Date: Wed, 25 May 2011 22:33:13 +0200 From: Joerg Wunsch <j@uriah.heep.sax.de> To: FreeBSD-gnats-submit@freebsd.org, freebsd-bugs@FreeBSD.org Subject: Re: kern/157287: re0: INVARIANTS panic (Memory modified after free) Message-ID: <20110525203313.GA11763@uriah.heep.sax.de> In-Reply-To: <201105240610.p4O6A94E003499@freefall.freebsd.org> References: <20110524060026.E8285AA@uriah.heep.sax.de> <201105240610.p4O6A94E003499@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Some more analysis on the stack trace: re_attach+0x118a corresponds to re_allocmem(), line 1085: /* Allocate DMA'able memory for the RX ring */ error = bus_dmamem_alloc(sc->rl_ldata.rl_rx_list_tag, (void **)&sc->rl_ldata.rl_rx_list, BUS_DMA_WAITOK | BUS_DMA_COHERENT | BUS_DMA_ZERO, &sc->rl_ldata.rl_rx_list_map); callee bus_dmamem_alloc+0x8a is i386/i386/busdma_machdep.c, bus_dmamem_alloc() line 526: /* * XXX: * (dmat->alignment < dmat->maxsize) is just a quick hack; the exact * alignment guarantees of malloc need to be nailed down, and the * code below should be rewritten to take that into account. * * In the meantime, we'll warn the user if malloc gets it wrong. */ if ((dmat->maxsize <= PAGE_SIZE) && (dmat->alignment < dmat->maxsize) && dmat->lowaddr >= ptoa((vm_paddr_t)Maxmem)) { *vaddr = malloc(dmat->maxsize, M_DEVBUF, mflags); } else { I could not spot anything obvious though. -- cheers, J"org .-.-. --... ...-- -.. . DL8DTL http://www.sax.de/~joerg/ NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110525203313.GA11763>