From owner-freebsd-current@FreeBSD.ORG Sun Jun 26 09:31:10 2005 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3E37216A41C for ; Sun, 26 Jun 2005 09:31:10 +0000 (GMT) (envelope-from thierry@herbelot.com) Received: from postfix4-2.free.fr (postfix4-2.free.fr [213.228.0.176]) by mx1.FreeBSD.org (Postfix) with ESMTP id CA6AB43D48 for ; Sun, 26 Jun 2005 09:31:09 +0000 (GMT) (envelope-from thierry@herbelot.com) Received: from herbelot.dyndns.org (bne75-4-82-227-159-103.fbx.proxad.net [82.227.159.103]) by postfix4-2.free.fr (Postfix) with ESMTP id 0F1A4320522 for ; Sun, 26 Jun 2005 11:31:09 +0200 (CEST) Received: from diversion.herbelot.nom (diversion.herbelot.nom [192.168.2.6]) by herbelot.dyndns.org (8.13.3/8.13.3) with ESMTP id j5Q9V366020495; Sun, 26 Jun 2005 11:31:05 +0200 (CEST) From: Thierry Herbelot To: freebsd-current@freebsd.org Date: Sun, 26 Jun 2005 11:30:58 +0200 User-Agent: KMail/1.8 References: <20050624212729.C537@odysseus.silby.com> <20050626064309.GA4700@nagual.pp.ru> <200506261049.42303.thierry@herbelot.com> In-Reply-To: <200506261049.42303.thierry@herbelot.com> X-Warning: Windows can lose your files X-Op-Sys: Le FriBi de la mort qui tue X-Org: TfH&Co X-MailScanner: Found to be clean MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200506261131.00331.thierry@herbelot.com> Cc: Mike Silbersack Subject: Re: Mbuf double-free guilty party detection patch X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: thierry@herbelot.com List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jun 2005 09:31:10 -0000 I wrote too soon : "better" error messages : This memory last freed by: c0663782 Memory modified after free 0xc20a9500(256) val=0 @ 0xc20a9540 This memory last freed by: c0663782 Memory modified after free 0xc20a9500(256) val=3 @ 0xc20a9544 This memory last freed by: c066a3b0 Memory modified after free 0xc20a9400(256) val=0 @ 0xc20a9400 This memory last freed by: c066a3b0 Memory modified after free 0xc20a9400(256) val=0 @ 0xc20a9404 This memory last freed by: c066a3b0 (these are the only two meaningful addresses in the log) multi-cur# addr2line -e /usr/src/sys/i386/compile/GENERIC/kernel.debug 0xc0663782 ../../../kern/uipc_mbuf.c:167 which is : 158 /* 159 * Free an entire chain of mbufs and associated external buffers, if 160 * applicable. 161 */ 162 void 163 m_freem(struct mbuf *mb) 164 { 165 166 while (mb != NULL) 167 mb = m_free(mb); 168 } multi-cur# addr2line -e /usr/src/sys/i386/compile/GENERIC/kernel.debug 0xc066a3b0 ../../../kern/uipc_socket2.c:1158 which is : 1147 if (m->m_len > len) { 1148 m->m_len -= len; 1149 m->m_data += len; 1150 sb->sb_cc -= len; 1151 if (m->m_type != MT_DATA && m->m_type != MT_HEADER && 1152 m->m_type != MT_OOBDATA) 1153 sb->sb_ctl -= len; 1154 break; 1155 } 1156 len -= m->m_len; 1157 sbfree(sb, m); 1158 m = m_free(m); the test case is : building the kernel while tar-ing the src tree over two separate ssh session. TfH