Date: Sun, 19 Aug 2018 09:42:25 +0000 From: bugzilla-noreply@freebsd.org To: fs@FreeBSD.org Subject: [Bug 227784] zfs: Fatal trap 9: general protection fault while in kernel mode on shutdown Message-ID: <bug-227784-3630-MrjFgY74VK@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-227784-3630@https.bugs.freebsd.org/bugzilla/> References: <bug-227784-3630@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=227784 Vladimir Kondratyev <wulf@freebsd.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wulf@freebsd.org --- Comment #10 from Vladimir Kondratyev <wulf@freebsd.org> --- (In reply to Andriy Gapon from comment #6) > Do you still have the crash dump? > If so, could you please provide full output of 'p *dd' ? I still observe the panic everyday, so I have a crash dump: (kgdb) frame 10 #10 0xffffffff8035f6dc in dsl_dir_evict_async (dbu=0xfffff80006b67400) at /usr/src/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_dir.c:158 158 spa_async_close(dd->dd_pool->dp_spa, dd); (kgdb) p *dd $7 = {dd_dbu = {dbu_tqent = {tqent_task = {ta_link = { stqe_next = 0xfffff8000689b400}, ta_pending = 0, ta_priority = 0, ta_func = 0xffffffff802f5410 <taskq_run_ent>, ta_context = 0xfffff80006b67400}, tqent_func = 0xffffffff8035f4e0 <dsl_dir_evict_async>, tqent_arg = 0xfffff80006b67400}, dbu_evict_func_sync = 0x0, dbu_evict_func_async = 0xffffffff8035f4e0 <dsl_dir_evict_async>, dbu_clear_on_evict_dbufp = 0xfffff80006b67458}, dd_object = 12, dd_pool = 0xfffff800066f5800, dd_dbuf = 0x0, dd_dirty_link = {tn_next = { 0x0, 0x0, 0x0, 0x0}, tn_member = "\000\000\000"}, dd_parent = 0xfffff80006b66c00, dd_lock = {lock_object = { lo_name = 0xffffffff80999c14 "dd->dd_lock", lo_flags = 577830912, lo_data = 0, lo_witness = 0x0}, sx_lock = 1}, dd_props = { list_size = 56, list_offset = 0, list_head = { list_next = 0xfffff80006b674c0, list_prev = 0xfffff80006b674c0}}, dd_snap_cmtime = {tv_sec = 1534644915, tv_nsec = 715064905}, dd_origin_txg = 0, dd_tempreserved = {0, 0, 0, 0}, dd_space_towrite = {0, 0, 0, 0}, dd_myname = "$ORIGIN", '\000' <repeats 248 times>} (kgdb) printf "%X\n", *(int *)dd->dd_pool DEADC0DE It looks like memory referenced by dd->dd_pool is already freed when spa_async_close() is called. -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-227784-3630-MrjFgY74VK>