From owner-freebsd-current@FreeBSD.ORG Tue Dec 11 02:34:09 2012 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7CC3B46A; Tue, 11 Dec 2012 02:34:09 +0000 (UTC) (envelope-from nparhar@gmail.com) Received: from mail-pa0-f54.google.com (mail-pa0-f54.google.com [209.85.220.54]) by mx1.freebsd.org (Postfix) with ESMTP id 2E26D8FC12; Tue, 11 Dec 2012 02:34:08 +0000 (UTC) Received: by mail-pa0-f54.google.com with SMTP id bi5so2546103pad.13 for ; Mon, 10 Dec 2012 18:34:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-type:content-disposition:in-reply-to :user-agent; bh=5c1hnPCGJJ7zTmRNDZ70C1RWwdEhcT02D5zQljfG6JM=; b=NkgDfwFsLM5sfdTBr7Lk64kVRKFoe9DWB0TdGegGqmTzdTnCGum88IIEPKl+QjLK3l RnAP+ViYLhUhkO45FcJC6nlHGKJ4eiUOYYTMwVocPlk2A2657QYgm8hOSBOu7pb9dgfM bP31I3BRNyNbHW0pt9ipuSJJYpoZoun9yHqLwOpLXNCBU0a53z2p+HNEAz4hbWZJa0Kq p6TiHwZshwx3VcE7NRp6yg7WP6ckLspX/fLMpPOtx8PFHp0saTdhEO5zKZsOj1RVr4wr nuHIrnlV2uP9B5N4HoCEeo6dxvijc0035s55gr2yz4SeI7uTl9kCuMv1o462PIHvCjEU NrdA== Received: by 10.68.239.104 with SMTP id vr8mr44547947pbc.59.1355193242646; Mon, 10 Dec 2012 18:34:02 -0800 (PST) Received: from itx (c-24-6-45-85.hsd1.ca.comcast.net. [24.6.45.85]) by mx.google.com with ESMTPS id na7sm438594pbc.48.2012.12.10.18.33.59 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 10 Dec 2012 18:34:00 -0800 (PST) Date: Mon, 10 Dec 2012 18:33:54 -0800 From: Navdeep Parhar To: Garrett Cooper Subject: Re: "Memory modified after free" - by whom? Message-ID: <20121211023354.GA1916@itx> Mail-Followup-To: Garrett Cooper , Adrian Chadd , mdf@freebsd.org, FreeBSD Current , freebsd-net@freebsd.org References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Cc: mdf@freebsd.org, Adrian Chadd , FreeBSD Current , freebsd-net@freebsd.org X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 02:34:09 -0000 On Mon, Dec 10, 2012 at 05:37:17PM -0800, Garrett Cooper wrote: > On Mon, Dec 10, 2012 at 3:21 PM, Adrian Chadd wrote: > > On 10 December 2012 15:18, wrote: > >> On Mon, Dec 10, 2012 at 3:10 PM, Adrian Chadd wrote: > >>> 9216 sounds like a jumbo frame mbuf. So the NIC is writing to an mbuf > >>> after it's finalised/freed. > >>> > >>> I have a similar bug showing up on ath(4) RX. :( > >> > >> Compile with DEBUG_MEMGUARD in the kernel configuration, and then set > >> vm.memguard.desc to the name of the UMA zone used for the 9216 byte > >> allocations, mbuf_jumbo_9k. This should cause a panic when the memory > >> is touched after free. > > > > Right, but I think its a _hardware_ access after the buffer has been freed.. > > At least that will give me an idea of who to punt the bug over to > next (assuming it lists the driver) -- one of the network folks, jfv, > or np :). It seems to be a recent change that's causing this (it's > spewing out these warnings every couple seconds), but that might also > be related to me getting lagg working on CURRENT as my last known base > was 9-STABLE and a lot of networking changes haven't been MFCed :). If you suspect it's a DMA from the NIC after the 9K cluster has been freed, see if the "corrupt" portion looks anything like an Ethernet frame. If it does then the DMAC in the frame will tell you who to follow up with -- jfv@ or me :-) (btw, your log had "val=ffffffff" so I think it's something else..) Regards, Navdeep > I could probably look through the code too after compiling it, but > it would take too long. > Thanks! > -Garrett > _______________________________________________ > freebsd-current@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"