>Number: 6539
>Category: kernel
>Synopsis: panic: pool_do_get(mcl2k): free list modified
>Confidential: yes
>Severity: serious
>Priority: medium
>Responsible: bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Thu Jan 06 06:20:01 GMT 2011
>Closed-Date:
>Last-Modified:
>Originator:
>Release:
>Organization:
>Environment:
System : OpenBSD 4.8
Details : OpenBSD 4.8-current (GENERIC) #542: Sun Jan 2 15:26:42
MST 2011
dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
Architecture: OpenBSD.i386
Machine : i386
>Description:
panic: pool_do_get(mcl2k): free list modified: page 0xd527e000; item
addr 0xd527e800; offset 0x0=0xc5240000
Starting stack trace...
panic(d08d1a5c,d7590c88,d08aff40,d7590c88,0) at panic+0x6a
panic(d08aff40,d09d9140,d527e000,d527e800,0) at panic+0x6a
pool_do_get(d0a27200,2,d7590cec,d03fec13,60) at pool_do_get+0x2aa
pool_get(d0a27200,2,d7590d2c,d0a4c328,d124e780) at pool_get+0x3d
m_clget(0,2,d100d434,800,5) at m_clget+0x82
sis_newbuf(d100d400,d74bf390,d100d434,249,249) at sis_newbuf+0x41
sis_fill_rx_ring(d100d400,e100,10,0,50) at sis_fill_rx_ring+0x69
sis_intr(d100d400) at sis_intr+0xb8
Xrecurse_legacy10() at Xrecurse_legacy10+0xb7
--- interrupt ---
Xspllower(2,1,d7590e44,d03ff7ee,d54e8a00) at Xspllower+0xe
m_pullup(d54e8c00,44,44,2,0) at m_pullup+0x111
ip_forward(d54e8a00,1,0,0,d0a4c31c) at ip_forward+0x128
ipv4_input(d54e8a00,6,d7590ef4,d043f265,d0202f0d) at ipv4_input+0x655
ipintr(d0202f0d,d10f9b40,d7590f14,d0578abf,0) at ipintr+0x49
netintr(0,40,d113fe00,0,d0201fc6) at netintr+0xd5
softintr_dispatch(1) at softintr_dispatch+0x4f
Xsoftnet() at Xsoftnet+0x12
--- interrupt ---
cpu_idle_cycle(d0adc1c0) at cpu_idle_cycle+0xf
Bad frame pointer: 0xd0b92e48
End of stack trace.
>How-To-Repeat:
get stuck with a piece of shit soekris 4801, run -current on it
doing nat for a couple machines, watch it panic every few hours
>Fix:
don't use a soekris
dmesg:
panic: pool_do_get(mcl2k): free list modified: page 0xd5282000; item addr
0xd5282000; offset 0x0=0xc5240000
Starting stack trace...
panic(d08d1a5c,d7590b08,d08aff40,d7590b08,d7590b38) at panic+0x6a
panic(d08aff40,d09d9140,d5282000,d5282000,0) at panic+0x6a
pool_do_get(d0a27200,2,d7590b6c,d03fec13,60) at pool_do_get+0x2aa
pool_get(d0a27200,2,d7590bac,d0a4c328,d124d780) at pool_get+0x3d
m_clget(0,2,d100d434,800,d09c6ca0) at m_clget+0x82
sis_newbuf(d100d400,d74bf390,d100d434,19,19) at sis_newbuf+0x41
sis_fill_rx_ring(d100d400,e100,10,0,0) at sis_fill_rx_ring+0x69
sis_intr(d100d400) at sis_intr+0xb8
Xrecurse_legacy10() at Xrecurse_legacy10+0xb7
--- interrupt ---
pf_test(2,d100d434,d7590dec,0,0) at pf_test+0x36f
ip_output(d53faf00,0,d0a2cb20,1,0) at ip_output+0x5f0
ip_forward(d53faf00,0,0,0,2) at ip_forward+0x181
ipv4_input(d53faf00,6,d7590ef4,d043f265,d0202f0d) at ipv4_input+0x655
ipintr(d0202f0d,d10f9b40,d7590f14,d0578abf,0) at ipintr+0x49
netintr(0,d7590f10,d113fe00,0,d0201fc6) at netintr+0xd5
softintr_dispatch(1) at softintr_dispatch+0x4f
Xsoftnet() at Xsoftnet+0x12
--- interrupt ---
cpu_idle_cycle(d0adc1c0) at cpu_idle_cycle+0xf
Bad frame pointer: 0xd0b92e48
End of stack trace.
