I got a simular panic with RELENG_5. - #2 0xc04a562a in panic (fmt=0xc0602beb "sbappendstream 1") at /usr/src/sys/kern/kern_shutdown.c:566 #3 0xc04ddd3a in sbappendstream_locked (sb=0xc1838bb4, m=0xc1084600) at /usr/src/sys/kern/uipc_socket2.c:739 #4 0xc0541978 in tcp_input (m=0xc1084600, off0=40) at /usr/src/sys/netinet/tcp_input.c:1295 #5 0xc053b011 in ip_input (m=0xc1084600) at /usr/src/sys/netinet/ip_input.c:776 #6 0xc050e016 in netisr_processqueue (ni=0xc067af38) at /usr/src/sys/net/netisr.c:233 #7 0xc050e1c4 in swi_net (dummy=0x0) at /usr/src/sys/net/netisr.c:340 #8 0xc0493e98 in ithread_loop (arg=0xc0fd9500) at /usr/src/sys/kern/kern_intr.c:547 #9 0xc049330c in fork_exit (callout=0xc0493d74 <ithread_loop>, arg=0xc0fd9500, frame=0xc99add38) -- В Птн, 24.06.2005, в 19:44, Peter Holm пишет: > On Fri, Jun 24, 2005 at 04:26:55PM +0200, Thierry Herbelot wrote: > > > > This is with an SMP machine (oldish BP6) > > > > It seems as thou I got the same one: > > panic: Memory modified after free 0xc216d500(256) val=c1d5e100 _at_ 0xc216d500 > > cpuid = 0 > KDB: enter: panic > [thread pid 37 tid 100020 ] > Stopped at kdb_enter+0x2b: nop > db> where > Tracing pid 37 tid 100020 td 0xc1540480 > kdb_enter(c0852679) at kdb_enter+0x2b > panic(c086d47e,c216d500,100,c1d5e100,c216d500) at panic+0x14b > trash_ctor(c216d500,100,cbfa0b04,1,c104a9d8) at trash_ctor+0x2f > mb_ctor_mbuf(c216d500,100,cbfa0b04,1) at mb_ctor_mbuf+0x18 > uma_zalloc_arg(c104a9a0,cbfa0b04,1) at uma_zalloc_arg+0x10f > m_copym(c1739300,16a0,5a8,1,5cef834) at m_copym+0x11c > tcp_output(c1fe78fc) at tcp_output+0xa42 > tcp_input(c178ab00,14,c178ab00,0,0) at tcp_input+0x2b0f > ip_input(c178ab00) at ip_input+0x511 > netisr_processqueue(c099eb38) at netisr_processqueue+0x6e > swi_net(0) at swi_net+0xbe > ithread_loop(c1573480,cbfa0d38,...) at ithread_loop+0x11c > fork_exit(c061bba0,c1573480,cbfa0d38) at fork_exit+0xa0 > fork_trampoline() at fork_trampoline+0x8 > > Details at http://www.holm.cc/stress/log/cons136.html > > - Peter > > > > > multi-cur# kgdb kernel.debug /files3/tmp/vmcore.154 > > [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: > > Undefined symbol "ps_pglobal_lookup"] > > GNU gdb 6.1.1 [FreeBSD] > > Copyright 2004 Free Software Foundation, Inc. > > GDB is free software, covered by the GNU General Public License, and you are > > welcome to change it and/or distribute copies of it under certain conditions. > > Type "show copying" to see the conditions. > > There is absolutely no warranty for GDB. Type "show warranty" for details. > > This GDB was configured as "i386-marcel-freebsd". > > #0 doadump () at pcpu.h:165 > > 165 __asm __volatile("movl %%fs:0,%0" : "=r" (td)); > > (kgdb) bt > > #0 doadump () at pcpu.h:165 > > #1 0xc046897a in db_fncall (dummy1=0, dummy2=0, dummy3=-1067166101, > > dummy4=0xcc89d8d4 "\bÙ\211Ì") at /usr/src/sys/ddb/db_command.c:531 > > #2 0xc0468788 in db_command (last_cmdp=0xc08fc464, cmd_table=0x0, > > aux_cmd_tablep=0xc0879f00, > > aux_cmd_tablep_end=0xc0879f1c) at /usr/src/sys/ddb/db_command.c:349 > > #3 0xc0468850 in db_command_loop () at /usr/src/sys/ddb/db_command.c:455 > > #4 0xc046a3d5 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:221 > > #5 0xc0645904 in kdb_trap (type=3, code=0, tf=0xcc89da18) > > at /usr/src/sys/kern/subr_kdb.c:471 > > #6 0xc07e7cbc in trap (frame= > > {tf_fs = -863436792, tf_es = -1067188184, tf_ds = -1065025496, tf_edi = > > -1064921604, tf_esi = 1, tf_ebp = -863380904, tf_isp = -863380924, tf_ebx = > > -863380860, tf_edx = 0, tf_ecx = -1056755712, tf_eax = 18, tf_trapno = 3, > > tf_err = 0, tf_eip = -1067166101, tf_cs = 32, tf_eflags = 642, tf_esp = > > -863380872, tf_ss = -1067263353}) at /usr/src/sys/i386/i386/trap.c:598 > > #7 0xc07d583a in calltrap () at /usr/src/sys/i386/i386/exception.s:139 > > #8 0xcc890008 in ?? () > > #9 0xc0640028 in blst_radix_init (scan=0xc084ecf5, > > radix=-4516961442427043584, > > skip=-1050930176, count=Unhandled dwarf expression opcode 0x93 > > ) at /usr/src/sys/kern/subr_blist.c:885 > > #10 0xc062da87 in panic (fmt=0x282 <Address 0x282 out of bounds>) > > at /usr/src/sys/kern/kern_shutdown.c:537 > > #11 0xc077be53 in trash_ctor (mem=0xc15c1400, size=0, arg=0xcc89db40, flags=1) > > at /usr/src/sys/vm/uma_dbg.c:72 > > #12 0xc0624bd8 in mb_ctor_mbuf (mem=0xc15c1400, size=256, arg=0xcc89db40, > > how=1) > > at /usr/src/sys/kern/kern_mbuf.c:204 > > #13 0xc077a85f in uma_zalloc_arg (zone=0xc104a9a0, udata=0xcc89db40, flags=1) > > at /usr/src/sys/vm/uma_core.c:1839 > > #14 0xc06c66ed in tcp_output (tp=0xc165eac8) at mbuf.h:392 > > ---Type <return> to continue, or q <return> to quit---q > > Quit > > (kgdb) frame 11 > > #11 0xc077be53 in trash_ctor (mem=0xc15c1400, size=0, arg=0xcc89db40, flags=1) > > at /usr/src/sys/vm/uma_dbg.c:72 > > 72 panic("Memory modified after free %p(%d) > > val=%x _at_ %p\n", > > (kgdb) list > > 67 > > 68 cnt = size / sizeof(uma_junk); > > 69 > > 70 for (p = mem; cnt > 0; cnt--, p++) > > 71 if (*p != uma_junk) > > 72 panic("Memory modified after free %p(%d) > > val=%x _at_ %p\n", > > 73 mem, size, *p, p); > > 74 return (0); > > 75 } > > 76 > > (kgdb) frame 13 > > #13 0xc077a85f in uma_zalloc_arg (zone=0xc104a9a0, udata=0xcc89db40, flags=1) > > at /usr/src/sys/vm/uma_core.c:1839 > > 1839 if (zone->uz_ctor(item, > > zone->uz_keg->uk_size, > > (kgdb) list > > 1834 ZONE_LOCK(zone); > > 1835 uma_dbg_alloc(zone, NULL, item); > > 1836 ZONE_UNLOCK(zone); > > 1837 #endif > > 1838 if (zone->uz_ctor != NULL) { > > 1839 if (zone->uz_ctor(item, > > zone->uz_keg->uk_size, > > 1840 udata, flags) != 0) { > > 1841 uma_zfree_internal(zone, item, > > udata, > > 1842 SKIP_DTOR); > > 1843 return (NULL); > > (kgdb) print *zone > > $1 = {uz_name = 0xc084d5b0 "Mbuf", uz_lock = 0xc10443c8, uz_keg = 0xc10443c0, > > uz_link = { > > le_next = 0xc104ac60, le_prev = 0xc10443f8}, uz_full_bucket = {lh_first = > > 0x0}, > > uz_free_bucket = {lh_first = 0x0}, uz_ctor = 0xc0624bc0 <mb_ctor_mbuf>, > > uz_dtor = 0xc0624c30 <mb_dtor_mbuf>, uz_init = 0, uz_fini = 0, uz_allocs = > > 1993622, > > uz_fills = 0, uz_count = 128, uz_cpu = {{uc_freebucket = 0xc15b820c, > > uc_allocbucket = 0xc103d20c, uc_allocs = 3}}} > > > > multi-cur# ident kernel.debug | grep uma_dbg.c > > $FreeBSD: src/sys/vm/uma_dbg.c,v 1.19 2005/02/16 21:45:59 bmilekic Exp $ > > multi-cur# ident kernel.debug | grep kern_mbuf.c > > $FreeBSD: src/sys/kern/kern_mbuf.c,v 1.8 2005/06/23 04:33:39 silby Exp $ > > multi-cur# ident kernel.debug | grep uma_core.c > > $FreeBSD: src/sys/vm/uma_core.c,v 1.119 2005/04/29 18:56:36 rwatson Exp $ > > _______________________________________________ > > freebsd-current_at_freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-current > > To unsubscribe, send any mail to "freebsd-current-unsubscribe_at_freebsd.org" > _______________________________________________ > freebsd-current_at_freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe_at_freebsd.org" -- Alex Lyashkov <umka_at_sevinter.net> HomeReceived on Fri Jun 24 2005 - 14:59:41 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:37 UTC