Date: Mon, 6 Mar 2006 17:34:41 +0000 (GMT) From: Robert Watson <rwatson@FreeBSD.org> To: stable@FreeBSD.org Subject: vm_page_free: pindex(0), busy(0), PG_BUSY(0), hold(0) panic: vm_page_free: freeing free page Message-ID: <20060306173205.G50149@fledge.watson.org>
next in thread | raw e-mail | index | archive | help
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
--0-936244938-1141666481=:50149
Content-Type: TEXT/PLAIN; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: QUOTED-PRINTABLE
Got the attached panic + trace on a build server today when doing a paralle=
l=20
buildworld.
Unread portion of the kernel message buffer:
vm_page_free: pindex(0), busy(0), PG_BUSY(0), hold(0)
panic: vm_page_free: freeing free page
Uptime: 2d20h44m8s
Dumping 1022 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 1022MB (261616 pages) 1006 990 974 958 942 926 910 894 878 862 =
846=20
830 814 798 782 766 750 734 718 702 686 670 654 638 622 606 590 574 558 542=
=20
526 510 494 478 462 446 430 414 398 382 366 350 334 318 302 286 270 254 238=
=20
222 206 190 174 158 142 126 110 94 78 62 46 30 14
#0 doadump () at pcpu.h:165
165 pcpu.h: No such file or directory.
in pcpu.h
(kgdb) bt
#0 doadump () at pcpu.h:165
#1 0xc064a012 in boot (howto=3D260) at /usr/src/sys/kern/kern_shutdown.c:3=
99
#2 0xc064a2a8 in panic (fmt=3D0xc08aa63a "vm_page_free: freeing free page"=
)
at /usr/src/sys/kern/kern_shutdown.c:555
#3 0xc07c7c2b in vm_page_free_toq (m=3D0xc1b6f330)
at /usr/src/sys/vm/vm_page.c:1023
#4 0xc07c7295 in vm_page_free (m=3D0xc1b6f330) at /usr/src/sys/vm/vm_page.=
c:403
#5 0xc07c4cd1 in vm_object_terminate (object=3D0xc57de630)
at /usr/src/sys/vm/vm_object.c:631
#6 0xc07c4bab in vm_object_deallocate (object=3D0xc57de630)
at /usr/src/sys/vm/vm_object.c:564
#7 0xc07c174e in vm_map_entry_delete (map=3D0xc518dce4, entry=3D0xc5110aa0=
)
at /usr/src/sys/vm/vm_map.c:2207
#8 0xc07c191b in vm_map_delete (map=3D0xc518dce4, start=3D3328910128,
end=3D3217031168) at /usr/src/sys/vm/vm_map.c:2300
#9 0xc07c197c in vm_map_remove (map=3D0xc518dce4, start=3D0, end=3D3217031=
168)
at /usr/src/sys/vm/vm_map.c:2319
#10 0xc0631fe3 in exit1 (td=3D0xc554d900, rv=3D0) at vm_map.h:211
#11 0xc06319ac in sys_exit (td=3D0xc554d900, uap=3D0x0)
at /usr/src/sys/kern/kern_exit.c:97
#12 0xc0825edb in syscall (frame=3D
{tf_fs =3D 59, tf_es =3D 59, tf_ds =3D 59, tf_edi =3D 0, tf_esi =3D =
1, tf_ebp =3D=20
-1077944200, tf_isp =3D -278880924, tf_ebx =3D -1077941067, tf_edx =3D 1346=
26912,=20
tf_ecx =3D 6, tf_eax =3D 1, tf_trapno =3D 12, tf_err =3D 2, tf_eip =3D 6727=
58583, tf_cs=20
=3D 51, tf_eflags =3D 658, tf_esp =3D -1077944324, tf_ss =3D 59})
at /usr/src/sys/i386/i386/trap.c:981
#13 0xc0814d5f in Xint0x80_syscall () at=20
/usr/src/sys/i386/i386/exception.s:200
#14 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) up
#1 0xc064a012 in boot (howto=3D260) at /usr/src/sys/kern/kern_shutdown.c:3=
99
399 doadump();
(kgdb) up
#2 0xc064a2a8 in panic (fmt=3D0xc08aa63a "vm_page_free: freeing free page"=
)
at /usr/src/sys/kern/kern_shutdown.c:555
555 boot(bootopt);
(kgdb) up
#3 0xc07c7c2b in vm_page_free_toq (m=3D0xc1b6f330)
at /usr/src/sys/vm/vm_page.c:1023
1023 panic("vm_page_free: freeing free page");
(kgdb) inspect *m
$1 =3D {pageq =3D {tqe_next =3D 0xc1b4b330, tqe_prev =3D 0xc0966a60}, listq=
=3D {
tqe_next =3D 0xc1276878, tqe_prev =3D 0xc87de668}, left =3D 0x0,
right =3D 0xc210be98, object =3D 0x0, pindex =3D 0, phys_addr =3D 663449=
600, md =3D {
pv_list_count =3D 0, pv_list =3D {tqh_first =3D 0x0, tqh_last =3D 0xc1=
b6f35c}},
queue =3D 24, flags =3D 128, pc =3D 23, wire_count =3D 0, cow =3D 0, hol=
d_count =3D 0,
act_count =3D 5 '\005', busy =3D 0 '\0', valid =3D 0 '\0', dirty =3D 0 '=
\0'}
(kgdb) up
#4 0xc07c7295 in vm_page_free (m=3D0xc1b6f330) at /usr/src/sys/vm/vm_page.=
c:403
403 vm_page_free_toq(m);
(kgdb) up
#5 0xc07c4cd1 in vm_object_terminate (object=3D0xc57de630)
at /usr/src/sys/vm/vm_object.c:631
631 vm_page_free(p);
(kgdb) inspect *p
Cannot access memory at address 0x0
(kgdb) inspect *object
$2 =3D {mtx =3D {mtx_object =3D {lo_class =3D 0xc08f26e4,
lo_name =3D 0xc08a966d "vm object",
lo_type =3D 0xc08aa45e "standard object", lo_flags =3D 4390912, lo_l=
ist =3D {
tqe_next =3D 0x0, tqe_prev =3D 0x0}, lo_witness =3D 0x0},
mtx_lock =3D 3310672128, mtx_recurse =3D 0}, object_list =3D {
tqe_next =3D 0xc63cd18c, tqe_prev =3D 0xc62d62b8}, shadow_head =3D {
lh_first =3D 0x0}, shadow_list =3D {le_next =3D 0x0, le_prev =3D 0xc82=
815d8},
memq =3D {tqh_first =3D 0xc1b6f330, tqh_last =3D 0xc1fb94e8}, root =3D 0=
xc210be98,
size =3D 8, generation =3D 13, ref_count =3D 0, shadow_count =3D 0, type=
=3D 0 '\0',
flags =3D 8584, pg_color =3D 27, paging_in_progress =3D 0,
resident_page_count =3D 6, backing_object =3D 0x0,
backing_object_offset =3D 20480, pager_object_list =3D {tqe_next =3D 0x0=
,
tqe_prev =3D 0x0}, handle =3D 0x0, un_pager =3D {vnp =3D {vnp_size =3D=
512}, devp =3D=20
{
devp_pglist =3D {tqh_first =3D 0x200, tqh_last =3D 0x0}}, swp =3D {
swp_bcount =3D 512}}}
(kgdb) up
#6 0xc07c4bab in vm_object_deallocate (object=3D0xc57de630)
at /usr/src/sys/vm/vm_object.c:564
564 vm_object_terminate(object);
(kgdb) up
#7 0xc07c174e in vm_map_entry_delete (map=3D0xc518dce4, entry=3D0xc5110aa0=
)
at /usr/src/sys/vm/vm_map.c:2207
2207 vm_object_deallocate(object);
(kgdb) up
#8 0xc07c191b in vm_map_delete (map=3D0xc518dce4, start=3D3328910128,
end=3D3217031168) at /usr/src/sys/vm/vm_map.c:2300
2300 vm_map_entry_delete(map, entry);
(kgdb) inspect *map
$3 =3D {header =3D {prev =3D 0xc66ae2a8, next =3D 0xc66b2330, left =3D 0x0,=
right =3D 0x0,
start =3D 0, end =3D 3217031168, avail_ssize =3D 0, adj_free =3D 0, ma=
x_free =3D 0,
object =3D {vm_object =3D 0x0, sub_map =3D 0x0}, offset =3D 0, eflags =
=3D 0,
protection =3D 0 '\0', max_protection =3D 0 '\0', inheritance =3D 0 '\=
0',
wired_count =3D 0, lastr =3D 0}, lock =3D {sx_object =3D {lo_class =3D=
0xc08f3aac,
lo_name =3D 0xc08a9dbd "user map", lo_type =3D 0xc08a9dbd "user map"=
,
