr/src/sys/SXEN  i386

uname -a from xen host: Linux zion 2.6.26-2-xen-686 #1 SMP Wed Nov 4 23:23:33 UTC 2009 i686 GNU/Linux


I randomly get kernel panics running FreeBSD 8.0 within a Xen virtual machine. The host is i386.

Here's what was displayed on the console at the time of one such panic:

Memory modified after free 0xc1405000(4092) val=deadc0e9 @ 0xc1405878
panic: Most recently used by subproc

cpuid = 0
KDB: enter: panic
[thread pid 887 tid 100047 ]
Stopped at      kdb_enter+0x3a: movl    $0,kdb_why

My kernel conf file, xen VM conf file, 'xm info' are all attached.

Occurs randomly

Patch attached with submission follows:

# This is a shell archive.  Save it in a file, remove anything before
# this line, and then unpack it by entering "sh file".  Note, it may
# create directories; files and directories will be owned by you and
# have default permissions.
# This archive contains:
#	kernel_conf
#	panic_message
#	xen_conf
#	xm_info
echo x - kernel_conf
sed 's/^X//' >kernel_conf << '918fbf5af05ea8c4ebb509cf9907594d'
X# XEN -- Kernel configuration for i386 XEN DomU
X# $FreeBSD: src/sys/i386/conf/XEN,v 2009/10/25 01:10:29 kensmith Exp $
Xcpu		I686_CPU
Xident		XEN
Xmakeoptions	DEBUG=-g		# Build kernel with gdb(1) debug symbols
Xmakeoptions	MODULES_OVERRIDE=""
Xoptions 	SCHED_ULE		# ULE scheduler
Xoptions 	PREEMPTION		# Enable kernel thread preemption
X#options 	SCHED_4BSD		 
Xoptions 	INET			# InterNETworking
Xoptions 	INET6			# IPv6 communications protocols
Xoptions 	SCTP			# Stream Control Transmission Protocol
Xoptions 	FFS			# Berkeley Fast Filesystem
Xoptions 	SOFTUPDATES		# Enable FFS soft updates support
Xoptions 	UFS_ACL			# Support for access control lists
Xoptions 	UFS_DIRHASH		# Improve performance on big directories
Xoptions 	UFS_GJOURNAL		# Enable gjournal-based UFS journaling
Xoptions 	NFSCLIENT		# Network Filesystem Client
Xoptions 	NFSSERVER		# Network Filesystem Server
Xoptions 	NFSLOCKD		# Network Lock Manager
Xoptions 	NFS_ROOT		# NFS usable as /, requires NFSCLIENT
Xoptions 	MSDOSFS			# MSDOS Filesystem
Xoptions 	CD9660			# ISO 9660 Filesystem
Xoptions 	PROCFS			# Process filesystem (requires PSEUDOFS)
Xoptions 	PSEUDOFS		# Pseudo-filesystem framework
Xoptions 	GEOM_PART_GPT		# GUID Partition Tables.
Xoptions 	GEOM_LABEL		# Provides labelization
Xoptions 	COMPAT_43TTY		# BSD 4.3 TTY compat (sgtty)
Xoptions 	COMPAT_FREEBSD4		# Compatible with FreeBSD4
Xoptions 	COMPAT_FREEBSD5		# Compatible with FreeBSD5
Xoptions 	COMPAT_FREEBSD6		# Compatible with FreeBSD6
Xoptions 	COMPAT_FREEBSD7		# Compatible with FreeBSD7
Xoptions 	KTRACE			# ktrace(1) support
Xoptions 	STACK			# stack(9) support
Xoptions 	SYSVSHM			# SYSV-style shared memory
Xoptions 	SYSVMSG			# SYSV-style message queues
Xoptions 	SYSVSEM			# SYSV-style semaphores
Xoptions 	_KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
Xoptions 	KBD_INSTALL_CDEV	# install a CDEV entry in /dev
Xoptions 	AUDIT			# Security event auditing
X# Debugging for use in -current
Xoptions 	KDB			# Enable kernel debugger support.
Xoptions 	DDB			# Support DDB.
Xoptions 	GDB			# Support remote GDB.
Xoptions 	INVARIANTS		# Enable calls of extra sanity checking
