panic: Memory modified after free
Alex Lyashkov
umka at sevinter.net
Fri Jun 24 16:59:42 GMT 2005
I got a simular panic with RELENG_5.
-
#2 0xc04a562a in panic (fmt=0xc0602beb "sbappendstream 1") at
/usr/src/sys/kern/kern_shutdown.c:566
#3 0xc04ddd3a in sbappendstream_locked (sb=0xc1838bb4, m=0xc1084600) at
/usr/src/sys/kern/uipc_socket2.c:739
#4 0xc0541978 in tcp_input (m=0xc1084600, off0=40) at
/usr/src/sys/netinet/tcp_input.c:1295
#5 0xc053b011 in ip_input (m=0xc1084600) at
/usr/src/sys/netinet/ip_input.c:776
#6 0xc050e016 in netisr_processqueue (ni=0xc067af38) at
/usr/src/sys/net/netisr.c:233
#7 0xc050e1c4 in swi_net (dummy=0x0) at /usr/src/sys/net/netisr.c:340
#8 0xc0493e98 in ithread_loop (arg=0xc0fd9500) at
/usr/src/sys/kern/kern_intr.c:547
#9 0xc049330c in fork_exit (callout=0xc0493d74 <ithread_loop>,
arg=0xc0fd9500, frame=0xc99add38)
--
В Птн, 24.06.2005, в 19:44, Peter Holm пишет:
> On Fri, Jun 24, 2005 at 04:26:55PM +0200, Thierry Herbelot wrote:
> >
> > This is with an SMP machine (oldish BP6)
> >
>
> It seems as thou I got the same one:
>
> panic: Memory modified after free 0xc216d500(256) val=c1d5e100 @ 0xc216d500
>
> cpuid = 0
> KDB: enter: panic
> [thread pid 37 tid 100020 ]
> Stopped at kdb_enter+0x2b: nop
> db> where
> Tracing pid 37 tid 100020 td 0xc1540480
> kdb_enter(c0852679) at kdb_enter+0x2b
> panic(c086d47e,c216d500,100,c1d5e100,c216d500) at panic+0x14b
> trash_ctor(c216d500,100,cbfa0b04,1,c104a9d8) at trash_ctor+0x2f
> mb_ctor_mbuf(c216d500,100,cbfa0b04,1) at mb_ctor_mbuf+0x18
> uma_zalloc_arg(c104a9a0,cbfa0b04,1) at uma_zalloc_arg+0x10f
> m_copym(c1739300,16a0,5a8,1,5cef834) at m_copym+0x11c
> tcp_output(c1fe78fc) at tcp_output+0xa42
> tcp_input(c178ab00,14,c178ab00,0,0) at tcp_input+0x2b0f
> ip_input(c178ab00) at ip_input+0x511
> netisr_processqueue(c099eb38) at netisr_processqueue+0x6e
> swi_net(0) at swi_net+0xbe
> ithread_loop(c1573480,cbfa0d38,...) at ithread_loop+0x11c
> fork_exit(c061bba0,c1573480,cbfa0d38) at fork_exit+0xa0
> fork_trampoline() at fork_trampoline+0x8
>
> Details at http://www.holm.cc/stress/log/cons136.html
>
> - Peter
>
> >
> > multi-cur# kgdb kernel.debug /files3/tmp/vmcore.154
> > [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so:
> > Undefined symbol "ps_pglobal_lookup"]
> > GNU gdb 6.1.1 [FreeBSD]
> > Copyright 2004 Free Software Foundation, Inc.
> > GDB is free software, covered by the GNU General Public License, and you are
> > welcome to change it and/or distribute copies of it under certain conditions.
> > Type "show copying" to see the conditions.
> > There is absolutely no warranty for GDB. Type "show warranty" for details.
> > This GDB was configured as "i386-marcel-freebsd".
