Panic - uma_zfree_arg - zone argument is NULL
Hi, Is this a known issue? Happens when invoking a program over and over again in a loop in from a shell. --HPS ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On 09/18/14 13:57, Hans Petter Selasky wrote: Hi, Is this a known issue? Happens when invoking a program over and over again in a loop in from a shell. --HPS Backtrace got stripped: FreeBSD 10.0-RELEASE panic: page fault Unread portion of the kernel message buffer: fault virtual address = 0xd8 fault code = supervisor read data, page not present instruction pointer = 0x20:0x80b07863 stack pointer = 0x28:0xfe085d63b3b0 frame pointer = 0x28:0xfe085d63b420 code segment= base 0x0, limit 0xf, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags= interrupt enabled, resume, IOPL = 0 current process = 5386 (sh) trap number = 12 panic: page fault cpuid = 21 KDB: stack backtrace: #0 0x808e7dc0 at kdb_backtrace+0x60 #1 0x808af8a5 at panic+0x155 #2 0x80c8e882 at trap_fatal+0x3a2 #3 0x80c8eb59 at trap_pfault+0x2c9 #4 0x80c8e2e6 at trap+0x5e6 #5 0x80c75582 at calltrap+0x8 #6 0x80898d25 at free+0x75 #7 0x8085c869 at elf64_load_file+0x379 #8 0x8085c23e at exec_elf64_imgact+0xa9e #9 0x80879f50 at kern_execve+0x690 #10 0x808796a7 at sys_execve+0x37 #11 0x80c8f177 at amd64_syscall+0x357 #12 0x80c7586b at Xfast_syscall+0xfb Uptime: 1h51m46s #0 doadump (textdump=) at pcpu.h:219 219 pcpu.h: No such file or directory. in pcpu.h (kgdb) #0 doadump (textdump=) at pcpu.h:219 #1 0x808af520 in kern_reboot (howto=260) at /10_release/sys/kern/kern_shutdown.c:447 #2 0x808af8e4 in panic (fmt=) at /10_release/sys/kern/kern_shutdown.c:754 #3 0x80c8e882 in trap_fatal (frame=, eva=) at /10_release/sys/amd64/amd64/trap.c:882 #4 0x80c8eb59 in trap_pfault (frame=0xfe085d63b300, usermode=0) at /10_release/sys/amd64/amd64/trap.c:699 #5 0x80c8e2e6 in trap (frame=0xfe085d63b300) at /10_release/sys/amd64/amd64/trap.c:463 #6 0x80c75582 in calltrap () at /10_release/sys/amd64/amd64/exception.S:232 #7 0x80b07863 in uma_zfree_arg (zone=0x0, item=0xf800114ee000, udata=0x81484760) at /10_release/sys/vm/uma_core.c:2519 #8 0x80898d25 in free (addr=, mtp=0x8138df70) at /10_release/sys/kern/kern_malloc.c:596 #9 0x8085c869 in elf64_load_file (p=, file=, addr=0xfe085d63b588, entry=0xfe085d63b790, pagesize=4096) at /10_release/sys/kern/imgact_elf.c:709 #10 0x8085c23e in exec_elf64_imgact (imgp=0xfe085d63b760) at /10_release/sys/kern/imgact_elf.c:944 #11 0x80879f50 in kern_execve (td=0xf800114db000, args=0xfe085d63b958, mac_p=0x0) at /10_release/sys/kern/kern_exec.c:501 #12 0x808796a7 in sys_execve (td=, uap=) at /10_release/sys/kern/kern_exec.c:213 #13 0x80c8f177 in amd64_syscall (td=0xf800114db000, traced=0) at subr_syscall.c:134 #14 0x80c7586b in Xfast_syscall () at /10_release/sys/amd64/amd64/exception.S:391 #15 0x000800d38d5a in ?? () Previous frame inner to this frame (corrupt stack?) Current language: auto; currently minimal (kgdb) --HPS ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote: H> #7 0x80b07863 in uma_zfree_arg (zone=0x0, item=0xf800114ee000, H> udata=0x81484760) udata here is uma_slab_t. Can you look at it? btw, is that reproducible on stable/10 or head? -- Totus tuus, Glebius. ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On 09/25/14 11:19, Gleb Smirnoff wrote: On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote: H> #7 0x80b07863 in uma_zfree_arg (zone=0x0, item=0xf800114ee000, H> udata=0x81484760) udata here is uma_slab_t. Can you look at it? btw, is that reproducible on stable/10 or head? Yes, it is reproducible. I have not tried stable/10 or head yet. (kgdb) print *(uma_slab_t)udata $3 = { us_keg = 0xf8085696d680, us_type = { _us_link = { le_next = 0xf80856970a80, le_prev = 0x3 }, _us_size = 18446735313429006976 }, us_hlink = { sle_next = 0x0 }, us_data = 0x81484778 "", us_free = { __bits = {0, 0, -2125969520, 0} }, us_freecount = 0, us_flags = 0 '\0', us_pad = 0 '\0' } --HPS ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On 09/26/14 07:51, Hans Petter Selasky wrote: On 09/25/14 11:19, Gleb Smirnoff wrote: On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote: H> #7 0x80b07863 in uma_zfree_arg (zone=0x0, item=0xf800114ee000, H> udata=0x81484760) udata here is uma_slab_t. Can you look at it? btw, is that reproducible on stable/10 or head? Yes, it is reproducible. I have not tried stable/10 or head yet. (kgdb) print *(uma_slab_t)udata $3 = { us_keg = 0xf8085696d680, us_type = { _us_link = { le_next = 0xf80856970a80, le_prev = 0x3 }, _us_size = 18446735313429006976 }, us_hlink = { sle_next = 0x0 }, us_data = 0x81484778 "", us_free = { __bits = {0, 0, -2125969520, 0} }, us_freecount = 0, us_flags = 0 '\0', us_pad = 0 '\0' } BTW: I don't rule out that this might be an indirect error of some other kernel modules which I am experimenting with currently. But if you see something which is obvious then please let me know. --HPS ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On Fri, Sep 26, 2014 at 07:59:09AM +0200, Hans Petter Selasky wrote: H> On 09/26/14 07:51, Hans Petter Selasky wrote: H> > On 09/25/14 11:19, Gleb Smirnoff wrote: H> >> On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote: H> >> H> #7 0x80b07863 in uma_zfree_arg (zone=0x0, H> >> item=0xf800114ee000, H> >> H> udata=0x81484760) H> >> H> >> udata here is uma_slab_t. Can you look at it? H> >> H> >> btw, is that reproducible on stable/10 or head? H> >> H> > H> > Yes, it is reproducible. I have not tried stable/10 or head yet. H> > H> > (kgdb) print *(uma_slab_t)udata H> > $3 = { H> >us_keg = 0xf8085696d680, Can you print the us_keg, please? -- Totus tuus, Glebius. ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On 09/26/14 08:06, Gleb Smirnoff wrote: On Fri, Sep 26, 2014 at 07:59:09AM +0200, Hans Petter Selasky wrote: H> On 09/26/14 07:51, Hans Petter Selasky wrote: H> > On 09/25/14 11:19, Gleb Smirnoff wrote: H> >> On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote: H> >> H> #7 0x80b07863 in uma_zfree_arg (zone=0x0, H> >> item=0xf800114ee000, H> >> H> udata=0x81484760) H> >> H> >> udata here is uma_slab_t. Can you look at it? H> >> H> >> btw, is that reproducible on stable/10 or head? H> >> H> > H> > Yes, it is reproducible. I have not tried stable/10 or head yet. H> > H> > (kgdb) print *(uma_slab_t)udata H> > $3 = { H> >us_keg = 0xf8085696d680, Can you print the us_keg, please? (kgdb) print *(*(uma_slab_t)udata).us_keg $5 = { uk_lock = { lock_object = { lo_name = 0xf8085696fd80 "\200\n\227V\b???\200?\226V\b???", lo_flags = 2168997728, lo_data = 4294967295, lo_witness = 0x0 }, mtx_lock = 0 }, uk_hash = { uh_slab_hash = 0x0, uh_hashsize = 0, uh_hashmask = 0 }, uk_zones = { lh_first = 0x0 }, uk_part_slab = { lh_first = 0x224821000 }, uk_free_slab = { lh_first = 0x0 }, uk_full_slab = { lh_first = 0xf8085696d720 }, uk_align = 0, uk_pages = 6, uk_free = 0, uk_reserve = 1, uk_size = 131072, uk_rsize = 67044352, uk_maxpages = 269, uk_init = 0, uk_fini = 0x81484760 , uk_allocf = 0xf8085696d7b8, uk_freef = 0xf80854307748, uk_offset = 18446744071584084984, uk_kva = 36435, uk_slabzone = 0x224822000, uk_slabsize = 0, uk_pgoff = 0, uk_ppera = 0, uk_ipers = 0, uk_flags = 1452726152, uk_name = 0x6 , uk_link = { le_next = 0x10001, le_prev = 0x3ff0400 } } --HPS ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On Fri, Sep 26, 2014 at 08:30:06AM +0200, Hans Petter Selasky wrote: H> On 09/26/14 08:06, Gleb Smirnoff wrote: H> > On Fri, Sep 26, 2014 at 07:59:09AM +0200, Hans Petter Selasky wrote: H> > H> On 09/26/14 07:51, Hans Petter Selasky wrote: H> > H> > On 09/25/14 11:19, Gleb Smirnoff wrote: H> > H> >> On Thu, Sep 18, 2014 at 02:03:44PM +0200, Hans Petter Selasky wrote: H> > H> >> H> #7 0x80b07863 in uma_zfree_arg (zone=0x0, H> > H> >> item=0xf800114ee000, H> > H> >> H> udata=0x81484760) H> > H> >> H> > H> >> udata here is uma_slab_t. Can you look at it? H> > H> >> H> > H> >> btw, is that reproducible on stable/10 or head? H> > H> >> H> > H> > H> > H> > Yes, it is reproducible. I have not tried stable/10 or head yet. H> > H> > H> > H> > (kgdb) print *(uma_slab_t)udata H> > H> > $3 = { H> > H> >us_keg = 0xf8085696d680, H> > H> > Can you print the us_keg, please? H> H> (kgdb) print *(*(uma_slab_t)udata).us_keg It is trash. This means that vtoslab() returned us bad pointer. Either this mean the address passed to free() is invalid, and belongs to a page not under UMA control, or someone else have mangled the page belonging to UMA. Can you please print *(struct vm_page *)0x81484760 ? -- Totus tuus, Glebius. ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
Re: Panic - uma_zfree_arg - zone argument is NULL
On 09/26/14 08:44, Gleb Smirnoff wrote: print *(struct vm_page *)0x81484760 (kgdb) print *(struct vm_page *)0x81484760 $4 = { plinks = { q = { tqe_next = 0xf8085696d680, tqe_prev = 0xf80856970a80 }, s = { ss = { sle_next = 0xf8085696d680 }, pv = 0xf80856970a80 }, memguard = { p = 18446735313428993664, v = 18446735313429006976 } }, listq = { tqe_next = 0x3, tqe_prev = 0x0 }, object = 0x81484778, pindex = 0, phys_addr = 0, md = { pv_list = { tqh_first = 0x81484790, tqh_last = 0x0 }, pv_gen = 0, pat_mode = 0 }, wire_count = 2168997800, busy_lock = 4294967295, hold_count = 0, flags = 0, aflags = 0 '\0', oflags = 0 '\0', queue = 0 '\0', segind = 0 '\0', order = 0 '\0', pool = 0 '\0', act_count = 0 '\0', valid = 0 '\0', dirty = 0 '\0' } --HPS ___ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"