Date: Thu, 21 Jan 2010 21:28:36 GMT From: Steve <fbsdpr@s.rhythm.cx> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/143069: Xen Kernel Panic - Memory modified after free (8.0-RELEASE) Message-ID: <201001212128.o0LLSawJ002024@www.freebsd.org> Resent-Message-ID: <201001212130.o0LLU5gT033522@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 143069 >Category: kern >Synopsis: Xen Kernel Panic - Memory modified after free (8.0-RELEASE) >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Jan 21 21:30:04 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Steve >Release: 8.0-RELEASE >Organization: >Environment: FreeBSD io 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Thu Jan 21 20:30:21 EST 2010 root@build:/usr/obj/usr/src/sys/SXEN i386 uname -a from xen host: Linux zion 2.6.26-2-xen-686 #1 SMP Wed Nov 4 23:23:33 UTC 2009 i686 GNU/Linux >Description: I randomly get kernel panics running FreeBSD 8.0 within a Xen virtual machine. The host is i386. Here's what was displayed on the console at the time of one such panic: Memory modified after free 0xc1405000(4092) val=deadc0e9 @ 0xc1405878 panic: Most recently used by subproc cpuid = 0 KDB: enter: panic [thread pid 887 tid 100047 ] Stopped at kdb_enter+0x3a: movl $0,kdb_why db> My kernel conf file, xen VM conf file, 'xm info' are all attached. >How-To-Repeat: Occurs randomly >Fix: Patch attached with submission follows: # This is a shell archive. Save it in a file, remove anything before # this line, and then unpack it by entering "sh file". Note, it may # create directories; files and directories will be owned by you and # have default permissions. # # This archive contains: # # kernel_conf # panic_message # xen_conf # xm_info # echo x - kernel_conf sed 's/^X//' >kernel_conf << '918fbf5af05ea8c4ebb509cf9907594d' X# X# XEN -- Kernel configuration for i386 XEN DomU X# X# $FreeBSD: src/sys/i386/conf/XEN,v 1.9.2.1.2.1 2009/10/25 01:10:29 kensmith Exp $ X Xcpu I686_CPU Xident XEN X Xmakeoptions DEBUG=-g # Build kernel with gdb(1) debug symbols Xmakeoptions MODULES_OVERRIDE="" X Xoptions SCHED_ULE # ULE scheduler Xoptions PREEMPTION # Enable kernel thread preemption X#options SCHED_4BSD X Xoptions INET # InterNETworking Xoptions INET6 # IPv6 communications protocols Xoptions SCTP # Stream Control Transmission Protocol Xoptions FFS # Berkeley Fast Filesystem Xoptions SOFTUPDATES # Enable FFS soft updates support Xoptions UFS_ACL # Support for access control lists Xoptions UFS_DIRHASH # Improve performance on big directories Xoptions UFS_GJOURNAL # Enable gjournal-based UFS journaling Xoptions NFSCLIENT # Network Filesystem Client Xoptions NFSSERVER # Network Filesystem Server Xoptions NFSLOCKD # Network Lock Manager Xoptions NFS_ROOT # NFS usable as /, requires NFSCLIENT Xoptions MSDOSFS # MSDOS Filesystem Xoptions CD9660 # ISO 9660 Filesystem Xoptions PROCFS # Process filesystem (requires PSEUDOFS) Xoptions PSEUDOFS # Pseudo-filesystem framework Xoptions GEOM_PART_GPT # GUID Partition Tables. Xoptions GEOM_LABEL # Provides labelization Xoptions COMPAT_43TTY # BSD 4.3 TTY compat (sgtty) Xoptions COMPAT_FREEBSD4 # Compatible with FreeBSD4 Xoptions COMPAT_FREEBSD5 # Compatible with FreeBSD5 Xoptions COMPAT_FREEBSD6 # Compatible with FreeBSD6 Xoptions COMPAT_FREEBSD7 # Compatible with FreeBSD7 Xoptions KTRACE # ktrace(1) support Xoptions STACK # stack(9) support Xoptions SYSVSHM # SYSV-style shared memory Xoptions SYSVMSG # SYSV-style message