From owner-freebsd-current@FreeBSD.ORG  Wed Feb  1 04:21:22 2006
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: freebsd-current@freebsd.org
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id BB35D16A420
	for <freebsd-current@freebsd.org>; Wed,  1 Feb 2006 04:21:22 +0000 (GMT)
	(envelope-from sgk@troutmask.apl.washington.edu)
Received: from troutmask.apl.washington.edu (troutmask.apl.washington.edu
	[128.208.78.105])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6AD1943D45
	for <freebsd-current@freebsd.org>; Wed,  1 Feb 2006 04:21:22 +0000 (GMT)
	(envelope-from sgk@troutmask.apl.washington.edu)
Received: from troutmask.apl.washington.edu (localhost [127.0.0.1])
	by troutmask.apl.washington.edu (8.13.4/8.13.4) with ESMTP id
	k114LMo7027812
	for <freebsd-current@freebsd.org>; Tue, 31 Jan 2006 20:21:22 -0800 (PST)
	(envelope-from sgk@troutmask.apl.washington.edu)
Received: (from sgk@localhost)
	by troutmask.apl.washington.edu (8.13.4/8.13.1/Submit) id
	k114LM6U027811
	for freebsd-current@freebsd.org; Tue, 31 Jan 2006 20:21:22 -0800 (PST)
	(envelope-from sgk)
Date: Tue, 31 Jan 2006 20:21:22 -0800
From: Steve Kargl <sgk@troutmask.apl.washington.edu>
To: freebsd-current@freebsd.org
Message-ID: <20060201042122.GA27796@troutmask.apl.washington.edu>
References: <20060131212209.GA870@troutmask.apl.washington.edu>
	<20060201010157.GA604@troutmask.apl.washington.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20060201010157.GA604@troutmask.apl.washington.edu>
User-Agent: Mutt/1.4.2.1i
Subject: Re: panic: Memory modified after free
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Feb 2006 04:21:22 -0000

On Tue, Jan 31, 2006 at 05:01:57PM -0800, Steve Kargl wrote:
> On Tue, Jan 31, 2006 at 01:22:09PM -0800, Steve Kargl wrote:
> > The system is a dual proc Tyan K8S Pro with 12 GB of memory.
> > The kernel is UP.  This was recorded by hand. I have the crash dump.
> > 
> > Memory modified after free 0xffffff02505e0c00(504) val=deadc0dd @
> > 0xffffff02505e0cd0
> > 
> 
> Thing are looking positively horrid.  A kernel from a cvsup with
> a date=2006.01.25.00.00.00 appears to work fine.  A kernel from with
> date=2006.01.27.00.00.00 dies with
> 
> dev_relthread() at dev_relthread+0x2e
> devfs_close() at devfs_close+0x1b6
> VOP_CLOSE_APV() at VOP_CLOSE_APV+0x74
> vn_close() at vn_close+0x8d
> vn_closefile() at vn_closefile+0x5a
> fdrop_locked() at fdrop_locked+0xa1
> closef() at closef+0x35f
> fdfree() at fdfree+0x513
> exit1() at exit1+0x360
> sys_exit() 	at sys_exit+0xe
> 

a 2006.01.26.12.00.00.00 kernel dies a similar death.
Unfortnately, this panic took out a portion of /usr/include
and /usr/src.  I can't prove it yet, but I think the
pts code may be the trigger.

-- 
Steve