panic: mtx_enter: locking against myself
Starting stack trace...
panic(d08d1a5c,d75908e8,0,0,0) at panic+0x6a
panic(d0202e38,d7590908,d03e96a3,d0a27200,0) at panic+0x6a
mtx_enter(d0a27200,0,0,4f,d54e8f00) at mtx_enter+0x60
pool_put(d0a27200,d528e800,7,3,3c00a8aa) at pool_put+0x33
m_extfree(d54e8f00,d759094e,d,4f0000,d54e8f00) at m_extfree+0x80
m_free_unlocked(d54e8f00,9c00115f,3f8,0,0) at m_free_unlocked+0x30
m_freem(d54e8f00,0,1,0,0) at m_freem+0x28
in_arpinput(d54e8f00,60,d08d0058,10,4000e) at in_arpinput+0x5d
arpintr(d0202f0d,d10f9b40,d7590a58,d0578abf,0) at arpintr+0xd8
netintr(0,3,0,0,d0201f8a) at netintr+0xe5
softintr_dispatch(1) at softintr_dispatch+0x4f
Xsoftnet() at Xsoftnet+0x12
--- interrupt ---
end(100,d7590b08,d08aff40,d7590b08,d7590b38) at 0xd7590b08
panic(d08aff40,d09d9140,d5282000,d5282000,0) at panic+0x65
pool_do_get(d0a27200,2,d7590b6c,d03fec13,60) at pool_do_get+0x2aa
pool_get(d0a27200,2,d7590bac,d0a4c328,d124d780) at pool_get+0x3d
m_clget(0,2,d100d434,800,d09c6ca0) at m_clget+0x82
sis_newbuf(d100d400,d74bf390,d100d434,19,19) at sis_newbuf+0x41
sis_fill_rx_ring(d100d400,e100,10,0,0) at sis_fill_rx_ring+0x69
sis_intr(d100d400) at sis_intr+0xb8
Xrecurse_legacy10() at Xrecurse_legacy10+0xb7
--- interrupt ---
pf_test(2,d100d434,d7590dec,0,0) at pf_test+0x36f
ip_output(d53faf00,0,d0a2cb20,1,0) at ip_output+0x5f0
ip_forward(d53faf00,0,0,0,2) at ip_forward+0x181
ipv4_input(d53faf00,6,d7590ef4,d043f265,d0202f0d) at ipv4_input+0x655
ipintr(d0202f0d,d10f9b40,d7590f14,d0578abf,0) at ipintr+0x49
netintr(0,d7590f10,d113fe00,0,d0201fc6) at netintr+0xd5
softintr_dispatch(1) at softintr_dispatch+0x4f
Xsoftnet() at Xsoftnet+0x12
--- interrupt ---
cpu_idle_cycle(d0adc1c0) at cpu_idle_cycle+0xf
Bad frame pointer: 0xd0b92e48
End of stack trace.
