From owner-freebsd-bugs@FreeBSD.ORG  Fri Apr  2 12:09:02 2004
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 8D1C016A4E4; Fri,  2 Apr 2004 12:09:02 -0800 (PST)
Received: from critter.freebsd.dk (critter.freebsd.dk [212.242.86.163])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id ED6B243D3F; Fri,  2 Apr 2004 12:09:01 -0800 (PST)
	(envelope-from phk@phk.freebsd.dk)
Received: from critter.freebsd.dk (localhost [127.0.0.1])
	by critter.freebsd.dk (8.12.11/8.12.11) with ESMTP id i32K8oC3036770;
	Fri, 2 Apr 2004 22:08:50 +0200 (CEST)
	(envelope-from phk@phk.freebsd.dk)
To: Vinod Kashyap <vkashyap@3WARE.com>
From: "Poul-Henning Kamp" <phk@phk.freebsd.dk>
In-Reply-To: Your message of "Fri, 02 Apr 2004 11:10:46 -0800."
             <A1964EDB64C8094DA12D2271C04B812601532143@tabby.3ware.com> 
Date: Fri, 02 Apr 2004 22:08:49 +0200
Message-ID: <36769.1080936529@critter.freebsd.dk>
cc: freebsd-bugs@freebsd.org
cc: 'Artem Koutchine' <matrix@itlegion.ru>
cc: freebsd-current@freebsd.org
Subject: Re: there is a bug in twe driver or disk subsystem for sure 
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Apr 2004 20:09:02 -0000

In message <A1964EDB64C8094DA12D2271C04B812601532143@tabby.3ware.com>, Vinod Ka
shyap writes:
>
>The 3ware (twe) driver is obviously not causing this panic.
>It's something else (at line 128 in file /usr/src/sys/udm_dbg.c).

>Memory modified after free 0x788f400(508) val=20202020 @ 0xe788f400
>panic: Most recently used by devbuf
>at line 128 in file /usr/src/sys/udm_dbg.c

You're wrong vinod, the bug _is_ most likely in the 3ware driver.

What happens is that some piece of RAM is passed to free(9) and
some code subsequently writes to it.  We only discover this when
we try to reuse it next time and it doesn't contain the correct
"magic debug pattern".

Please compile your kernel with DIAGNOSTICS to enable the extended
malloc(9) debugging functions.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.