From owner-freebsd-fs@freebsd.org Sun Aug 28 05:30:20 2016 Return-Path: Delivered-To: freebsd-fs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B6EEDB78AD1 for ; Sun, 28 Aug 2016 05:30:20 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A6A6FC80 for ; Sun, 28 Aug 2016 05:30:20 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id u7S5UJQC079581 for ; Sun, 28 Aug 2016 05:30:20 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-fs@FreeBSD.org Subject: [Bug 212168] [panic] [UFS] use-after-free panic (0xdeadc0dedeadc0de) Date: Sun, 28 Aug 2016 05:30:20 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 11.0-RC1 X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: peter@FreeBSD.org X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-fs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2016 05:30:20 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D212168 --- Comment #6 from Peter Wemm --- It is very confusing as the compiler is doing extensive inlining. As near as I can tell, the area you asked about is like this: softdep_freefile(): handle_bufwait(inodedep, &freefile->fx_jwork); 7568 clear_unlinked_inodedep(inodedep); -> clear_unlinked_inodedep(): 9685: bwrite(bp); ACQUIRE_LOCK(ump); ->=20 bwrite(): 393: return (BO_WRITE(bp->b_bufobj, bp)); -> I'm confused after here. The return address of the frame is softdep_freefile+0x66c, which is the inlined sys/buf.h BO_WRITE macro. I *think* the chain continues from BO_WRITE() -> ffs_bufwrite() -> bufwrite= () -> bstrategy()-> ffs_geom_strategy(). I am 100% confident that it is originating from clear_unlinked_inodedep(). = 99% sure it is the first bwrite(), not the second one at line 9699. Is this of any help? --=20 You are receiving this mail because: You are the assignee for the bug.=