OpenBSD 4.8-current (GENERIC) #542: Sun Jan 2 15:26:42 MST 2011
dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Geode(TM) Integrated Processor by National Semi ("Geode by NSC"
586-class) 267 MHz
cpu0: FPU,TSC,MSR,CX8,CMOV,MMX
real mem = 268005376 (255MB)
avail mem = 253546496 (241MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 20/80/03, BIOS32 rev. 0 @ 0xf7840
pcibios0 at bios0: rev 2.0 @ 0xf0000/0x10000
pcibios0: pcibios_get_intr_routing - function not supported
pcibios0: PCI IRQ Routing information unavailable.
pcibios0: PCI bus #0 is the last bus
bios0: ROM list: 0xc8000/0x9000
cpu0 at mainbus0: (uniprocessor)
cpu0: TSC disabled
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 0 function 0 "Cyrix GXm PCI" rev 0x00
sis0 at pci0 dev 6 function 0 "NS DP83815 10/100" rev 0x00, DP83816A: irq 10,
address 00:00:24:c5:d1:2c
nsphyter0 at sis0 phy 0: DP83815 10/100 PHY, rev. 1
sis1 at pci0 dev 7 function 0 "NS DP83815 10/100" rev 0x00, DP83816A: irq 10,
address 00:00:24:c5:d1:2d
nsphyter1 at sis1 phy 0: DP83815 10/100 PHY, rev. 1
sis2 at pci0 dev 8 function 0 "NS DP83815 10/100" rev 0x00, DP83816A: irq 10,
address 00:00:24:c5:d1:2e
nsphyter2 at sis2 phy 0: DP83815 10/100 PHY, rev. 1
gscpcib0 at pci0 dev 18 function 0 "NS SC1100 ISA" rev 0x00
gpio0 at gscpcib0: 64 pins
"NS SC1100 SMI" rev 0x00 at pci0 dev 18 function 1 not configured
pciide0 at pci0 dev 18 function 2 "NS SCx200 IDE" rev 0x01: DMA, channel 0
wired to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 1: <CF 4GB>
wd0: 1-sector PIO, LBA, 3823MB, 7831152 sectors
wd0(pciide0:0:1): using PIO mode 4, Ultra-DMA mode 2
geodesc0 at pci0 dev 18 function 5 "NS SC1100 X-Bus" rev 0x00: iid 6 revision 3
wdstatus 0
ohci0 at pci0 dev 19 function 0 "Compaq USB OpenHost" rev 0x08: irq 11, version
1.0, legacy support
isa0 at gscpcib0
isadma0 at isa0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
nsclpcsio0 at isa0 port 0x2e/2: NSC PC87366 rev 9: GPIO VLM TMS
gpio1 at nsclpcsio0: 29 pins
gscsio0 at isa0 port 0x15c/2: SC1100 SIO rev 1:
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
usb0 at ohci0: USB revision 1.0
uhub0 at usb0 "Compaq OHCI root hub" rev 1.00/1.00 addr 1
biomask fbe5 netmask ffe5 ttymask ffff
vscsi0 at root
scsibus0 at vscsi0: 256 targets
softraid0 at root
root on wd0a swap on wd0b dump on wd0b
WARNING: / was not properly unmounted
panic: pool_do_get(mcl2k): free list modified: page 0xd527e000; item addr
0xd527e800; offset 0x0=0xc5240000
Starting stack trace...
panic(d08d1a5c,d7590c88,d08aff40,d7590c88,0) at panic+0x6a
panic(d08aff40,d09d9140,d527e000,d527e800,0) at panic+0x6a
pool_do_get(d0a27200,2,d7590cec,d03fec13,60) at pool_do_get+0x2aa
pool_get(d0a27200,2,d7590d2c,d0a4c328,d124e780) at pool_get+0x3d
m_clget(0,2,d100d434,800,5) at m_clget+0x82
sis_newbuf(d100d400,d74bf390,d100d434,249,249) at sis_newbuf+0x41
sis_fill_rx_ring(d100d400,e100,10,0,50) at sis_fill_rx_ring+0x69
sis_intr(d100d400) at sis_intr+0xb8
Xrecurse_legacy10() at Xrecurse_legacy10+0xb7
--- interrupt ---
Xspllower(2,1,d7590e44,d03ff7ee,d54e8a00) at Xspllower+0xe
m_pullup(d54e8c00,44,44,2,0) at m_pullup+0x111
ip_forward(d54e8a00,1,0,0,d0a4c31c) at ip_forward+0x128
ipv4_input(d54e8a00,6,d7590ef4,d043f265,d0202f0d) at ipv4_input+0x655
ipintr(d0202f0d,d10f9b40,d7590f14,d0578abf,0) at ipintr+0x49
netintr(0,40,d113fe00,0,d0201fc6) at netintr+0xd5
softintr_dispatch(1) at softintr_dispatch+0x4f
Xsoftnet() at Xsoftnet+0x12
--- interrupt ---
cpu_idle_cycle(d0adc1c0) at cpu_idle_cycle+0xf
Bad frame pointer: 0xd0b92e48
End of stack trace.
