Date: Tue, 8 Nov 2005 17:13:37 -0600 (CST) From: Mark Tinguely <tinguely@casselton.net> To: freebsd-current@freebsd.org, snezhko@indorsoft.ru Cc: max@love2party.net Subject: Re: CURRENT + amd64 + user-ppp = panic Message-ID: <200511082313.jA8NDbft005916@casselton.net> In-Reply-To: <u64r2kgko.fsf@indorsoft.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Okay, I am alittle dense in reading the soreceive() debugger line, basically the debugger trace must refer to an expansion of the m_free() inline definition in soreceive(). Either a callout is not being removed when the memory is freed and that memory is recycled to an MBUF OR someone is incorrectly chaining a memory location into an MBUF. before too much work is done (below), could you print out the callout that is being freed but active and the memory around it (before it is overwritten by "deadc0de"). It may tell us which callout that it is or was. You should be able to do that with your existing kernel. If we cannot glean who the callout is/was, then more tests can be added to determine if the UMA is allocating memory chained to the callout or if the MBUF chain is corrupted. --Mark Tinguely
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200511082313.jA8NDbft005916>