> > #0 doadump () at pcpu.h:165
> > 165 __asm __volatile("movl %%fs:0,%0" : "=r" (td));
> > (kgdb) bt
> > #0 doadump () at pcpu.h:165
> > #1 0xc046897a in db_fncall (dummy1=0, dummy2=0, dummy3=-1067166101,
> > dummy4=0xcc89d8d4 "\bÙ\211Ì") at /usr/src/sys/ddb/db_command.c:531
> > #2 0xc0468788 in db_command (last_cmdp=0xc08fc464, cmd_table=0x0,
> > aux_cmd_tablep=0xc0879f00,
> > aux_cmd_tablep_end=0xc0879f1c) at /usr/src/sys/ddb/db_command.c:349
> > #3 0xc0468850 in db_command_loop () at /usr/src/sys/ddb/db_command.c:455
> > #4 0xc046a3d5 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:221
> > #5 0xc0645904 in kdb_trap (type=3, code=0, tf=0xcc89da18)
> > at /usr/src/sys/kern/subr_kdb.c:471
> > #6 0xc07e7cbc in trap (frame=
> > {tf_fs = -863436792, tf_es = -1067188184, tf_ds = -1065025496, tf_edi =
> > -1064921604, tf_esi = 1, tf_ebp = -863380904, tf_isp = -863380924, tf_ebx =
> > -863380860, tf_edx = 0, tf_ecx = -1056755712, tf_eax = 18, tf_trapno = 3,
> > tf_err = 0, tf_eip = -1067166101, tf_cs = 32, tf_eflags = 642, tf_esp =
> > -863380872, tf_ss = -1067263353}) at /usr/src/sys/i386/i386/trap.c:598
> > #7 0xc07d583a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
> > #8 0xcc890008 in ?? ()
> > #9 0xc0640028 in blst_radix_init (scan=0xc084ecf5,
> > radix=-4516961442427043584,
> > skip=-1050930176, count=Unhandled dwarf expression opcode 0x93
> > ) at /usr/src/sys/kern/subr_blist.c:885
> > #10 0xc062da87 in panic (fmt=0x282 <Address 0x282 out of bounds>)
> > at /usr/src/sys/kern/kern_shutdown.c:537
> > #11 0xc077be53 in trash_ctor (mem=0xc15c1400, size=0, arg=0xcc89db40, flags=1)
> > at /usr/src/sys/vm/uma_dbg.c:72
> > #12 0xc0624bd8 in mb_ctor_mbuf (mem=0xc15c1400, size=256, arg=0xcc89db40,
> > how=1)
> > at /usr/src/sys/kern/kern_mbuf.c:204
> > #13 0xc077a85f in uma_zalloc_arg (zone=0xc104a9a0, udata=0xcc89db40, flags=1)
> > at /usr/src/sys/vm/uma_core.c:1839
> > #14 0xc06c66ed in tcp_output (tp=0xc165eac8) at mbuf.h:392
> > ---Type <return> to continue, or q <return> to quit---q
> > Quit
> > (kgdb) frame 11
> > #11 0xc077be53 in trash_ctor (mem=0xc15c1400, size=0, arg=0xcc89db40, flags=1)
> > at /usr/src/sys/vm/uma_dbg.c:72
> > 72 panic("Memory modified after free %p(%d)
> > val=%x @ %p\n",
> > (kgdb) list
> > 67
> > 68 cnt = size / sizeof(uma_junk);
> > 69
> > 70 for (p = mem; cnt > 0; cnt--, p++)
> > 71 if (*p != uma_junk)
> > 72 panic("Memory modified after free %p(%d)
> > val=%x @ %p\n",
> > 73 mem, size, *p, p);
> > 74 return (0);
> > 75 }
> > 76
> > (kgdb) frame 13
> > #13 0xc077a85f in uma_zalloc_arg (zone=0xc104a9a0, udata=0xcc89db40, flags=1)
> > at /usr/src/sys/vm/uma_core.c:1839
> > 1839 if (zone->uz_ctor(item,
> > zone->uz_keg->uk_size,
> > (kgdb) list
> > 1834 ZONE_LOCK(zone);
> > 1835 uma_dbg_alloc(zone, NULL, item);
> > 1836 ZONE_UNLOCK(zone);
> > 1837 #endif
> > 1838 if (zone->uz_ctor != NULL) {
> > 1839 if (zone->uz_ctor(item,
> > zone->uz_keg->uk_size,
> > 1840 udata, flags) != 0) {
> > 1841 uma_zfree_internal(zone, item,
> > udata,
> > 1842 SKIP_DTOR);
> > 1843 return (NULL);
> > (kgdb) print *zone
> > $1 = {uz_name = 0xc084d5b0 "Mbuf", uz_lock = 0xc10443c8, uz_keg = 0xc10443c0,
> > uz_link = {
> > le_next = 0xc104ac60, le_prev = 0xc10443f8}, uz_full_bucket = {lh_first =
> > 0x0},
> > uz_free_bucket = {lh_first = 0x0}, uz_ctor = 0xc0624bc0 <mb_ctor_mbuf>,
> > uz_dtor = 0xc0624c30 <mb_dtor_mbuf>, uz_init = 0, uz_fini = 0, uz_allocs =
> > 1993622,
> > uz_fills = 0, uz_count = 128, uz_cpu = {{uc_freebucket = 0xc15b820c,
> > uc_allocbucket = 0xc103d20c, uc_allocs = 3}}}
> >
> > multi-cur# ident kernel.debug | grep uma_dbg.c
> > $FreeBSD: src/sys/vm/uma_dbg.c,v 1.19 2005/02/16 21:45:59 bmilekic Exp $
> > multi-cur# ident kernel.debug | grep kern_mbuf.c
> > $FreeBSD: src/sys/kern/kern_mbuf.c,v 1.8 2005/06/23 04:33:39 silby Exp $
> > multi-cur# ident kernel.debug | grep uma_core.c
> > $FreeBSD: src/sys/vm/uma_core.c,v 1.119 2005/04/29 18:56:36 rwatson Exp $
> > _______________________________________________
> > freebsd-current at freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-current
> > To unsubscribe, send any mail to "freebsd-current-unsubscribe at freebsd.org"
> _______________________________________________
> freebsd-current at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe at freebsd.org"
--
Alex Lyashkov <umka at sevinter.net>
Home
More information about the freebsd-current
mailing list