queues Xoptions SYSVSEM # SYSV-style semaphores Xoptions _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions Xoptions KBD_INSTALL_CDEV # install a CDEV entry in /dev Xoptions AUDIT # Security event auditing X X# Debugging for use in -current Xoptions KDB # Enable kernel debugger support. Xoptions DDB # Support DDB. Xoptions GDB # Support remote GDB. Xoptions INVARIANTS # Enable calls of extra sanity checking Xoptions INVARIANT_SUPPORT # Extra sanity checks of internal structures, required by INVARIANTS Xoptions WITNESS # Enable checks to detect deadlocks and cycles Xoptions WITNESS_SKIPSPIN # Don't run witness on spinlocks for speed X Xoptions PAE Xnooption NATIVE Xoption XEN Xnodevice atpic Xnodevice isa Xoptions MCLSHIFT=12 X X# To make an SMP kernel, the next two lines are needed Xoptions SMP # Symmetric MultiProcessor Kernel Xdevice apic # I/O APIC X X Xdevice atkbdc # AT keyboard controller Xdevice atkbd # AT keyboard Xdevice psm # PS/2 mouse Xdevice pci X Xdevice kbdmux # keyboard multiplexer X X# Pseudo devices. Xdevice loop # Network loopback Xdevice random # Entropy device Xdevice ether # Ethernet support Xdevice tun # Packet tunnel. Xdevice pty # Pseudo-ttys (telnet etc) Xdevice md # Memory "disks" Xdevice gif # IPv6 and IPv4 tunneling Xdevice faith # IPv6-to-IPv4 relaying (translation) X X# The `bpf' device enables the Berkeley Packet Filter. X# Be aware of the administrative consequences of enabling this! X# Note that 'bpf' is required for DHCP. Xdevice bpf # Berkeley packet filter X Xdevice pf Xdevice pflog Xoptions ALTQ Xoptions ALTQ_CBQ Xoptions ALTQ_RED Xoptions ALTQ_RIO Xoptions ALTQ_HFSC Xoptions ALTQ_CDNR Xoptions ALTQ_PRIQ Xoptions ALTQ_NOPCC Xoptions ALTQ_DEBUG 918fbf5af05ea8c4ebb509cf9907594d echo x - panic_message sed 's/^X//' >panic_message << '0cc79c80a309fbd42d82ff1b959cf447' XMemory modified after free 0xc1405000(4092) val=deadc0e9 @ 0xc1405878 Xpanic: Most recently used by subproc X Xcpuid = 0 XKDB: enter: panic X[thread pid 887 tid 100047 ] XStopped at kdb_enter+0x3a: movl $0,kdb_why Xdb> 0cc79c80a309fbd42d82ff1b959cf447 echo x - xen_conf sed 's/^X//' >xen_conf << '0efe0e465773a1ccc925f94ff8e8d377' Xkernel = '/boot/freebsd-sxen-8.0' Xmemory = '128' X# 0xCA00=xbd0, 0xCA10=xbd1, 0xCA20=xbd2, etc... Xdisk = [ 'file:/v/domains/io/root.img,0xCA00,w' ] Xname = 'io' Xvif = [ 'mac=00:16:3E:D1:AC:39' ] X Xon_poweroff = 'destroy' Xon_reboot = 'restart' Xon_crash = 'preserve' X Xextra = "boot_verbose=0" Xextra += ",vfs.root.mountfrom=ufs:/dev/xbd0" Xextra += ",kern.hz=100" 0efe0e465773a1ccc925f94ff8e8d377 echo x - xm_info sed 's/^X//' >xm_info << 'ee657461338f760680553136f579a67f' Xhost : zion Xrelease : 2.6.26-2-xen-686 Xversion : #1 SMP Wed Nov 4 23:23:33 UTC 2009 Xmachine : i686 Xnr_cpus : 4 Xnr_nodes : 1 Xcores_per_socket : 1 Xthreads_per_core : 2 Xcpu_mhz : 3056 Xhw_caps : bfebfbff:00000000:00000000:00000080:00004400 Xtotal_memory : 5631 Xfree_memory : 0 Xnode_to_cpu : node0:0-3 Xxen_major : 3 Xxen_minor : 2 Xxen_extra : -1 Xxen_caps : xen-3.0-x86_32p Xxen_scheduler : credit Xxen_pagesize : 4096 Xplatform_params : virt_start=0xf5800000 Xxen_changeset : unavailable Xcc_compiler : gcc version 4.3.1 (Debian 4.3.1-2) Xcc_compile_by : waldi Xcc_compile_domain : debian.org Xcc_compile_date : Sat Jun 28 15:25:00 UTC 2008 Xxend_config_format : 4 ee657461338f760680553136f579a67f exit >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201001212128.o0LLSawJ002024>