From owner-freebsd-bugs@FreeBSD.ORG Tue May 24 06:10:10 2011 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 65B5C1065670 for ; Tue, 24 May 2011 06:10:10 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 283C68FC0C for ; Tue, 24 May 2011 06:10:10 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p4O6AASr003505 for ; Tue, 24 May 2011 06:10:10 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p4O6A9te003504; Tue, 24 May 2011 06:10:10 GMT (envelope-from gnats) Resent-Date: Tue, 24 May 2011 06:10:10 GMT Resent-Message-Id: <201105240610.p4O6A9te003504@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Joerg Wunsch Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 68482106566B for ; Tue, 24 May 2011 06:00:28 +0000 (UTC) (envelope-from j@uriah.heep.sax.de) Received: from uriah.heep.sax.de (uriah.heep.sax.de [213.240.137.9]) by mx1.freebsd.org (Postfix) with ESMTP id 1D74F8FC08 for ; Tue, 24 May 2011 06:00:27 +0000 (UTC) Received: by uriah.heep.sax.de (Postfix, from userid 107) id E8285AA; Tue, 24 May 2011 08:00:26 +0200 (MET DST) Message-Id: <20110524060026.E8285AA@uriah.heep.sax.de> Date: Tue, 24 May 2011 08:00:26 +0200 (MET DST) From: Joerg Wunsch To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/157287: re0: INVARIANTS panic (Memory modified after free) X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 May 2011 06:10:10 -0000 >Number: 157287 >Category: kern >Synopsis: re0: INVARIANTS panic (Memory modified after free) >Confidential: no >Severity: critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue May 24 06:10:09 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Joerg Wunsch >Release: FreeBSD 8.2-STABLE i386 >Organization: >Environment: System: FreeBSD uriah.heep.sax.de 8.2-STABLE FreeBSD 8.2-STABLE #3: Wed May 18 07:47:11 MET DST 2011 r@uriah.heep.sax.de:/usr/obj/usr/src/sys/URIAH i386 >Description: I recently built an INVARIANTS kernel (in order to debug some issue where removing a SCSI device caused a devfs list corruption). Every now and then, when booting, I get the following panic in the re(4) driver: re0: port 0xd800-0xd8ff mem 0xfe9ff000-0xfe9fffff irq 19 at device 0.0 on pci3 re0: Using 1 MSI message re0: Chip rev. 0x38000000 re0: MAC rev. 0x00000000 Memory modified after free 0xc6eec000(4092) val=7403c042 @ 0xc6eec000 panic: Most recently used by none cpuid = 0 KDB: enter: panic Usually, the next reboot works again. Note that this hardware does not zero out the memory at boot by itself (can be seen by monitoring old panic messages after a reboot), so this is likely an uninitialized variable or such. >How-To-Repeat: Build an INVARIANTS kernel, and run it on a machine with re(4) hardware. >Fix: >Release-Note: >Audit-Trail: >Unformatted: