Date: Wed, 25 May 2011 22:33:13 +0200 From: Joerg Wunsch <j@uriah.heep.sax.de> To: FreeBSD-gnats-submit@freebsd.org, freebsd-bugs@FreeBSD.org Subject: Re: kern/157287: re0: INVARIANTS panic (Memory modified after free) Message-ID: <20110525203313.GA11763@uriah.heep.sax.de> In-Reply-To: <201105240610.p4O6A94E003499@freefall.freebsd.org> References: <20110524060026.E8285AA@uriah.heep.sax.de> <201105240610.p4O6A94E003499@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Some more analysis on the stack trace:
re_attach+0x118a corresponds to re_allocmem(), line 1085:
/* Allocate DMA'able memory for the RX ring */
error = bus_dmamem_alloc(sc->rl_ldata.rl_rx_list_tag,
(void **)&sc->rl_ldata.rl_rx_list,
BUS_DMA_WAITOK | BUS_DMA_COHERENT | BUS_DMA_ZERO,
&sc->rl_ldata.rl_rx_list_map);
callee bus_dmamem_alloc+0x8a is i386/i386/busdma_machdep.c,
bus_dmamem_alloc() line 526:
/*
* XXX:
* (dmat->alignment < dmat->maxsize) is just a quick hack; the exact
* alignment guarantees of malloc need to be nailed down, and the
* code below should be rewritten to take that into account.
*
* In the meantime, we'll warn the user if malloc gets it wrong.
*/
if ((dmat->maxsize <= PAGE_SIZE) &&
(dmat->alignment < dmat->maxsize) &&
dmat->lowaddr >= ptoa((vm_paddr_t)Maxmem)) {
*vaddr = malloc(dmat->maxsize, M_DEVBUF, mflags);
} else {
I could not spot anything obvious though.
--
cheers, J"org .-.-. --... ...-- -.. . DL8DTL
http://www.sax.de/~joerg/ NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110525203313.GA11763>