Re: Panic on shutdown _at_r328436: "Unholding 6 with cnt = -559038242"

In message <CANCZdfpgo7=O+NvQH_Vh56U1sSd92_3TmNGDiSF+xMXzQQNsnA_at_mail.gma
il.com>
, Warner Losh writes:
> --94eb2c0425900a5b5c0563e1b5b8
> Content-Type: text/plain; charset="UTF-8"
> Content-Transfer-Encoding: quoted-printable
>
> On Sun, Jan 28, 2018 at 7:38 PM, Cy Schubert <Cy.Schubert_at_cschubert.com>
> wrote:
>
> > In message <2effa324-c428-6135-371b-acb00c803d29_at_freebsd.org>, Allan
> > Jude write
> > s:
> > > On 2018-01-28 16:28, Warner Losh wrote:
> > > > On Sun, Jan 28, 2018 at 2:22 PM, thomas masper <
> > thomas.masper_at_gmail.com>
> > > > wrote:
> > > >
> > > >> Hi,
> > > >> similar panic happen to me when extracting a pendrive from laptop US=
> B
> > port
> > > >> (I tried 3 different pendrive).
> > > >> No issue if I reboot or shutdown. I don't know if those two issues a=
> re
> > > >> related.
> > > >>
> > > >
> > > > Do you have a reproducible test case? Ideally, it would be 'insert an=
> d
> > > > remove usb thumb drive' but maybe there's more steps between insert a=
> nd
> > > > removal.
> > > >
> > > > Warner
> > > >
> > > >
> > > >
> > > >> panic: Releasing 6 with cnt =3D -559038242
> >
> > Converting this to hex we get DEADC0DE.
>
>
> vm/uma_dbg.c:static const uint32_t uma_junk =3D 0xdeadc0de;
>
> Use after free it is then...

Yes, INVARIANTS. Learned that when I was chasing an ipfilter use after 
free.


-- 
Cheers,
Cy Schubert <Cy.Schubert_at_cschubert.com>
FreeBSD UNIX:  <cy_at_FreeBSD.org>   Web:  http://www.FreeBSD.org

	The need of the many outweighs the greed of the few.