Okay, I am alittle dense in reading the soreceive() debugger line, basically the debugger trace must refer to an expansion of the m_free() inline definition in soreceive(). Either a callout is not being removed when the memory is freed and that memory is recycled to an MBUF OR someone is incorrectly chaining a memory location into an MBUF. before too much work is done (below), could you print out the callout that is being freed but active and the memory around it (before it is overwritten by "deadc0de"). It may tell us which callout that it is or was. You should be able to do that with your existing kernel. If we cannot glean who the callout is/was, then more tests can be added to determine if the UMA is allocating memory chained to the callout or if the MBUF chain is corrupted. --Mark TinguelyReceived on Tue Nov 08 2005 - 22:13:39 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:47 UTC