From owner-freebsd-net@FreeBSD.ORG  Tue Dec 11 07:53:45 2012
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 2FDCA2D7;
 Tue, 11 Dec 2012 07:53:45 +0000 (UTC)
 (envelope-from glebius@FreeBSD.org)
Received: from cell.glebius.int.ru (glebius.int.ru [81.19.69.10])
 by mx1.freebsd.org (Postfix) with ESMTP id 9794D8FC14;
 Tue, 11 Dec 2012 07:53:43 +0000 (UTC)
Received: from cell.glebius.int.ru (localhost [127.0.0.1])
 by cell.glebius.int.ru (8.14.5/8.14.5) with ESMTP id qBB7rheP090531;
 Tue, 11 Dec 2012 11:53:43 +0400 (MSK)
 (envelope-from glebius@FreeBSD.org)
Received: (from glebius@localhost)
 by cell.glebius.int.ru (8.14.5/8.14.5/Submit) id qBB7rhx9090530;
 Tue, 11 Dec 2012 11:53:43 +0400 (MSK)
 (envelope-from glebius@FreeBSD.org)
X-Authentication-Warning: cell.glebius.int.ru: glebius set sender to
 glebius@FreeBSD.org using -f
Date: Tue, 11 Dec 2012 11:53:43 +0400
From: Gleb Smirnoff <glebius@FreeBSD.org>
To: mdf@FreeBSD.org
Subject: Re: "Memory modified after free" - by whom?
Message-ID: <20121211075343.GT48639@FreeBSD.org>
References: <CAGH67wQKUDLQmL8cnWwgzQpWAN2OhKLu0AemPNuy7EOC-i1p9g@mail.gmail.com>
 <CAJ-Vmo=MsSV3DhAVEP36d+FccHDdQz7+y7v5xTjYKyBP0PfQoQ@mail.gmail.com>
 <CAMBSHm96ZEiF4mOhUyk-aDS+Gs+hDsh_dMsd-WFcmZ+Sm6Zk+A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <CAMBSHm96ZEiF4mOhUyk-aDS+Gs+hDsh_dMsd-WFcmZ+Sm6Zk+A@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: Garrett Cooper <yanegomi@gmail.com>, freebsd-net@FreeBSD.org,
 Adrian Chadd <adrian@FreeBSD.org>,
 FreeBSD Current <freebsd-current@FreeBSD.org>
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Dec 2012 07:53:45 -0000

On Mon, Dec 10, 2012 at 03:18:45PM -0800, mdf@freebsd.org wrote:
m> On Mon, Dec 10, 2012 at 3:10 PM, Adrian Chadd <adrian@freebsd.org> wrote:
m> > 9216 sounds like a jumbo frame mbuf. So the NIC is writing to an mbuf
m> > after it's finalised/freed.
m> >
m> > I have a similar bug showing up on ath(4) RX. :(
m> 
m> Compile with DEBUG_MEMGUARD in the kernel configuration, and then set
m> vm.memguard.desc to the name of the UMA zone used for the 9216 byte
m> allocations, mbuf_jumbo_9k.  This should cause a panic when the memory
m> is touched after free.

DEBUG_MEMGUARD doesn't work with cluster zone, I'm afraid it won't work
with mbuf_jumbo_9k, too, but I didn't try this.

The problem is documented in BUGS in memguard(9).


-- 
Totus tuus, Glebius.