From owner-freebsd-sparc64@FreeBSD.ORG Tue Sep 28 15:43:21 2004 Return-Path: Delivered-To: freebsd-sparc64@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E6BD516A4CF for ; Tue, 28 Sep 2004 15:43:21 +0000 (GMT) Received: from mail2.speakeasy.net (mail2.speakeasy.net [216.254.0.202]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9BF4943D41 for ; Tue, 28 Sep 2004 15:43:21 +0000 (GMT) (envelope-from jhb@FreeBSD.org) Received: (qmail 2406 invoked from network); 28 Sep 2004 15:43:21 -0000 Received: from dsl027-160-063.atl1.dsl.speakeasy.net (HELO server.baldwin.cx) ([216.27.160.63]) (envelope-sender ) encrypted SMTP for ; 28 Sep 2004 15:43:20 -0000 Received: from [10.50.40.210] (gw1.twc.weather.com [216.133.140.1]) (authenticated bits=0) by server.baldwin.cx (8.12.11/8.12.11) with ESMTP id i8SFhF2N002165; Tue, 28 Sep 2004 11:43:18 -0400 (EDT) (envelope-from jhb@FreeBSD.org) From: John Baldwin To: freebsd-sparc64@FreeBSD.org Date: Tue, 28 Sep 2004 11:31:03 -0400 User-Agent: KMail/1.6.2 References: <20040921064450.GA54998@xor.obsecurity.org> <20040928071241.GA74512@xor.obsecurity.org> In-Reply-To: <20040928071241.GA74512@xor.obsecurity.org> MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200409281131.03448.jhb@FreeBSD.org> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on server.baldwin.cx cc: sparc64@FreeBSD.org cc: Kris Kennaway Subject: Re: Memory modified after free 0xfffff8001b210e00(504) val=deadc0dd @ 0xfffff8001b21 X-BeenThere: freebsd-sparc64@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Porting FreeBSD to the Sparc List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Sep 2004 15:43:22 -0000 On Tuesday 28 September 2004 03:12 am, Kris Kennaway wrote: > On Mon, Sep 20, 2004 at 11:44:50PM -0700, Kris Kennaway wrote: > > I just got this panic on an SMP sparc package machine running 6.0: > > > > Memory modified after free 0xfffff8001b210e00(504) val=deadc0dd @ > > 0xfffff8001b210f20 panic: Most recently used by file desc > > cpuid = 0 > > KDB: enter: panic > > [thread 100195] > > Stopped at kdb_enter+0x38: ta %xcc, 1 > > db> trace > > panic() at panic+0x19c > > mtrash_ctor() at mtrash_ctor+0x7c > > uma_zalloc_arg() at uma_zalloc_arg+0x3e8 > > malloc() at malloc+0xa8 > > fdinit() at fdinit+0x40 > > fdcopy() at fdcopy+0x28 > > fork1() at fork1+0x770 > > fork() at fork+0x10 > > syscall() at syscall+0x220 > > -- syscall (2, FreeBSD ELF64, fork) %o7=0x10fe00 -- > > userland() at 0x40643008 > > user trace: trap %o7=0x10fe00 > > pc 0x40643008, sp 0x7fdffffc3d1 > > pc 0x106e6c, sp 0x7fdffffc491 > > pc 0x1067d0, sp 0x7fdffffc561 > > pc 0x107110, sp 0x7fdffffc621 > > pc 0x10a3b4, sp 0x7fdffffc711 > > pc 0x109c78, sp 0x7fdffffc8a1 > > Dumping 512 MB (1 chunks) > > chunk at 0: 536870912 bytes panic: trap: fast data access mmu miss > > cpuid = 0 > > KDB: enter: panic > > [thread 100195] > > Stopped at kdb_enter+0x38: ta %xcc, 1 > > db> > > Happened again.. Unfortunately it's hard to track these down as we really need to know where it was free'd() from and UMA/malloc do not currently have the ability to tell us that. -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org