From owner-freebsd-alpha Sat Dec 14 16:37:34 2002 Delivered-To: freebsd-alpha@freebsd.org Received: from green.bikeshed.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 29EDC37B401; Sat, 14 Dec 2002 16:37:33 -0800 (PST) Received: from green.bikeshed.org (uk08zvq67bw49ucc@green.bikeshed.org [10.0.0.1] (may be forged)) by green.bikeshed.org (8.12.6/8.12.6) with ESMTP id gBF0bWOa014044; Sat, 14 Dec 2002 19:37:32 -0500 (EST) (envelope-from green@green.bikeshed.org) Received: from localhost (green@localhost) by green.bikeshed.org (8.12.6/8.12.6/Submit) with ESMTP id gBF0bVSM014040; Sat, 14 Dec 2002 19:37:31 -0500 (EST) Message-Id: <200212150037.gBF0bVSM014040@green.bikeshed.org> X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4 To: John Baldwin Cc: Kris Kennaway , current@FreeBSD.org, alpha@FreeBSD.org Subject: Re: UMA panic under load In-Reply-To: Your message of "Thu, 12 Dec 2002 11:34:00 EST." From: "Brian F. Feldman" Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Sat, 14 Dec 2002 19:37:31 -0500 Sender: owner-freebsd-alpha@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org John Baldwin wrote: > > On 12-Dec-2002 Kris Kennaway wrote: > > I got this on an alpha tonight. It was under heavy load at the time > > (18 simultaneous package builds had just been spawned on the machine). > > Any ideas? > > > > Slab at 0xfffffc00042d3fb8, freei 2 = 0. > > panic: Duplicate free of item 0xfffffc00042d22e0 from zone 0xfffffc0007d31800(VMSPACE) > > > > db_print_backtrace() at db_print_backtrace+0x18 > > panic() at panic+0x104 > > uma_dbg_free() at uma_dbg_free+0x170 > > uma_zfree_arg() at uma_zfree_arg+0x150 > > vmspace_free() at vmspace_free+0xe4 > > swapout_procs() at swapout_procs+0x428 > > vm_daemon() at vm_daemon+0x74 > > fork_exit() at fork_exit+0xe0 > > exception_return() at exception_return > > --- root of call graph --- > > panic > > Stopped at Debugger+0x34: zapnot v0,#0xf,v0 > > db> > > I have seen this on a couple of different arch's I think. A vmspace > shouldn't be free'd here, it's refcount should not be that low. > I wonder if something is free'ing the vmspace w/o dropping the refcount? The problem appears to be that swapout_procs() is swapping out a process that is in the process of exiting (in exit1()) and having already relinquished its vmspace, but has not set PRS_ZOMBIE yet (which would be preventing the swapout). It's clearly not correct for a process in exit1() to be swapped out, and the vmspace _needs_ to be decremented in the correct place or resources are NEVER freed when the race is lost. -- Brian Fundakowski Feldman \'[ FreeBSD ]''''''''''\ <> green@FreeBSD.org <> bfeldman@tislabs.com \ The Power to Serve! \ Opinions expressed are my own. \,,,,,,,,,,,,,,,,,,,,,,\ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-alpha" in the body of the message