Re: "Memory modified after free" - by whom?

From: Gleb Smirnoff <glebius_at_FreeBSD.org>
Date: Tue, 11 Dec 2012 11:53:43 +0400
On Mon, Dec 10, 2012 at 03:18:45PM -0800, mdf_at_freebsd.org wrote:
m> On Mon, Dec 10, 2012 at 3:10 PM, Adrian Chadd <adrian_at_freebsd.org> wrote:
m> > 9216 sounds like a jumbo frame mbuf. So the NIC is writing to an mbuf
m> > after it's finalised/freed.
m> >
m> > I have a similar bug showing up on ath(4) RX. :(
m> 
m> Compile with DEBUG_MEMGUARD in the kernel configuration, and then set
m> vm.memguard.desc to the name of the UMA zone used for the 9216 byte
m> allocations, mbuf_jumbo_9k.  This should cause a panic when the memory
m> is touched after free.

DEBUG_MEMGUARD doesn't work with cluster zone, I'm afraid it won't work
with mbuf_jumbo_9k, too, but I didn't try this.

The problem is documented in BUGS in memguard(9).


-- 
Totus tuus, Glebius.
Received on Tue Dec 11 2012 - 06:53:45 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:33 UTC