From owner-freebsd-current@FreeBSD.ORG  Sat Jun 25 02:55:52 2005
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: current@freebsd.org
Delivered-To: freebsd-current@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4A40316A41F
	for <current@freebsd.org>; Sat, 25 Jun 2005 02:55:52 +0000 (GMT)
	(envelope-from silby@silby.com)
Received: from relay01.pair.com (relay01.pair.com [209.68.5.15])
	by mx1.FreeBSD.org (Postfix) with SMTP id CDF7543D49
	for <current@freebsd.org>; Sat, 25 Jun 2005 02:55:51 +0000 (GMT)
	(envelope-from silby@silby.com)
Received: (qmail 26093 invoked from network); 25 Jun 2005 02:55:50 -0000
Received: from unknown (HELO localhost) (unknown)
	by unknown with SMTP; 25 Jun 2005 02:55:50 -0000
X-pair-Authenticated: 209.68.2.70
Date: Fri, 24 Jun 2005 21:55:34 -0500 (CDT)
From: Mike Silbersack <silby@silby.com>
To: current@freebsd.org
In-Reply-To: <20050624212729.C537@odysseus.silby.com>
Message-ID: <20050624215504.L537@odysseus.silby.com>
References: <20050624212729.C537@odysseus.silby.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: Thierry Herbelot <thierry@herbelot.com>
Subject: Re: Mbuf double-free guilty party detection patch
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 25 Jun 2005 02:55:52 -0000


By the way, the subject of this e-mail should be "use after free", not 
"double-free" - oops.

Mike "Silby" Silbersack

On Fri, 24 Jun 2005, Mike Silbersack wrote:

>
> The attached patch stores the address of who freed an mbuf/cluster/whatever 
> inside it, then prints that address when panicing. You can then feed that 
> address into "x 0xwhatever" in DDB to see who the semi-guilty party is.
>
> Two flaws in the patch as is:
>
> - It's messy and not compatible with non-i386, cleanups are needed.
>
> - If the mbuf in question is part of a mbuf chain, we'll see m_freem as the 
> guilty party, because it called m_free.
>
> So, if you're one of the people seeing panics due to mbufs being used after 
> free, please try applying the patch and see what results you get. If you keep 
> getting m_freem as the previous user, then I'll have to enhance it to work 
> around that.
>
> Mike "Silby" Silbersack