From owner-freebsd-geom@FreeBSD.ORG Sat Jun 23 05:07:24 2007 Return-Path: X-Original-To: freebsd-geom@freebsd.org Delivered-To: freebsd-geom@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id D317C16A468 for ; Sat, 23 Jun 2007 05:07:24 +0000 (UTC) (envelope-from david.cecil@nokia.com) Received: from mgw-ext11.nokia.com (smtp.nokia.com [131.228.20.170]) by mx1.freebsd.org (Postfix) with ESMTP id 6143613C44B for ; Sat, 23 Jun 2007 05:07:24 +0000 (UTC) (envelope-from david.cecil@nokia.com) Received: from esebh105.NOE.Nokia.com (esebh105.ntc.nokia.com [172.21.138.211]) by mgw-ext11.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id l5N4kgU2013596 for ; Sat, 23 Jun 2007 07:46:46 +0300 Received: from siebh102.NOE.Nokia.com ([172.30.195.29]) by esebh105.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Sat, 23 Jun 2007 07:46:43 +0300 Received: from syebe101.NOE.Nokia.com ([172.30.128.65]) by siebh102.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Sat, 23 Jun 2007 12:46:42 +0800 Received: from [172.30.67.199] ([172.30.67.199]) by syebe101.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.1830); Sat, 23 Jun 2007 14:46:40 +1000 Message-ID: <467CA5B0.4090508@nokia.com> Date: Sat, 23 Jun 2007 14:46:40 +1000 From: David Cecil User-Agent: Thunderbird 1.5.0.12 (Windows/20070509) MIME-Version: 1.0 To: freebsd-geom@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 23 Jun 2007 04:46:40.0913 (UTC) FILETIME=[7DB1C810:01C7B551] X-Nokia-AV: Clean Subject: Duplicate free X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jun 2007 05:07:24 -0000 Hi, I've encountered a duplicate free in 6.1-RELEASE-based code. I have noticed that the same stack trace was reported about two years ago on a number of occasions, and some code was added to try and help debug the situation. However, I don't see any resolution. Does anyone have any more information on this before I try and debug it further? Any hints for trying to find who freed it first? Maybe I should add the KTR debug that went into 1.66 of geom_io.c. db> bt Tracing pid 17 tid 100016 td 0x86badaf0 kdb_enter(80750631) at kdb_enter+0x2b panic(807786cd,8a778d80,81856780,80747d25,807786b1,...) at panic+0x137 uma_dbg_free(81856780,0,8a778d80) at uma_dbg_free+0x110 uma_zfree_arg(81856780,8a778d80,0) at uma_zfree_arg+0x66 g_destroy_bio(8a778d80,805319b4,8a778d80,e1ca3c60,805c9620,...) at g_destroy_bio+0x13 g_disk_done(8a778d80) at g_disk_done+0x62 biodone(8a778d80) at biodone+0x58 ad_done(88042840) at ad_done+0x2a ata_completed(88042840,0,86c38cdc,0,80753b6d,...) at ata_completed+0x504 taskqueue_run(86c38cc0,e1ca3cec,8056999a,0,0,...) at taskqueue_run+0x86 taskqueue_swi_run(0) at taskqueue_swi_run+0xe ithread_execute_handlers(86c14000,86c29280) at ithread_execute_handlers+0xfa ithread_loop(86c534f0,e1ca3d38,86c534f0,80569a10,0,...) at ithread_loop+0x76 fork_exit(80569a10,86c534f0,e1ca3d38) at fork_exit+0xa0 fork_trampoline() at fork_trampoline+0x8 --- trap 0x1, eip = 0, esp = 0xe1ca3d6c, ebp = 0 --- The panic string is: Duplicate free of item 0x8a778d80 from zone 0x81856780(g_bio) Thanks, Dave