panic: ffs_blkfree: freeing free frag

From: Stefan Farfeleder <stefan+current_at_fafoe.dyndns.org>
Date: Thu, 1 May 2003 15:50:11 +0200
Hi,

I just got this panic I'd like to report.  I was doing stuff in X, thus
I cannot provide a DDB backtrace.


Script started on Thu May  1 15:17:46 2003
root_at_wombat:/usr/obj/usr/home/stefan/freebsd/src/sys/WOMBAT 4 (0)# gdb -k kernel.debug /var/crash/vmcore.0
GNU gdb 5.2.1 (FreeBSD)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-undermydesk-freebsd"...
panic: bremfree: removing a buffer not on a queue
panic messages:
---
panic: ffs_blkfree: freeing free block

syncing disks, buffers remaining... panic: bremfree: removing a buffer not on a queue
Uptime: 2h34m20s
Dumping 255 MB
ata0: resetting devices ..
done
 16 32[CTRL-C to abort]  48 64 80 96 112 128 144 160 176 192 208 224 240
---
Reading symbols from /boot/kernel/acpi.ko...done.
Loaded symbols for /boot/kernel/acpi.ko
Reading symbols from /boot/kernel/radeon.ko...done.
Loaded symbols for /boot/kernel/radeon.ko
#0  doadump () at /usr/home/stefan/freebsd/src/sys/kern/kern_shutdown.c:238
238		dumping++;
(kgdb) bt
#0  doadump () at /usr/home/stefan/freebsd/src/sys/kern/kern_shutdown.c:238
#1  0xc022bf33 in boot (howto=260)
    at /usr/home/stefan/freebsd/src/sys/kern/kern_shutdown.c:370
#2  0xc022c27b in panic ()
    at /usr/home/stefan/freebsd/src/sys/kern/kern_shutdown.c:543
#3  0xc026fe62 in bremfreel (bp=0xc7743dd0)
    at /usr/home/stefan/freebsd/src/sys/kern/vfs_bio.c:648
#4  0xc026fd45 in bremfree (bp=0x0)
    at /usr/home/stefan/freebsd/src/sys/kern/vfs_bio.c:630
#5  0xc02797f8 in vop_stdfsync (ap=0xcdc7b9f0)
    at /usr/home/stefan/freebsd/src/sys/kern/vfs_default.c:757
#6  0xc01f31a0 in spec_fsync (ap=0xcdc7b9f0)
    at /usr/home/stefan/freebsd/src/sys/fs/specfs/spec_vnops.c:418
#7  0xc01f25c8 in spec_vnoperate (ap=0x0)
    at /usr/home/stefan/freebsd/src/sys/fs/specfs/spec_vnops.c:123
#8  0xc031f62d in ffs_sync (mp=0xc26c9200, waitfor=2, cred=0xc0eb3e80, 
    td=0xc042f440) at vnode_if.h:612
#9  0xc02857fb in sync (td=0xc042f440, uap=0x0)
    at /usr/home/stefan/freebsd/src/sys/kern/vfs_syscalls.c:137
#10 0xc022ba93 in boot (howto=256)
    at /usr/home/stefan/freebsd/src/sys/kern/kern_shutdown.c:279
#11 0xc022c27b in panic ()
    at /usr/home/stefan/freebsd/src/sys/kern/kern_shutdown.c:543
---Type <return> to continue, or q <return> to quit---
#12 0xc030759a in ffs_blkfree (fs=0xc2789800, devvp=0xc272436c, bno=852096, 
    size=16384, inum=5304)
    at /usr/home/stefan/freebsd/src/sys/ufs/ffs/ffs_alloc.c:1768
#13 0xc031758f in indir_trunc (freeblks=0xc31e9800, dbn=3405760, level=0, 
    lbn=12, countp=0xcdc7bc10)
    at /usr/home/stefan/freebsd/src/sys/ufs/ffs/ffs_softdep.c:2615
#14 0xc0317025 in handle_workitem_freeblocks (freeblks=0xc31e9800, flags=0)
    at /usr/home/stefan/freebsd/src/sys/ufs/ffs/ffs_softdep.c:2480
#15 0xc031418a in process_worklist_item (matchmnt=0x0, flags=0)
    at /usr/home/stefan/freebsd/src/sys/ufs/ffs/ffs_softdep.c:756
#16 0xc0313eb0 in softdep_process_worklist (matchmnt=0x0)
    at /usr/home/stefan/freebsd/src/sys/ufs/ffs/ffs_softdep.c:622
#17 0xc0281ebe in sched_sync ()
    at /usr/home/stefan/freebsd/src/sys/kern/vfs_subr.c:1757
#18 0xc0217830 in fork_exit (callout=0xc0281bd0 <sched_sync>, arg=0x0, 
    frame=0x0) at /usr/home/stefan/freebsd/src/sys/kern/kern_fork.c:795
(kgdb) f 12
#12 0xc030759a in ffs_blkfree (fs=0xc2789800, devvp=0xc272436c, bno=852096, 
    size=16384, inum=5304)
    at /usr/home/stefan/freebsd/src/sys/ufs/ffs/ffs_alloc.c:1768
1768					panic("ffs_blkfree: freeing free frag");
(kgdb) l
1763			for (i = 0; i < frags; i++) {
1764				if (isset(blksfree, cgbno + i)) {
1765					printf("dev = %s, block = %jd, fs = %s\n",
