From owner-freebsd-bugs@FreeBSD.ORG Sun Jun 28 09:30:04 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BDB0E1065677 for ; Sun, 28 Jun 2009 09:30:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 9A0538FC17 for ; Sun, 28 Jun 2009 09:30:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n5S9U471052808 for ; Sun, 28 Jun 2009 09:30:04 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n5S9U4SJ052807; Sun, 28 Jun 2009 09:30:04 GMT (envelope-from gnats) Resent-Date: Sun, 28 Jun 2009 09:30:04 GMT Resent-Message-Id: <200906280930.n5S9U4SJ052807@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Barbara Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E2EC3106566C for ; Sun, 28 Jun 2009 09:19:55 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id C6E938FC08 for ; Sun, 28 Jun 2009 09:19:55 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n5S9Jtjh069069 for ; Sun, 28 Jun 2009 09:19:55 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n5S9Jt0M069068; Sun, 28 Jun 2009 09:19:55 GMT (envelope-from nobody) Message-Id: <200906280919.n5S9Jt0M069068@www.freebsd.org> Date: Sun, 28 Jun 2009 09:19:55 GMT From: Barbara To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/136120: panic: free: address has not been allocated. X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jun 2009 09:30:05 -0000 >Number: 136120 >Category: kern >Synopsis: panic: free: address has not been allocated. >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Jun 28 09:30:04 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Barbara >Release: 7-STABLE >Organization: >Environment: FreeBSD satanasso.local.net 7.2-STABLE FreeBSD 7.2-STABLE #0: Sat Jun 27 11:45:31 CEST 2009 root@satanasso.local.net:/usr/obj/usr/src/sys/SATANASSO i386 >Description: # kgdb kernel.debug /var/crash/vmcore.15 GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Unread portion of the kernel message buffer: panic: free: address 0xc7043680(0xc7043000) has not been allocated. cpuid = 1 Uptime: 21h44m27s Physical memory: 2031 MB Dumping 277 MB: 262 246 230 214 198 182 166 150 134 118 102 86 70 54 38 22 6 Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/linux.ko.symbols...done. done. Loaded symbols for /boot/kernel/linux.ko Reading symbols from /boot/modules/nvidia.ko...done. Loaded symbols for /boot/modules/nvidia.ko Reading symbols from /boot/kernel/acpi.ko...Reading symbols from /boot/kernel/acpi.ko.symbols...done. done. Loaded symbols for /boot/kernel/acpi.ko Reading symbols from /boot/kernel/linprocfs.ko...Reading symbols from /boot/kernel/linprocfs.ko.symbols...done. done. Loaded symbols for /boot/kernel/linprocfs.ko Reading symbols from /boot/kernel/logo_saver.ko...Reading symbols from /boot/kernel/logo_saver.ko.symbols...done. done. Loaded symbols for /boot/kernel/logo_saver.ko #0 doadump () at pcpu.h:196 196 __asm __volatile("movl %%fs:0,%0" : "=r" (td)); (kgdb) bt #0 doadump () at pcpu.h:196 #1 0xc059a827 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418 #2 0xc059aafc in panic (fmt=Variable "fmt" is not available. ) at /usr/src/sys/kern/kern_shutdown.c:574 #3 0xc05886c0 in free (addr=0x0, mtp=0xc0865400) at /usr/src/sys/kern/kern_malloc.c:446 #4 0xc05d4eab in writev (td=0xc647cd80, uap=0xc5766cfc) at /usr/src/sys/kern/sys_generic.c:389 #5 0xc07decd5 in syscall (frame=0xc5766d38) at /usr/src/sys/i386/i386/trap.c:1089 #6 0xc07c4760 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:262 #7 0x00000033 in ?? () Previous frame inner to this frame (corrupt stack?) (kgdb) frame 4 #4 0xc05d4eab in writev (td=0xc647cd80, uap=0xc5766cfc) at /usr/src/sys/kern/sys_generic.c:389 389 free(auio, M_IOV); (kgdb) list 384 385 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 386 if (error) 387 return (error); 388 error = kern_writev(td, uap->fd, auio); 389 free(auio, M_IOV); 390 return (error); 391 } 392 393 int (kgdb) print auio $1 = (struct uio *) 0xc7043680 (kgdb) print M_IOV $2 = {{ks_next = 0xc0865360, _ks_memuse = 0, _ks_size = 0, _ks_inuse = 0, _ks_calls = 0, _ks_maxused = 0, ks_magic = 877983977, ks_shortdesc = 0xc082f926 "iov", ks_handle = 0xc5816810, _lo_name = 0x0, _lo_type = 0x0, _lo_flags = 0, _lo_list_next = 0x0, _lo_witness = 0x0, _mtx_lock = 0, _mtx_recurse = 0}} >How-To-Repeat: >Fix: >Release-Note: >Audit-Trail: >Unformatted: