On Fri, Jun 24, 2005 at 04:26:55PM +0200, Thierry Herbelot wrote: > > This is with an SMP machine (oldish BP6) > It seems as thou I got the same one: panic: Memory modified after free 0xc216d500(256) val=c1d5e100 _at_ 0xc216d500 cpuid = 0 KDB: enter: panic [thread pid 37 tid 100020 ] Stopped at kdb_enter+0x2b: nop db> where Tracing pid 37 tid 100020 td 0xc1540480 kdb_enter(c0852679) at kdb_enter+0x2b panic(c086d47e,c216d500,100,c1d5e100,c216d500) at panic+0x14b trash_ctor(c216d500,100,cbfa0b04,1,c104a9d8) at trash_ctor+0x2f mb_ctor_mbuf(c216d500,100,cbfa0b04,1) at mb_ctor_mbuf+0x18 uma_zalloc_arg(c104a9a0,cbfa0b04,1) at uma_zalloc_arg+0x10f m_copym(c1739300,16a0,5a8,1,5cef834) at m_copym+0x11c tcp_output(c1fe78fc) at tcp_output+0xa42 tcp_input(c178ab00,14,c178ab00,0,0) at tcp_input+0x2b0f ip_input(c178ab00) at ip_input+0x511 netisr_processqueue(c099eb38) at netisr_processqueue+0x6e swi_net(0) at swi_net+0xbe ithread_loop(c1573480,cbfa0d38,...) at ithread_loop+0x11c fork_exit(c061bba0,c1573480,cbfa0d38) at fork_exit+0xa0 fork_trampoline() at fork_trampoline+0x8 Details at http://www.holm.cc/stress/log/cons136.html - Peter > > multi-cur# kgdb kernel.debug /files3/tmp/vmcore.154 > [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: > Undefined symbol "ps_pglobal_lookup"] > GNU gdb 6.1.1 [FreeBSD] > Copyright 2004 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "i386-marcel-freebsd". > #0 doadump () at pcpu.h:165 > 165 __asm __volatile("movl %%fs:0,%0" : "=r" (td)); > (kgdb) bt > #0 doadump () at pcpu.h:165 > #1 0xc046897a in db_fncall (dummy1=0, dummy2=0, dummy3=-1067166101, > dummy4=0xcc89d8d4 "\bÙ\211Ì") at /usr/src/sys/ddb/db_command.c:531 > #2 0xc0468788 in db_command (last_cmdp=0xc08fc464, cmd_table=0x0, > aux_cmd_tablep=0xc0879f00, > aux_cmd_tablep_end=0xc0879f1c) at /usr/src/sys/ddb/db_command.c:349 > #3 0xc0468850 in db_command_loop () at /usr/src/sys/ddb/db_command.c:455 > #4 0xc046a3d5 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:221 > #5 0xc0645904 in kdb_trap (type=3, code=0, tf=0xcc89da18) > at /usr/src/sys/kern/subr_kdb.c:471 > #6 0xc07e7cbc in trap (frame= > {tf_fs = -863436792, tf_es = -1067188184, tf_ds = -1065025496, tf_edi = > -1064921604, tf_esi = 1, tf_ebp = -863380904, tf_isp = -863380924, tf_ebx = > -863380860, tf_edx = 0, tf_ecx = -1056755712, tf_eax = 18, tf_trapno = 3, > tf_err = 0, tf_eip = -1067166101, tf_cs = 32, tf_eflags = 642, tf_esp = > -863380872, tf_ss = -1067263353}) at /usr/src/sys/i386/i386/trap.c:598 > #7 0xc07d583a in calltrap () at /usr/src/sys/i386/i386/exception.s:139 > #8 0xcc890008 in ?? () > #9 0xc0640028 in blst_radix_init (scan=0xc084ecf5, > radix=-4516961442427043584, > skip=-1050930176, count=Unhandled dwarf