1766					    devtoname(dev), (intmax_t)(bno + i),
1767					    fs->fs_fsmnt);
1768					panic("ffs_blkfree: freeing free frag");
1769				}
1770				setbit(blksfree, cgbno + i);
1771			}
1772			cgp->cg_cs.cs_nffree += i;
(kgdb) info locals
cgp = (struct cg *) 0xc867b000
bp = (struct buf *) 0xc7743dd0
fragno = 663
cgbno = 5304
cgblkno = -3618720706253235200
i = 663
error = 0
cg = 9
blk = 0
frags = -1032699028
bbase = -948854032
blksfree = (u_int8_t *) 0xc867bc28 "ÿ"
dev = (struct cdev *) 0xc26cdc00
(kgdb) p *fs
$1 = {fs_firstfield = 0, fs_unused_1 = 0, fs_sblkno = 40, fs_cblkno = 48, 
  fs_iblkno = 56, fs_dblkno = 3000, fs_old_cgoffset = 0, fs_old_cgmask = 0, 
  fs_old_time = 0, fs_old_size = 0, fs_old_dsize = 0, fs_ncg = 52, 
  fs_bsize = 16384, fs_fsize = 2048, fs_frag = 8, fs_minfree = 8, 
  fs_old_rotdelay = 0, fs_old_rps = 0, fs_bmask = -16384, fs_fmask = -2048, 
  fs_bshift = 14, fs_fshift = 11, fs_maxcontig = 8, fs_maxbpg = 2048, 
  fs_fragshift = 3, fs_fsbtodb = 2, fs_sbsize = 2048, fs_spare1 = {0, 0}, 
  fs_nindir = 2048, fs_inopb = 64, fs_old_nspf = 0, fs_optim = 0, 
  fs_old_npsect = 0, fs_old_interleave = 0, fs_old_trackskew = 0, fs_id = {
    1049820160, 865521459}, fs_old_csaddr = 0, fs_cssize = 2048, 
  fs_cgsize = 16384, fs_spare2 = 0, fs_old_nsect = 0, fs_old_spc = 0, 
  fs_old_ncyl = 0, fs_old_cpg = 0, fs_ipg = 23552, fs_fpg = 94088, 
  fs_old_cstotal = {cs_ndir = 0, cs_nbfree = 0, cs_nifree = 0, cs_nffree = 0}, 
  fs_fmod = 1 '\001', fs_clean = 0 '\0', fs_ronly = 0 '\0', 
  fs_old_flags = -128 '\200', 
  fs_fsmnt = "/usr/home", '\0' <repeats 458 times>, 
  fs_volname = '\0' <repeats 31 times>, fs_swuid = 0, fs_pad = 0, 
  fs_cgrotor = 32, fs_ocsp = {0x0 <repeats 28 times>}, 
  fs_contigdirs = 0xc26418d0 "", fs_csp = 0xc2641000, 
  fs_maxcluster = 0xc2641800, fs_active = 0x0, fs_old_cpc = 0, 
  fs_maxbsize = 16384, fs_sparecon64 = {0 <repeats 17 times>}, 
  fs_sblockloc = 65536, fs_cstotal = {cs_ndir = 38596, cs_nbfree = 438709, 
    cs_nifree = 998225, cs_nffree = 9262, cs_numclusters = 0, cs_spare = {0, 
---Type <return> to continue, or q <return> to quit---
      0, 0}}, fs_time = 1051791990, fs_size = 4828884, fs_dsize = 4674923, 
  fs_csaddr = 3000, fs_pendingblocks = 1048, fs_pendinginodes = 1, 
  fs_snapinum = {0 <repeats 20 times>}, fs_avgfilesize = 16384, 
  fs_avgfpdir = 64, fs_save_cgsize = 0, fs_sparecon32 = {
    0 <repeats 26 times>}, fs_flags = 2, fs_contigsumsize = 8, 
  fs_maxsymlinklen = 120, fs_old_inodefmt = 0, 
  fs_maxfilesize = 140806241583103, fs_qbmask = 16383, fs_qfmask = 2047, 
  fs_state = 0, fs_old_postblformat = 0, fs_old_nrpos = 0, fs_spare5 = {0, 0}, 
  fs_magic = 424935705}
(kgdb) quit
root_at_wombat:/usr/obj/usr/home/stefan/freebsd/src/sys/WOMBAT 5 (0)# dumpfs /usr/home | head -17
magic	19540119 (UFS2)	time	Thu May  1 15:28:58 2003
superblock location	65536	id	[ 3e92fc00 3396cf33 ]
ncg	52	size	4828884	blocks	4674923
bsize	16384	shift	14	mask	0xffffc000
fsize	2048	shift	11	mask	0xfffff800
frag	8	shift	3	fsbtodb	2
minfree	8%	optim	time	symlinklen 120
maxbsize 16384	maxbpg	2048	maxcontig 8	contigsumsize 8
nbfree	438912	ndir	38596	nifree	998248	nffree	9272
bpg	11761	fpg	94088	ipg	23552
nindir	2048	inopb	64	maxfilesize	140806241583103
sbsize	2048	cgsize	16384	csaddr	3000	cssize	2048
sblkno	40	cblkno	48	iblkno	56	dblkno	3000
cgrotor	14	fmod	0	ronly	0	clean	0
flags	soft-updates 
fsmnt	/usr/home
volname		swuid	0
root_at_wombat:/usr/obj/usr/home/stefan/freebsd/src/sys/WOMBAT 6 (0)# exit

Script done on Thu May  1 15:31:08 2003


The kernel sources are 2 days old.  Any additional information wanted?

Regards,
Stefan Farfeleder
Received on Thu May 01 2003 - 04:50:17 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:05 UTC