lo_flags =3D 3866624, lo_list =3D {tqe_next =3D 0x0, tqe_prev =3D 0x=
0},
lo_witness =3D 0x0}, sx_lock =3D 0xc0952234, sx_cnt =3D -1, sx_shrd_=
cv =3D {
cv_description =3D 0xc08a9dbd "user map", cv_waiters =3D 0},
sx_shrd_wcnt =3D 0, sx_excl_cv =3D {cv_description =3D 0xc08a9dbd "use=
r map",
cv_waiters =3D 0}, sx_excl_wcnt =3D 0, sx_xholder =3D 0xc554d900},
system_mtx =3D {mtx_object =3D {lo_class =3D 0xc08f26e4,
lo_name =3D 0xc08a9db2 "system map", lo_type =3D 0xc08a9db2 "system =
map",
lo_flags =3D 4390912, lo_list =3D {tqe_next =3D 0x0, tqe_prev =3D 0x=
0},
lo_witness =3D 0x0}, mtx_lock =3D 4, mtx_recurse =3D 0}, nentries =
=3D 12,
size =3D 1372160, timestamp =3D 93, needs_wakeup =3D 0 '\0', system_map =
=3D 0 '\0',
flags =3D 0 '\0', root =3D 0xc66b8330, pmap =3D 0xc518dda4}
(kgdb) up
#9 0xc07c197c in vm_map_remove (map=3D0xc518dce4, start=3D0, end=3D3217031=
168)
at /usr/src/sys/vm/vm_map.c:2319
2319 result =3D vm_map_delete(map, start, end);
(kgdb) up
#10 0xc0631fe3 in exit1 (td=3D0xc554d900, rv=3D0) at vm_map.h:211
211 {
(kgdb) inspect *td
$4 =3D {td_proc =3D 0xc554c624, td_ksegrp =3D 0xc4b104e0, td_plist =3D {
tqe_next =3D 0x0, tqe_prev =3D 0xc554c634}, td_kglist =3D {tqe_next =
=3D 0x0,
tqe_prev =3D 0xc4b104ec}, td_slpq =3D {tqe_next =3D 0x0, tqe_prev =3D =
0xc546a880},
td_lockq =3D {tqe_next =3D 0x0, tqe_prev =3D 0xef634c2c}, td_runq =3D {
tqe_next =3D 0x0, tqe_prev =3D 0xc554c63c}, td_selq =3D {tqh_first =3D=
0x0,
tqh_last =3D 0xc554d930}, td_sleepqueue =3D 0xc546a880,
td_turnstile =3D 0xc4fda080, td_umtxq =3D 0xc54b1d80, td_tid =3D 100115,
td_flags =3D 16842754, td_inhibitors =3D 0, td_pflags =3D 0, td_dupfd =
=3D 0,
td_wchan =3D 0x0, td_wmesg =3D 0x0, td_lastcpu =3D 0 '\0', td_oncpu =3D =
0 '\0',
td_owepreempt =3D 0 '\0', td_locks =3D 0, td_blocked =3D 0x0, td_ithd =
=3D 0x0,
td_lockname =3D 0x0, td_contested =3D {lh_first =3D 0x0}, td_sleeplocks =
=3D 0x0,
td_intr_nesting_level =3D 0, td_pinned =3D 0, td_mailbox =3D 0x0,
td_ucred =3D 0xc59efe00, td_standin =3D 0x0, td_upcall =3D 0x0, td_stick=
s =3D 1580,
td_uuticks =3D 0, td_usticks =3D 0, td_intrval =3D 0, td_oldsigmask =3D =
{__bits =3D {
0, 0, 0, 0}}, td_sigmask =3D {__bits =3D {0, 0, 0, 0}}, td_siglist =
=3D {
__bits =3D {0, 0, 0, 0}}, td_generation =3D 4, td_sigstk =3D {ss_sp =
=3D 0x0,
ss_size =3D 0, ss_flags =3D 4}, td_kflags =3D 0, td_xsig =3D 0,
td_profil_addr =3D 0, td_profil_ticks =3D 0, td_base_pri =3D 193 '=C1',
td_priority =3D 193 '=C1', td_pcb =3D 0xef609d90, td_state =3D TDS_RUNNI=
NG,
td_retval =3D {0, 134626912}, td_slpcallout =3D {c_links =3D {sle =3D {
sle_next =3D 0x0}, tqe =3D {tqe_next =3D 0x0, tqe_prev =3D 0xd8b05=
058}},
c_time =3D 247449857, c_arg =3D 0xc554d900,
c_func =3D 0xc0668410 <sleepq_timeout>, c_mtx =3D 0x0, c_flags =3D 16}=
,
td_frame =3D 0xef609d38, td_kstack_obj =3D 0xc554fe70, td_kstack =3D 401=
6078848,
td_kstack_pages =3D 2, td_altkstack_obj =3D 0x0, td_altkstack =3D 0,
td_altkstack_pages =3D 0, td_critnest =3D 0, td_md =3D {md_spinlock_coun=
t =3D 0,
