Date: Wed, 25 May 2011 20:40:11 GMT From: Joerg Wunsch <j@uriah.heep.sax.de> To: freebsd-net@FreeBSD.org Subject: Re: kern/157287: re0: INVARIANTS panic (Memory modified after free) Message-ID: <201105252040.p4PKeB6B082921@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/157287; it has been noted by GNATS.
From: Joerg Wunsch <j@uriah.heep.sax.de>
To: FreeBSD-gnats-submit@freebsd.org, freebsd-bugs@FreeBSD.org
Cc:
Subject: Re: kern/157287: re0: INVARIANTS panic (Memory modified after free)
Date: Wed, 25 May 2011 22:33:13 +0200
Some more analysis on the stack trace:
re_attach+0x118a corresponds to re_allocmem(), line 1085:
/* Allocate DMA'able memory for the RX ring */
error = bus_dmamem_alloc(sc->rl_ldata.rl_rx_list_tag,
(void **)&sc->rl_ldata.rl_rx_list,
BUS_DMA_WAITOK | BUS_DMA_COHERENT | BUS_DMA_ZERO,
&sc->rl_ldata.rl_rx_list_map);
callee bus_dmamem_alloc+0x8a is i386/i386/busdma_machdep.c,
bus_dmamem_alloc() line 526:
/*
* XXX:
* (dmat->alignment < dmat->maxsize) is just a quick hack; the exact
* alignment guarantees of malloc need to be nailed down, and the
* code below should be rewritten to take that into account.
*
* In the meantime, we'll warn the user if malloc gets it wrong.
*/
if ((dmat->maxsize <= PAGE_SIZE) &&
(dmat->alignment < dmat->maxsize) &&
dmat->lowaddr >= ptoa((vm_paddr_t)Maxmem)) {
*vaddr = malloc(dmat->maxsize, M_DEVBUF, mflags);
} else {
I could not spot anything obvious though.
--
cheers, J"org .-.-. --... ...-- -.. . DL8DTL
http://www.sax.de/~joerg/ NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201105252040.p4PKeB6B082921>