From owner-freebsd-hackers  Tue Dec 16 11:33:42 1997
Return-Path: <owner-freebsd-hackers>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id LAA21958
          for hackers-outgoing; Tue, 16 Dec 1997 11:33:42 -0800 (PST)
          (envelope-from owner-freebsd-hackers)
Received: from smtp01.primenet.com (smtp01.primenet.com [206.165.6.131])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id LAA21934
          for <freebsd-hackers@FreeBSD.ORG>; Tue, 16 Dec 1997 11:33:31 -0800 (PST)
          (envelope-from tlambert@usr01.primenet.com)
Received: (from daemon@localhost)
	by smtp01.primenet.com (8.8.8/8.8.8) id MAA10409;
	Tue, 16 Dec 1997 12:19:20 -0700 (MST)
Received: from usr01.primenet.com(206.165.6.201)
 via SMTP by smtp01.primenet.com, id smtpd010386; Tue Dec 16 12:19:19 1997
Received: (from tlambert@localhost)
	by usr01.primenet.com (8.8.5/8.8.5) id MAA20145;
	Tue, 16 Dec 1997 12:19:15 -0700 (MST)
From: Terry Lambert <tlambert@primenet.com>
Message-Id: <199712161919.MAA20145@usr01.primenet.com>
Subject: Re: panic: blkfree: freeling free block/frag
To: ivt@gamma.ru (Igor Timkin)
Date: Tue, 16 Dec 1997 19:19:15 +0000 (GMT)
Cc: tlambert@primenet.com, ivt@gamma.ru, freebsd-hackers@FreeBSD.ORG
In-Reply-To: <199712161442.RAA24936@crocus.gamma.ru> from "Igor Timkin" at Dec 16, 97 05:42:10 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: owner-freebsd-hackers@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> ivt@news:/var/tmp/innfeed:2:306>gdb -k /sys/compile/NEWS/kernel /usr/local/news/crash/vmcore.1
> GDB is free software and you are welcome to distribute copies of it
>  under certain conditions; type "show copying" to see the conditions.
> There is absolutely no warranty for GDB; type "show warranty" for details.
> GDB 4.16 (i386-unknown-freebsd), 
> Copyright 1996 Free Software Foundation, Inc...
> IdlePTD 1f0000
> current pcb at 1d79c0
> panic: blkfree: freeing free block
> #0  boot (howto=256) at ../../kern/kern_shutdown.c:266
> 266                                     dumppcb.pcb_cr3 = rcr3();
> (kgdb) where
> #0  boot (howto=256) at ../../kern/kern_shutdown.c:266
> #1  0xe01105e2 in panic (fmt=0xe0188a85 "blkfree: freeing free block")
>     at ../../kern/kern_shutdown.c:390
> #2  0xe0188c57 in ffs_blkfree (ip=0xe3e50500, bno=10, size=4096)
>     at ../../ufs/ffs/ffs_alloc.c:1230
> #3  0xe018b09a in ffs_indirtrunc (ip=0xe3e50500, lbn=-12, dbn=394248, 
>     lastbn=-1, level=0, countp=0xdfbffd9c) at ../../ufs/ffs/ffs_inode.c:500
> #4  0xe018aac8 in ffs_truncate (ap=0xdfbffe74) at ../../ufs/ffs/ffs_inode.c:317
> #5  0xe018e6a5 in ufs_inactive (ap=0xdfbffea0) at vnode_if.h:1003
> #6  0xe012fb3f in vrele (vp=0xe3b12800) at vnode_if.h:699
> #7  0xe012fa33 in vput (vp=0xe3b12800) at ../../kern/vfs_subr.c:858
> #8  0xe0191e80 in ufs_remove (ap=0xdfbffef4) at ../../ufs/ufs/ufs_vnops.c:697
> #9  0xe0131d25 in unlink (p=0xe4dc6e00, uap=0xdfbfff94, retval=0xdfbfff84)
>     at vnode_if.h:459
> #10 0xe01ac1ff in syscall (frame={tf_es = 39, tf_ds = -541130713, tf_edi = 1, 
>       tf_esi = 28736, tf_ebp = -541074456, tf_isp = -541065244, 
>       tf_ebx = 28944, tf_edx = 0, tf_ecx = 41472, tf_eax = 10, tf_trapno = 7, 
>       tf_err = 7, tf_eip = 268950145, tf_cs = 31, tf_eflags = 582, 
>       tf_esp = -541074568, tf_ss = 39}) at ../../i386/i386/trap.c:890
> #11 0x1007da81 in ?? ()
> #12 0x2453 in ?? ()
> #13 0x2914 in ?? ()
> #14 0x1095 in ?? ()

Start at unlink, and look at the arguments all the way down to see
if they are reasonable.

When you find an unreasonable argument, go up one function, and look at
the contents of the auto variables.  See if they are corrupted.

Personally, I am not happy with the vnode/free block management in
FreeBSD, but there's nothing I can do about it to make it more
deterministic.  I'm pretty sure that the race windows have been
nailed closed by increased complexity, so it's probably something
else.


					Terry Lambert
					terry@lambert.org
---
Any opinions in this posting are my own and not those of my present
or previous employers.