expression opcode 0x93 > ) at /usr/src/sys/kern/subr_blist.c:885 > #10 0xc062da87 in panic (fmt=0x282 <Address 0x282 out of bounds>) > at /usr/src/sys/kern/kern_shutdown.c:537 > #11 0xc077be53 in trash_ctor (mem=0xc15c1400, size=0, arg=0xcc89db40, flags=1) > at /usr/src/sys/vm/uma_dbg.c:72 > #12 0xc0624bd8 in mb_ctor_mbuf (mem=0xc15c1400, size=256, arg=0xcc89db40, > how=1) > at /usr/src/sys/kern/kern_mbuf.c:204 > #13 0xc077a85f in uma_zalloc_arg (zone=0xc104a9a0, udata=0xcc89db40, flags=1) > at /usr/src/sys/vm/uma_core.c:1839 > #14 0xc06c66ed in tcp_output (tp=0xc165eac8) at mbuf.h:392 > ---Type <return> to continue, or q <return> to quit---q > Quit > (kgdb) frame 11 > #11 0xc077be53 in trash_ctor (mem=0xc15c1400, size=0, arg=0xcc89db40, flags=1) > at /usr/src/sys/vm/uma_dbg.c:72 > 72 panic("Memory modified after free %p(%d) > val=%x _at_ %p\n", > (kgdb) list > 67 > 68 cnt = size / sizeof(uma_junk); > 69 > 70 for (p = mem; cnt > 0; cnt--, p++) > 71 if (*p != uma_junk) > 72 panic("Memory modified after free %p(%d) > val=%x _at_ %p\n", > 73 mem, size, *p, p); > 74 return (0); > 75 } > 76 > (kgdb) frame 13 > #13 0xc077a85f in uma_zalloc_arg (zone=0xc104a9a0, udata=0xcc89db40, flags=1) > at /usr/src/sys/vm/uma_core.c:1839 > 1839 if (zone->uz_ctor(item, > zone->uz_keg->uk_size, > (kgdb) list > 1834 ZONE_LOCK(zone); > 1835 uma_dbg_alloc(zone, NULL, item); > 1836 ZONE_UNLOCK(zone); > 1837 #endif > 1838 if (zone->uz_ctor != NULL) { > 1839 if (zone->uz_ctor(item, > zone->uz_keg->uk_size, > 1840 udata, flags) != 0) { > 1841 uma_zfree_internal(zone, item, > udata, > 1842 SKIP_DTOR); > 1843 return (NULL); > (kgdb) print *zone > $1 = {uz_name = 0xc084d5b0 "Mbuf", uz_lock = 0xc10443c8, uz_keg = 0xc10443c0, > uz_link = { > le_next = 0xc104ac60, le_prev = 0xc10443f8}, uz_full_bucket = {lh_first = > 0x0}, > uz_free_bucket = {lh_first = 0x0}, uz_ctor = 0xc0624bc0 <mb_ctor_mbuf>, > uz_dtor = 0xc0624c30 <mb_dtor_mbuf>, uz_init = 0, uz_fini = 0, uz_allocs = > 1993622, > uz_fills = 0, uz_count = 128, uz_cpu = {{uc_freebucket = 0xc15b820c, > uc_allocbucket = 0xc103d20c, uc_allocs = 3}}} > > multi-cur# ident kernel.debug | grep uma_dbg.c > $FreeBSD: src/sys/vm/uma_dbg.c,v 1.19 2005/02/16 21:45:59 bmilekic Exp $ > multi-cur# ident kernel.debug | grep kern_mbuf.c > $FreeBSD: src/sys/kern/kern_mbuf.c,v 1.8 2005/06/23 04:33:39 silby Exp $ > multi-cur# ident kernel.debug | grep uma_core.c > $FreeBSD: src/sys/vm/uma_core.c,v 1.119 2005/04/29 18:56:36 rwatson Exp $ > _______________________________________________ > freebsd-current_at_freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe_at_freebsd.org"Received on Fri Jun 24 2005 - 14:44:36 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:37 UTC