From owner-freebsd-current@FreeBSD.ORG Mon Mar 1 09:49:09 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 08F7416A4CE; Mon, 1 Mar 2004 09:49:09 -0800 (PST) Received: from mail.backtech.com (wilma.backtech.com [209.198.99.18]) by mx1.FreeBSD.org (Postfix) with ESMTP id 880ED43D3F; Mon, 1 Mar 2004 09:49:08 -0800 (PST) (envelope-from dexter@backtech.com) Received: by mail.backtech.com (Postfix, from userid 1001) id DDA672FD2F; Mon, 1 Mar 2004 12:49:07 -0500 (EST) Date: Mon, 1 Mar 2004 12:49:07 -0500 From: Dexter McNeil To: Scott Long Message-ID: <20040301174907.GA3634@net-1.backtech.com> References: <20040226233749.GA76201@net-1.backtech.com> <403E844D.9060303@freebsd.org> <20040227022653.GA92832@net-1.backtech.com> <4040EDC2.1020306@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4040EDC2.1020306@freebsd.org> User-Agent: Mutt/1.5.3i cc: freebsd-current@freebsd.org Subject: Re: mlx driver related kernel panic in Freebsd 5.2.1-RELEASE X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Mar 2004 17:49:09 -0000 Scott, This patch seems to have fixed it. I've been trying for the past few hours to crash the machine with massive file copies (both local and via NFS) and it's stayed up! Many thanks!! Cheers, Dexter McNeil On Sat, Feb 28, 2004 at 12:36:34PM -0700, Scott Long wrote: > Dexter, > > I sent out a patch earlier today that might help. If not, I'll take you > up on your offer for remote access to the machine. The mlx driver > underwent a massive structural overhaul over the summer, and I might > have missed some edge cases. Attached is the patch in case you missed > it. > > Scott > > Dexter McNeil wrote: > >Scott, > > I can make remote access to the box and serial console port available > >if it will help. > > > >On Thu, Feb 26, 2004 at 04:42:05PM -0700, Scott Long wrote: > > > >>Thanks for the report, I'll look at it. > >> > >>Scott > >> > >>Dexter McNeil wrote: > >> > >>>OK, I seem to be able to get FreeBSD 5.2.1-RELEASE to reliably panic with > >>>a "panic: free: address 0xd8d5e000(0xd8d5e000) has not been allocated." > >>>on > >>>the serial console when it crashes. > >>> > >>>I'm doing two copies of the entire ports collection to seperate > >>>subdirectories when the crash occurs. It seems to do this regardless of > >>> > >>>The machine is an IBM Netfinity 5500 with 4 x 550Mhz P3 Xeon CPUS, 2gigs > >>>of ram and a Mylex DAC1100 RAID controller. There are 6 73G disks > >>>attached > >>>to channel 0 of the controller, 5 disks are in a RAID 5 array, the sixth > >>>is a hot spare. > >>> > >>>Any ideas? > >>> > >>> > >>> > >>>A 'trace' at the db> prompt yields: > >>> > >>>cpuid = 2; > >>>Debugger("panic") > >>>Stopped at Debugger+0x55: xchgl %ebx,in_Debugger.0 > >>>db> trace > >>>Debugger(c06d1f22,2,c06d07e3,e257dc30,100) at Debugger+0x55 > >>>panic(c06d07e3,d8d5e000,d8d5e000,0,c06d07a4) at panic+0x156 > >>>free(d8d5e000,c0705300,1,0,c0522975) at free+0xa3 > >>>mlx_enquire(c8277000,c,c,c04c3b60,d8) at mlx_enquire+0xef > >>>mlx_periodic(c8277000,0,c06d2fed,d8,1) at mlx_periodic+0x174 > >>>softclock(0,0,c06cfc87,23a,c81d4a98) at softclock+0x1b8 > >>>ithread_loop(c42f1f00,e257dd48,c06cfaed,311,0) at ithread_loop+0x192 > >>>fork_exit(c0518350,c42f1f00,e257dd48) at fork_exit+0xb4 > >>>fork_trampoline() at fork_trampoline+0x8 > >>>--- trap 0x1, eip = 0, esp = 0xe257dd7c, ebp = 0 --- > >>> > > > > > > Index: mlx.c > =================================================================== > RCS file: /usr/ncvs/src/sys/dev/mlx/mlx.c,v > retrieving revision 1.44 > diff -u -r1.44 mlx.c > --- mlx.c 22 Feb 2004 09:52:46 -0000 1.44 > +++ mlx.c 28 Feb 2004 17:48:59 -0000 > @@ -1554,8 +1554,8 @@ > if ((mc->mc_complete == NULL) && (mc != NULL)) > mlx_releasecmd(mc); > /* we got an error, and we allocated a result */ > - if ((error != 0) && (mc->mc_data != NULL)) { > - free(mc->mc_data, M_DEVBUF); > + if ((error != 0) && (result != NULL)) { > + free(result, M_DEVBUF); > mc->mc_data = NULL; > } > return(result); -- The ultimate destination on the journey of life is a hole 6 feet deep. Enjoy the journey - the destination is nothing to write home about.