From owner-freebsd-current@FreeBSD.ORG  Fri Sep 26 06:44:24 2014
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 31740BE9
 for <freebsd-current@freebsd.org>; Fri, 26 Sep 2014 06:44:24 +0000 (UTC)
Received: from cell.glebius.int.ru (glebius.int.ru [81.19.69.10])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "cell.glebius.int.ru", Issuer "cell.glebius.int.ru" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id A670735B
 for <freebsd-current@freebsd.org>; Fri, 26 Sep 2014 06:44:23 +0000 (UTC)
Received: from cell.glebius.int.ru (localhost [127.0.0.1])
 by cell.glebius.int.ru (8.14.9/8.14.9) with ESMTP id s8Q6iLk1045621
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
 Fri, 26 Sep 2014 10:44:21 +0400 (MSK)
 (envelope-from glebius@FreeBSD.org)
Received: (from glebius@localhost)
 by cell.glebius.int.ru (8.14.9/8.14.9/Submit) id s8Q6iLpO045620;
 Fri, 26 Sep 2014 10:44:21 +0400 (MSK)
 (envelope-from glebius@FreeBSD.org)
X-Authentication-Warning: cell.glebius.int.ru: glebius set sender to
 glebius@FreeBSD.org using -f
Date: Fri, 26 Sep 2014 10:44:21 +0400
From: Gleb Smirnoff <glebius@FreeBSD.org>
To: Hans Petter Selasky <hps@selasky.org>
Subject: Re: Panic - uma_zfree_arg - zone argument is NULL
Message-ID: <20140926064421.GF884@glebius.int.ru>
References: <541AC8A4.3000306@selasky.org> <541ACA20.5030805@selasky.org>
 <20140925091911.GZ884@FreeBSD.org> <5424FEE4.3050504@selasky.org>
 <542500AD.2020708@selasky.org>
 <20140926060640.GE884@glebius.int.ru>
 <542507EE.5050704@selasky.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <542507EE.5050704@selasky.org>
User-Agent: Mutt/1.5.23 (2014-03-12)
Cc: FreeBSD Current <freebsd-current@freebsd.org>
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Sep 2014 06:44:24 -0000

On Fri, Sep 26, 2014 at 08:30:06AM +0200, Hans Petter Selasky wrote:
H> On 09/26/14 08:06, Gleb Smirnoff wrote:
H> > On Fri, Sep 26, 2014 at 07:59:09AM +0200, Hans Petter Selasky wrote:
H> > H> On 09/26/14 07:51, Hans Petter Selasky wrote:
H> > H> > On 09/25/14 11:19, Gleb Smirnoff wrote:
H> > H> >> On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote:
H> > H> >> H> #7  0xffffffff80b07863 in uma_zfree_arg (zone=0x0,
H> > H> >> item=0xfffff800114ee000,
H> > H> >> H>      udata=0xffffffff81484760)
H> > H> >>
H> > H> >> udata here is uma_slab_t. Can you look at it?
H> > H> >>
H> > H> >> btw, is that reproducible on stable/10 or head?
H> > H> >>
H> > H> >
H> > H> > Yes, it is reproducible. I have not tried stable/10 or head yet.
H> > H> >
H> > H> > (kgdb) print *(uma_slab_t)udata
H> > H> > $3 = {
H> > H> >    us_keg = 0xfffff8085696d680,
H> >
H> > Can you print the us_keg, please?
H> 
H> (kgdb) print *(*(uma_slab_t)udata).us_keg
 <skip>

It is trash. This means that vtoslab() returned us bad pointer.

Either this mean the address passed to free() is invalid, and
belongs to a page not under UMA control, or someone else have
mangled the page belonging to UMA.

Can you please print *(struct vm_page *)0xffffffff81484760 ?

-- 
Totus tuus, Glebius.