Re: panic: ffs_blkfree: freeing free frag

On Thu, 01 May 2003 14:50:38 +0000, Stefan Farfeleder wrote:

> Hi,
> 
> I just got this panic I'd like to report.  I was doing stuff in X, thus
> I cannot provide a DDB backtrace.

I just got similar, on six hours old CURRENT.

> panic: bremfree: removing a buffer not on a queue
> panic messages:
> ---
> panic: ffs_blkfree: freeing free block

Mine panicked first on ffs_blkfree: freeing free frag. I wasn't doing any
disc activity, just chatting on IRC and maybe checking mail in
background.


(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:238
#1  0xc02213b8 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:370
#2  0xc02216ab in panic () at /usr/src/sys/kern/kern_shutdown.c:543
#3  0xc025fd70 in bremfreel (bp=0xc7802088) at /usr/src/sys/kern/vfs_bio.c:648
#4  0xc025fca5 in bremfree (bp=0x0) at /usr/src/sys/kern/vfs_bio.c:630
#5  0xc02690e8 in vop_stdfsync (ap=0xd5d339f8) at /usr/src/sys/kern/vfs_default.c:759
#6  0xc01ebc00 in spec_fsync (ap=0xd5d339f8) at /usr/src/sys/fs/specfs/spec_vnops.c:418
#7  0xc01eb298 in spec_vnoperate (ap=0x0) at /usr/src/sys/fs/specfs/spec_vnops.c:123
#8  0xc02fd24d in ffs_sync (mp=0xc26eee00, waitfor=2, cred=0xc0eb5e80, td=0xc03f35a0) at vnode_if.h:612
#9  0xc0274c7b in sync (td=0xc03f35a0, uap=0x0) at /usr/src/sys/kern/vfs_syscalls.c:137
#10 0xc0220fc2 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:279
#11 0xc02216ab in panic () at /usr/src/sys/kern/kern_shutdown.c:543
#12 0xc02e51ba in ffs_blkfree (fs=0xc2758000, devvp=0xc27165b4, bno=3703640, size=16384, inum=35768) at /usr/src/sys/ufs/ffs/ffs_alloc.c:1768
#13 0xc02f51af in indir_trunc (freeblks=0xc2de2500, dbn=24882976, level=0, lbn=12, countp=0xd5d33c10)
    at /usr/src/sys/ufs/ffs/ffs_softdep.c:2615
#14 0xc02f4c45 in handle_workitem_freeblocks (freeblks=0xc2de2500, flags=0) at /usr/src/sys/ufs/ffs/ffs_softdep.c:2480
#15 0xc02f1daa in process_worklist_item (matchmnt=0x0, flags=0) at /usr/src/sys/ufs/ffs/ffs_softdep.c:756
#16 0xc02f1ad0 in softdep_process_worklist (matchmnt=0x0) at /usr/src/sys/ufs/ffs/ffs_softdep.c:622
#17 0xc02714fe in sched_sync () at /usr/src/sys/kern/vfs_subr.c:1761
#18 0xc020e24e in fork_exit (callout=0xc0271210 <sched_sync>, arg=0x0, frame=0x0) at /usr/src/sys/kern/kern_fork.c:793


(kgdb) up 12
#12 0xc02e51ba in ffs_blkfree (fs=0xc2758000, devvp=0xc27165b4, bno=3703640, size=16384, inum=35768) at /usr/src/sys/ufs/ffs/ffs_alloc.c:1768
1768                                    panic("ffs_blkfree: freeing free frag");
(kgdb) list
1763                    for (i = 0; i < frags; i++) {
1764                            if (isset(blksfree, cgbno + i)) {
1765                                    printf("dev = %s, block = %jd, fs = %s\n",
1766                                        devtoname(dev), (intmax_t)(bno + i),
1767                                        fs->fs_fsmnt);
1768                                    panic("ffs_blkfree: freeing free frag");
1769                            }
1770                            setbit(blksfree, cgbno + i);
1771                    }
1772                    cgp->cg_cs.cs_nffree += i;