Xoptions 	INVARIANT_SUPPORT	# Extra sanity checks of internal structures, required by INVARIANTS
Xoptions 	WITNESS			# Enable checks to detect deadlocks and cycles
Xoptions 	WITNESS_SKIPSPIN	# Don't run witness on spinlocks for speed
Xoptions 	PAE
Xnooption	NATIVE
Xoption		XEN
Xnodevice	atpic
Xnodevice	isa
Xoptions 	MCLSHIFT=12
X# To make an SMP kernel, the next two lines are needed
Xoptions 	SMP			# Symmetric MultiProcessor Kernel
Xdevice		apic			# I/O APIC
Xdevice		atkbdc		# AT keyboard controller
Xdevice		atkbd		# AT keyboard
Xdevice		psm		# PS/2 mouse
Xdevice		pci
Xdevice		kbdmux		# keyboard multiplexer
X# Pseudo devices.
Xdevice		loop		# Network loopback
Xdevice		random		# Entropy device
Xdevice		ether		# Ethernet support
Xdevice		tun		# Packet tunnel.
Xdevice		pty		# Pseudo-ttys (telnet etc)
Xdevice		md		# Memory "disks"
Xdevice		gif		# IPv6 and IPv4 tunneling
Xdevice		faith		# IPv6-to-IPv4 relaying (translation)
X# The `bpf' device enables the Berkeley Packet Filter.
X# Be aware of the administrative consequences of enabling this!
X# Note that 'bpf' is required for DHCP.
Xdevice		bpf		# Berkeley packet filter
Xdevice		pf
Xdevice		pflog
Xoptions 	ALTQ
Xoptions 	ALTQ_CBQ
Xoptions 	ALTQ_RED
Xoptions 	ALTQ_RIO
Xoptions 	ALTQ_HFSC
Xoptions 	ALTQ_CDNR
Xoptions 	ALTQ_PRIQ
Xoptions 	ALTQ_NOPCC
Xoptions 	ALTQ_DEBUG
echo x - panic_message
sed 's/^X//' >panic_message << '0cc79c80a309fbd42d82ff1b959cf447'
XMemory modified after free 0xc1405000(4092) val=deadc0e9 @ 0xc1405878
Xpanic: Most recently used by subproc
Xcpuid = 0
XKDB: enter: panic
X[thread pid 887 tid 100047 ]
XStopped at      kdb_enter+0x3a: movl    $0,kdb_why
echo x - xen_conf
sed 's/^X//' >xen_conf << '0efe0e465773a1ccc925f94ff8e8d377'
Xkernel  = '/boot/freebsd-sxen-8.0'
Xmemory  = '128'
X# 0xCA00=xbd0, 0xCA10=xbd1, 0xCA20=xbd2, etc...
Xdisk    = [ 'file:/v/domains/io/root.img,0xCA00,w' ]
Xname    = 'io'
Xvif     = [ 'mac=00:16:3E:D1:AC:39' ]
Xon_poweroff = 'destroy'
Xon_reboot   = 'restart'
Xon_crash    = 'preserve'
Xextra = "boot_verbose=0"
Xextra += ",vfs.root.mountfrom=ufs:/dev/xbd0"
Xextra += ",kern.hz=100"
echo x - xm_info
sed 's/^X//' >xm_info << 'ee657461338f760680553136f579a67f'
Xhost                   : zion
Xrelease                : 2.6.26-2-xen-686
Xversion                : #1 SMP Wed Nov 4 23:23:33 UTC 2009
Xmachine                : i686
Xnr_cpus                : 4
Xnr_nodes               : 1
Xcores_per_socket       : 1
Xthreads_per_core       : 2
Xcpu_mhz                : 3056
Xhw_caps                : bfebfbff:00000000:00000000:00000080:00004400
Xtotal_memory           : 5631
Xfree_memory            : 0
Xnode_to_cpu            : node0:0-3
Xxen_major              : 3
Xxen_minor              : 2
Xxen_extra              : -1
Xxen_caps               : xen-3.0-x86_32p
Xxen_scheduler          : credit
Xxen_pagesize           : 4096
Xplatform_params        : virt_start=0xf5800000
Xxen_changeset          : unavailable
Xcc_compiler            : gcc version 4.3.1 (Debian 4.3.1-2)
Xcc_compile_by          : waldi
Xcc_compile_domain      :
Xcc_compile_date        : Sat Jun 28 15:25:00 UTC 2008
Xxend_config_format     : 4


More information about the freebsd-bugs mailing list