From owner-freebsd-stable@FreeBSD.ORG Thu May 29 23:12:04 2014 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id DE898FC3; Thu, 29 May 2014 23:12:03 +0000 (UTC) Received: from mail-qg0-x229.google.com (mail-qg0-x229.google.com [IPv6:2607:f8b0:400d:c04::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 91A1A22B2; Thu, 29 May 2014 23:12:03 +0000 (UTC) Received: by mail-qg0-f41.google.com with SMTP id j5so3185122qga.0 for ; Thu, 29 May 2014 16:12:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:date:message-id:subject:from:to:content-type; bh=AwfRur+j8wb58yhrCvgbAeUtKBh6cbk3IZmjAKexSOo=; b=JNOD6iBZraU3d/Ur8ncN+/smdOAfoROD0SxxFZELjPpOXKXLd85dQZWJJUIiQjU5by C26Tm/7IV+3rA/ZjWZiFIPJWaUs42vzT3HNQq97c+0wJ//MXlTGDFSY4IxbHBmEMR5kD Bdk8uw+YyZXed8V1u+jrDE8boRwOqwQ6iNchsz29t/VsjtAL+eh9LgIzuI/bYi/bj3at GT36knJ9Y9mQ2Uftqn0t8XddqlkR+NpCIaj1YIRRTM0iM3qq4eZ4TH9ToHBlUkGRz7g/ DzzZdkkP9aXNFvoDsw9wgjXh3xZ6b1mzEIGh4985rVDfyQnGEErzjjB9hLQvOHdkfZN1 WzCA== MIME-Version: 1.0 X-Received: by 10.224.60.137 with SMTP id p9mr15059655qah.92.1401405122531; Thu, 29 May 2014 16:12:02 -0700 (PDT) Sender: hiren.panchasara@gmail.com Received: by 10.96.122.133 with HTTP; Thu, 29 May 2014 16:12:02 -0700 (PDT) Date: Thu, 29 May 2014 16:12:02 -0700 X-Google-Sender-Auth: G4R5dV8N60TgoiQ_i7cy4qMkszY Message-ID: Subject: Stable/10 panic: uma_zfree: Freeing to non free bucket index. From: hiren panchasara To: freebsd-stable@freebsd.org, Jeff Roberson Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 May 2014 23:12:04 -0000 We are at stable/10 r261579. On a Xeon E5-2670 with 64GB ram, we saw this panic: Unread portion of the kernel message buffer: panic: uma_zfree: Freeing to non free bucket index. cpuid = 1 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe106e49a6e0 kdb_backtrace() at kdb_backtrace+0x39/frame 0xfffffe106e49a790 vpanic() at vpanic+0x126/frame 0xfffffe106e49a7d0 kassert_panic() at kassert_panic+0x136/frame 0xfffffe106e49a840 uma_zfree_arg() at uma_zfree_arg+0x3cd/frame 0xfffffe106e49a8a0 _fdrop() at _fdrop+0x63/frame 0xfffffe106e49a8c0 closef() at closef+0x1d1/frame 0xfffffe106e49a950 closefp() at closefp+0xa0/frame 0xfffffe106e49a9a0 ia32_syscall() at ia32_syscall+0x255/frame 0xfffffe106e49aab0 Xint0x80_syscall() at Xint0x80_syscall+0x95/frame 0xfffffe106e49aab0 --- syscall (6, FreeBSD ELF32, sys_close), rip = 0x63594804, rsp = 0xffff6684, rbp = 0xffff66b0 --- Uptime: 5d10h19m35s I can provide more info if needed. (kgdb) bt #0 doadump (textdump=1) at pcpu.h:219 #1 0xffffffff805fb2f7 in kern_reboot (howto=260) at ../../../kern/kern_shutdown.c:452 #2 0xffffffff805fb805 in vpanic (fmt=, ap=) at ../../../kern/kern_shutdown.c:759 #3 0xffffffff805fb696 in kassert_panic (fmt=) at ../../../kern/kern_shutdown.c:647 #4 0xffffffff807e7aed in uma_zfree_arg (zone=, item=0xfffff80108a3f8c0, udata=0x0) at ../../../vm/uma_core.c:2706 #5 0xffffffff805b8813 in _fdrop (fp=0xfffff80108a3f8c0, td=) at uma.h:364 #6 0xffffffff805bb131 in closef (fp=0xfffff80108a3f8c0, td=0xfffff8015f53b000) at ../../../kern/kern_descrip.c:2415 #7 0xffffffff805b8c40 in closefp (fdp=0xfffff802727f1800, fd=, fp=0xfffff80108a3f8c0, td=0xfffff8015f53b000, holdleaders=) at ../../../kern/kern_descrip.c:1257 #8 0xffffffff80a34b65 in ia32_syscall (frame=0xfffffe106e49aac0) at subr_syscall.c:135 #9 0xffffffff8095e675 in Xint0x80_syscall () at ia32_exception.S:73 #10 0x0000000063594804 in ?? () Previous frame inner to this frame (corrupt stack?) Current language: auto; currently minimal (kgdb) f 4 #4 0xffffffff807e7aed in uma_zfree_arg (zone=, item=0xfffff80108a3f8c0, udata=0x0) at ../../../vm/uma_core.c:2706 2706 ../../../vm/uma_core.c: No such file or directory. in ../../../vm/uma_core.c (kgdb) l 2701 in ../../../vm/uma_core.c (kgdb) 2696. zfree_start: 2697. /* 2698. * Try to free into the allocbucket first to give LIFO ordering 2699. * for cache-hot datastructures. Spill over into the freebucket 2700. * if necessary. Alloc will swap them if one runs dry. 2701. */ 2702. bucket = cache->uc_allocbucket; 2703. if (bucket == NULL || bucket->ub_cnt >= bucket->ub_entries) 2704. bucket = cache->uc_freebucket; 2705. if (bucket != NULL && bucket->ub_cnt < bucket->ub_entries) { 2706. KASSERT(bucket->ub_bucket[bucket->ub_cnt] == NULL, 2707. ("uma_zfree: Freeing to non free bucket index.")); 2708. bucket->ub_bucket[bucket->ub_cnt] = item; 2709. bucket->ub_cnt++; 2710. cache->uc_frees++; 2711. critical_exit(); 2712. return; 2713. } Thanks, Hiren