(kgdb) info locals
cgp = (struct cg *) 0xc9a38000
bp = (struct buf *) 0xc7802088
fragno = 4471
cgbno = 35768
cgblkno = -3039022871458462720
i = 4471
error = 0
cg = 39
blk = 0
frags = -1071181980
bbase = -948281016
blksfree = (u_int8_t *) 0xc9a38c2e ""
dev = (struct cdev *) 0xc26e4400


(kgdb) print *fs
$1 = {fs_firstfield = 0, fs_unused_1 = 0, fs_sblkno = 8, fs_cblkno = 16, fs_iblkno = 24, fs_dblkno = 1496, fs_old_cgoffset = 0, 
  fs_old_cgmask = -1, fs_old_time = 1051809814, fs_old_size = 8452528, fs_old_dsize = 8318599, fs_ncg = 90, fs_bsize = 16384, fs_fsize = 2048, 
  fs_frag = 8, fs_minfree = 8, fs_old_rotdelay = 0, fs_old_rps = 60, fs_bmask = -16384, fs_fmask = -2048, fs_bshift = 14, fs_fshift = 11, 
  fs_maxcontig = 8, fs_maxbpg = 2048, fs_fragshift = 3, fs_fsbtodb = 2, fs_sbsize = 2048, fs_spare1 = {0, 0}, fs_nindir = 4096, 
  fs_inopb = 128, fs_old_nspf = 4, fs_optim = 0, fs_old_npsect = 376192, fs_old_interleave = 1, fs_old_trackskew = 0, fs_id = {1047112445, 
    1911299698}, fs_old_csaddr = 1496, fs_cssize = 2048, fs_cgsize = 16384, fs_spare2 = 0, fs_old_nsect = 376192, fs_old_spc = 376192, 
  fs_old_ncyl = 90, fs_old_cpg = 1, fs_ipg = 23552, fs_fpg = 94048, fs_old_cstotal = {cs_ndir = 24490, cs_nbfree = 108437, 
    cs_nifree = 1903649, cs_nffree = 49988}, fs_fmod = 1 '\001', fs_clean = 0 '\0', fs_ronly = 0 '\0', fs_old_flags = -128 '\200', 
  fs_fsmnt = "/usr", '\0' <repeats 463 times>, fs_volname = '\0' <repeats 31 times>, fs_swuid = 0, fs_pad = 0, fs_cgrotor = 59, fs_ocsp = {
    0x0 <repeats 28 times>}, fs_contigdirs = 0xc2625968 "", fs_csp = 0xc2625000, fs_maxcluster = 0xc2625800, fs_active = 0x0, fs_old_cpc = 0, 
  fs_maxbsize = 16384, fs_sparecon64 = {0 <repeats 17 times>}, fs_sblockloc = 8192, fs_cstotal = {cs_ndir = 24493, cs_nbfree = 104496, 
    cs_nifree = 1903726, cs_nffree = 50085, cs_numclusters = 0, cs_spare = {0, 0, 0}}, fs_time = 1051823349, fs_size = 8452528, 
  fs_dsize = 8318599, fs_csaddr = 1496, fs_pendingblocks = 3236, fs_pendinginodes = 1, fs_snapinum = {0 <repeats 20 times>}, 
  fs_avgfilesize = 16384, fs_avgfpdir = 64, fs_save_cgsize = 0, fs_sparecon32 = {0 <repeats 26 times>}, fs_flags = 2, fs_contigsumsize = 8, 
  fs_maxsymlinklen = 60, fs_old_inodefmt = 2, fs_maxfilesize = 17592186044415, fs_qbmask = 16383, fs_qfmask = 2047, fs_state = 0, 
  fs_old_postblformat = 1, fs_old_nrpos = 1, fs_spare5 = {0, 0}, fs_magic = 72020}


-- 
Pav Lucistnik <pav_at_oook.cz>
Muj pocitac neni tak nervozni, je jen trochu ANSI