[Bug 212168] [panic] [UFS] use-after-free panic (0xdeadc0dedeadc0de)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212168

Peter Wemm <peter at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |peter at FreeBSD.org

--- Comment #4 from Peter Wemm <peter at FreeBSD.org> ---
>From an earlier console log that Glen has been capturing:
Stopped at      softdep_disk_io_initiation+0x50:        ldr     x21, [x8, #664]
db> set $lines 0
db> bt
Tracing pid 44795 tid 101060 td 0xfffffd0027a859c0
db_trace_self() at db_stack_trace+0xf0
db_stack_trace() at db_command+0x254
db_command() at db_command_loop+0x60
db_command_loop() at db_trap+0xf0
db_trap() at kdb_trap+0x180
kdb_trap() at data_abort+0x19c
data_abort() at handle_el1h_sync+0x68
handle_el1h_sync() at ffs_geom_strategy+0x108
ffs_geom_strategy() at ffs_geom_strategy+0x108
ffs_geom_strategy() at bufwrite+0x210
bufwrite() at softdep_freefile+0x66c
softdep_freefile() at ffs_vfree+0x28
ffs_vfree() at ufs_inactive+0x2a4
ufs_inactive() at VOP_INACTIVE_APV+0xcc
VOP_INACTIVE_APV() at vinactive+0xb8
vinactive() at vputx+0x30c
vputx() at vn_close+0xf0
vn_close() at vn_closefile+0x58
vn_closefile() at closef+0x1f8
closef() at fdescfree_fds+0x8c
fdescfree_fds() at fdescfree+0x468
fdescfree() at exit1+0x48c
exit1() at sys_sys_exit+0x10
sys_sys_exit() at do_el0_sync+0x4c0
do_el0_sync() at handle_el0_sync+0x64
handle_el0_sync() at 0x41b670
db>

Every one of these I've seen has been in the
exit->close->inactive->freefile->ffs_geom_strategy->softdep_disk_io_initiation
path, and always at that precise location.  It's always a [0xdeadc0dedeadc0de +
offset] memory read.

Unfortunately I can't see any ps output in the console for any of these.

-- 
You are receiving this mail because:
You are the assignee for the bug.