"Memory modified after free" - by whom?

[Gleb Smirnoff]

On Mon, Dec 10, 2012 at 03:18:45PM -0800, mdf at freebsd.org wrote:
m> On Mon, Dec 10, 2012 at 3:10 PM, Adrian Chadd <adrian at freebsd.org> wrote:
m> > 9216 sounds like a jumbo frame mbuf. So the NIC is writing to an mbuf
m> > after it's finalised/freed.
m> >
m> > I have a similar bug showing up on ath(4) RX. :(
m> 
m> Compile with DEBUG_MEMGUARD in the kernel configuration, and then set
m> vm.memguard.desc to the name of the UMA zone used for the 9216 byte
m> allocations, mbuf_jumbo_9k.  This should cause a panic when the memory
m> is touched after free.

DEBUG_MEMGUARD doesn't work with cluster zone, I'm afraid it won't work
with mbuf_jumbo_9k, too, but I didn't try this.

The problem is documented in BUGS in memguard(9).


-- 
Totus tuus, Glebius.