syncing disks... splassert: assertwaitok: want -1 have 1
panic: assertwaitok: non-zero mutex count: 1
Starting stack trace...
panic(d08d1a5c,d7590888,ffffffff,1,d75908f0) at panic+0x6a
panic(d08b0a10,1,d75908bc,d03e9a55,d0a177f4) at panic+0x6a
assertwaitok(d0a177f4,0,a177f4,28,14) at assertwaitok+0x3e
pool_get(d0a27960,9,0,0,65580) at pool_get+0x95
buf_get(d54de270,65580,0,4000,d100e900) at buf_get+0x176
getblk(d54de270,65580,0,4000,0) at getblk+0x6c
bio_doread(d54de270,65580,0,4000,0) at bio_doread+0x42
bread(d54de270,65580,0,4000,ffffffff) at bread+0x32
ffs_update(d547c678,0,0,0,d52c3e80,4,0) at ffs_update+0x24b
ffs_fsync(d7590af8,12,d54e4278,d0415a1a,d7590afc) at ffs_fsync+0x292
VOP_FSYNC(d52c3e80,d54ee000,2,d54e4278,d11f3000) at VOP_FSYNC+0x30
ffs_sync_vnode(d52c3e80,d7590b7c,8,d11f6200,d54ee000) at ffs_sync_vnode+0x70
vfs_mount_foreach_vnode(d11f3000,d04f3eb0,d7590b7c,d7590b6c,d0202f0d) at
vfs_mount_foreach_vnode+0x2a
ffs_sync(d11f3000,2,d54ee000,d54e4278,203) at ffs_sync+0x7a
sys_sync(d54e4278,0,0,0,d7590c08) at sys_sync+0xa1
vfs_syncwait(1,d02004d1,d0b92e48,d7590c88,d7590c28) at vfs_syncwait+0x2e
vfs_shutdown(d08aa86b,1,ef,d08a4782,d03eb7f0) at vfs_shutdown+0x39
boot(100,d7590c88,d08aff40,d7590c88,0) at boot+0x188
panic(d08aff40,d09d9140,d527e000,d527e800,0) at panic+0x65
pool_do_get(d0a27200,2,d7590cec,d03fec13,60) at pool_do_get+0x2aa
pool_get(d0a27200,2,d7590d2c,d0a4c328,d124e780) at pool_get+0x3d
m_clget(0,2,d100d434,800,5) at m_clget+0x82
sis_newbuf(d100d400,d74bf390,d100d434,249,249) at sis_newbuf+0x41
sis_fill_rx_ring(d100d400,e100,10,0,50) at sis_fill_rx_ring+0x69
sis_intr(d100d400) at sis_intr+0xb8
Xrecurse_legacy10() at Xrecurse_legacy10+0xb7
--- interrupt ---
Xspllower(2,1,d7590e44,d03ff7ee,d54e8a00) at Xspllower+0xe
m_pullup(d54e8c00,44,44,2,0) at m_pullup+0x111
ip_forward(d54e8a00,1,0,0,d0a4c31c) at ip_forward+0x128
ipv4_input(d54e8a00,6,d7590ef4,d043f265,d0202f0d) at ipv4_input+0x655
ipintr(d0202f0d,d10f9b40,d7590f14,d0578abf,0) at ipintr+0x49
netintr(0,40,d113fe00,0,d0201fc6) at netintr+0xd5
softintr_dispatch(1) at softintr_dispatch+0x4f
Xsoftnet() at Xsoftnet+0x12
--- interrupt ---
cpu_idle_cycle(d0adc1c0) at cpu_idle_cycle+0xf
Bad frame pointer: 0xd0b92e48
End of stack trace.
