Panic - uma_zfree_arg - zone argument is NULL

[Gleb Smirnoff]

On Fri, Sep 26, 2014 at 08:30:06AM +0200, Hans Petter Selasky wrote:
H> On 09/26/14 08:06, Gleb Smirnoff wrote:
H> > On Fri, Sep 26, 2014 at 07:59:09AM +0200, Hans Petter Selasky wrote:
H> > H> On 09/26/14 07:51, Hans Petter Selasky wrote:
H> > H> > On 09/25/14 11:19, Gleb Smirnoff wrote:
H> > H> >> On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote:
H> > H> >> H> #7  0xffffffff80b07863 in uma_zfree_arg (zone=0x0,
H> > H> >> item=0xfffff800114ee000,
H> > H> >> H>      udata=0xffffffff81484760)
H> > H> >>
H> > H> >> udata here is uma_slab_t. Can you look at it?
H> > H> >>
H> > H> >> btw, is that reproducible on stable/10 or head?
H> > H> >>
H> > H> >
H> > H> > Yes, it is reproducible. I have not tried stable/10 or head yet.
H> > H> >
H> > H> > (kgdb) print *(uma_slab_t)udata
H> > H> > $3 = {
H> > H> >    us_keg = 0xfffff8085696d680,
H> >
H> > Can you print the us_keg, please?
H> 
H> (kgdb) print *(*(uma_slab_t)udata).us_keg
 <skip>

It is trash. This means that vtoslab() returned us bad pointer.

Either this mean the address passed to free() is invalid, and
belongs to a page not under UMA control, or someone else have
mangled the page belonging to UMA.

Can you please print *(struct vm_page *)0xffffffff81484760 ?

-- 
Totus tuus, Glebius.