md_saved_flags =3D 582}, td_sched =3D 0xc554da54}
(kgdb) inspect *td->td_proc
$5 =3D {p_list =3D {le_next =3D 0xc50c8a3c, le_prev =3D 0xc0952f84}, p_kseg=
rps =3D {
tqh_first =3D 0xc4b104e0, tqh_last =3D 0xc4b104e4}, p_threads =3D {
tqh_first =3D 0xc554d900, tqh_last =3D 0xc554d908}, p_suspended =3D {
tqh_first =3D 0x0, tqh_last =3D 0xc554c63c}, p_ucred =3D 0xc59efe00, p=
_fd =3D 0x0,
p_fdtol =3D 0x0, p_stats =3D 0xc5161e00, p_limit =3D 0xc8e8ad00,
p_sigacts =3D 0xc90cb000, p_flag =3D 24578, p_sflag =3D 1, p_state =3D P=
RS_NORMAL,
p_pid =3D 33761, p_hash =3D {le_next =3D 0x0, le_prev =3D 0xc4a8ff84}, p=
_pglist =3D {
le_next =3D 0x0, le_prev =3D 0xc50c8a8c}, p_pptr =3D 0xc50c8a3c, p_sib=
ling =3D {
le_next =3D 0x0, le_prev =3D 0xc50c8aa0}, p_children =3D {lh_first =3D=
0x0},
p_mtx =3D {mtx_object =3D {lo_class =3D 0xc08f26e4,
lo_name =3D 0xc0894ece "process lock",
lo_type =3D 0xc0894ece "process lock", lo_flags =3D 4390912, lo_list=
=3D {
tqe_next =3D 0x0, tqe_prev =3D 0x0}, lo_witness =3D 0x0}, mtx_lock=
=3D 4,
mtx_recurse =3D 0}, p_oppid =3D 0, p_vmspace =3D 0xc518dce4, p_swtime =
=3D 0,
p_realtimer =3D {it_interval =3D {tv_sec =3D 0, tv_usec =3D 0}, it_value=
=3D {
tv_sec =3D 0, tv_usec =3D 0}}, p_rux =3D {rux_runtime =3D {sec =3D 0=
,
frac =3D 79150977401680154}, rux_uticks =3D 1, rux_sticks =3D 1547,
rux_iticks =3D 0, rux_uu =3D 0, rux_su =3D 0, rux_iu =3D 0}, p_crux =
=3D {
rux_runtime =3D {sec =3D 0, frac =3D 3898975394652827504}, rux_uticks =
=3D 17,
rux_sticks =3D 13, rux_iticks =3D 0, rux_uu =3D 0, rux_su =3D 0, rux_i=
u =3D 0},
p_profthreads =3D 0, p_maxthrwaits =3D 0, p_traceflag =3D 0, p_tracevp =
=3D 0x0,
p_tracecred =3D 0x0, p_textvp =3D 0xc4e29110, p_siglist =3D {__bits =3D =
{0, 0, 0,
0}}, p_lock =3D 0 '\0', p_sigiolst =3D {slh_first =3D 0x0}, p_sigpar=
ent =3D 20,
p_sig =3D 0, p_code =3D 0, p_stops =3D 0, p_stype =3D 0, p_step =3D 0 '\=
0',
p_pfsflags =3D 0 '\0', p_nlminfo =3D 0x0, p_aioinfo =3D 0x0, p_singlethr=
ead =3D 0x0,
p_suspcount =3D 0, p_xthread =3D 0x0, p_boundary_count =3D 0,
p_procscopegrp =3D 0x0, p_magic =3D 3203398350,
p_comm =3D "sh\000e\000\000r", '\0' <repeats 12 times>, p_pgrp =3D 0xc53=
46100,
p_sysent =3D 0xc0934c20, p_args =3D 0x0, p_cpulimit =3D 9223372036854775=
807,
p_nice =3D 4 '\004', p_xstat =3D 0, p_klist =3D {kl_list =3D {slh_first =
=3D 0x0},
kl_lock =3D 0xc062f934 <knlist_mtx_lock>,
kl_unlock =3D 0xc062f968 <knlist_mtx_unlock>,
kl_locked =3D 0xc062f9a4 <knlist_mtx_locked>, kl_lockarg =3D 0xc554c68=
c},
p_numthreads =3D 1, p_numksegrps =3D 1, p_md =3D {md_ldt =3D 0x0}, p_itc=
allout =3D {
c_links =3D {sle =3D {sle_next =3D 0x0}, tqe =3D {tqe_next =3D 0x0,
tqe_prev =3D 0x0}}, c_time =3D 0, c_arg =3D 0x0, c_func =3D 0, c_m=
tx =3D 0x0,
c_flags =3D 16}, p_acflag =3D 0, p_ru =3D 0xc59e4400, p_peers =3D 0x0,
p_leader =3D 0xc554c624, p_emuldata =3D 0x0, p_label =3D 0x0, p_sched =
=3D=20
0xc554c830}
Robert N M Watson
--0-936244938-1141666481=:50149--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060306173205.G50149>