OpenBSD 4.8-current (GENERIC) #542: Sun Jan 2 15:26:42 MST 2011
dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Geode(TM) Integrated Processor by National Semi ("Geode by NSC"
586-class) 267 MHz
cpu0: FPU,TSC,MSR,CX8,CMOV,MMX
real mem = 268005376 (255MB)
avail mem = 253546496 (241MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 20/80/03, BIOS32 rev. 0 @ 0xf7840
pcibios0 at bios0: rev 2.0 @ 0xf0000/0x10000
pcibios0: pcibios_get_intr_routing - function not supported
pcibios0: PCI IRQ Routing information unavailable.
pcibios0: PCI bus #0 is the last bus
bios0: ROM list: 0xc8000/0x9000
cpu0 at mainbus0: (uniprocessor)
cpu0: TSC disabled
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 0 function 0 "Cyrix GXm PCI" rev 0x00
sis0 at pci0 dev 6 function 0 "NS DP83815 10/100" rev 0x00, DP83816A: irq 10,
address 00:00:24:c5:d1:2c
nsphyter0 at sis0 phy 0: DP83815 10/100 PHY, rev. 1
sis1 at pci0 dev 7 function 0 "NS DP83815 10/100" rev 0x00, DP83816A: irq 10,
address 00:00:24:c5:d1:2d
nsphyter1 at sis1 phy 0: DP83815 10/100 PHY, rev. 1
sis2 at pci0 dev 8 function 0 "NS DP83815 10/100" rev 0x00, DP83816A: irq 10,
address 00:00:24:c5:d1:2e
nsphyter2 at sis2 phy 0: DP83815 10/100 PHY, rev. 1
gscpcib0 at pci0 dev 18 function 0 "NS SC1100 ISA" rev 0x00
gpio0 at gscpcib0: 64 pins
"NS SC1100 SMI" rev 0x00 at pci0 dev 18 function 1 not configured
pciide0 at pci0 dev 18 function 2 "NS SCx200 IDE" rev 0x01: DMA, channel 0
wired to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 1: <CF 4GB>
wd0: 1-sector PIO, LBA, 3823MB, 7831152 sectors
wd0(pciide0:0:1): using PIO mode 4, Ultra-DMA mode 2
geodesc0 at pci0 dev 18 function 5 "NS SC1100 X-Bus" rev 0x00: iid 6 revision 3
wdstatus 0
ohci0 at pci0 dev 19 function 0 "Compaq USB OpenHost" rev 0x08: irq 11, version
1.0, legacy support
isa0 at gscpcib0
isadma0 at isa0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
nsclpcsio0 at isa0 port 0x2e/2: NSC PC87366 rev 9: GPIO VLM TMS
gpio1 at nsclpcsio0: 29 pins
gscsio0 at isa0 port 0x15c/2: SC1100 SIO rev 1:
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
usb0 at ohci0: USB revision 1.0
uhub0 at usb0 "Compaq OHCI root hub" rev 1.00/1.00 addr 1
biomask fbe5 netmask ffe5 ttymask ffff
vscsi0 at root
scsibus0 at vscsi0: 256 targets
softraid0 at root
root on wd0a swap on wd0b dump on wd0b
WARNING: / was not properly unmounted
>Release-Note:
>Audit-Trail:
>Unformatted:
