Date: Sun, 21 Sep 2003 13:10:22 +0200 From: Andreas Klemm <andreas@freebsd.org> To: freebsd-current@freebsd.org Subject: -current on laptop: panic: m_free detected a mbuf double free Message-ID: <20030921111022.GA7415@titan.klemm.apsfilter.org> In-Reply-To: <20030914194647.GA18839@titan.klemm.apsfilter.org> References: <20030909180947.GA23478@titan.klemm.apsfilter.org> <20030913071847.GA10778@titan.klemm.apsfilter.org> <20030913.092402.62370625.imp@bsdimp.com> <20030913141119.A27896@sasami.jurai.net> <20030913165818.I27896@sasami.jurai.net> <20030914002507.GA5239@titan.klemm.apsfilter.org> <20030913203403.E27896@sasami.jurai.net> <20030914194647.GA18839@titan.klemm.apsfilter.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Update the status now on -current.
I downloaded the last recent snapshot of 2003-09-20 from current.freebsd.org.
Made a test ftp session using the live CDROM. Same like a week before.
Panic if I download something big from my FreeBSD ftp server.
5.1 on my normal PIII PC works fine. This seems to be PCMCIA
related.
db> trace
Debugger(...
panic(...
m_free(...
m_freem(...
ip_input(...
swi_net(...
ithread_loop(...
fork_exit(...
fork_trampoline(...
On Sun, Sep 14, 2003 at 09:46:47PM +0200, Andreas Klemm wrote:
> On Sat, Sep 13, 2003 at 08:35:06PM -0400, Matthew N. Dodd wrote:
> > On Sun, 14 Sep 2003, Andreas Klemm wrote:
> > > It works for me, xl0 card is recognized.
> >
> > Great!
> >
> > > But during heavy ftp network traffic the LAPTOP panics.
>
> machine paniced 2 times
> A) one time after transferring ~90 MB of a ~300 MB large ISO image
> B) 2nd time after transferring ~ 8 MB of same large file
> C) 3rd time after transferring ~ 6 MB of same large file
>
> In DDB I see using where, that the machine always crashes within
> the same functions. DDB tells me:
>
> to B) panic: m_free detected a mbuf double-free
> Debugger("panic")
> Stopped at Debugger+0x54: xchgl %ebx,in_Debugger.0
> db> where
> Debugger
> panic
> m_free
> m_freem
> ip_input <---------- happens at different functions
> ...
> db> panic
> ...
>
> to C) panic: m_free detected a mbuf double-free
> Debugger("panic")
> Stopped at Debugger+0x54: xchgl %ebx,in_Debugger.0
> db> where
> Debugger
> panic
> m_free
> m_freem
> xl_txeof <----------- happens at different functions
> xl_intr
> cbb_intr
> ithread_loop
> fork_exit
> fork_trampoline
> --- trap 0x1, eip = 0, esp = 0xcb042d7c, ebp = 0 ---
> db> panic
> panic: from debugger
> Uptime: 2m55s
> Dumping 191M
> Dump complete
>
>
> Let's see what gdb tells me, from panic "B)"
> Sorry for case "C)" I didn't have enough space :-(
>
> (kgdb) where
>
> #0 doadump
> #1 0x... in boot (howto=260) at ../../../kern/kern_shutdown.c: 372
> #2 0x... in panic () at ../../../kern/kern_shutdown.c: 550
> #3 0x... in db_panic () at ../../../ddb/db_command.c: 450
> #4 0x... in db_command (...) at ../../../ddb/db_command.c: 346
> #5 0x... in db_command_loop () at ../../../ddb/db_command.c: 472
> #6 0x... in db_trap (type=3, code=0) at ../../../ddb/db_trap.c: 73
> #7 0x... in kdb_trap (type=3, code=0, regs=0xcb027bc6)
> at ../../../i386/i386/db_interface.c: 171
> #8 0x... in trap (frame=
> {tf_fs = 24, tf_es = -1039597552, tf_ds = 16, tf_edi = 1, tf_esi ) -1070431840, tf_ebp = -889029704, tf_isp = -889029736, tf_ebx = 0, tf_edx = 0, tf_ecx = 32, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1070703196, tf_cs = 8, tf_eflags = 642, tf_esp = -1070363254, tf_ss = -1070440292})
> at ../../../i386/i386/trap.c: 577
> #9 0x... in calltrap () at {standard input}: 102
> #10 0x... in panic (fmt=0xc03281a0 "m_free detected a mbuf double-freeze")
> at ../../../kern/kern_shutdown.c: 534
> #11 0x... in m_free (mb=0xc0d4fe00) at ../../../kern/subr_mbuf.c: 1368
> #12 0x... in m_freem (mb=0x0) at ../../../kern/subr_mbuf.c: 1403
> #13 0x... in ip_input (mb=0xc0d4fe00) at ../../../netinet/ip_input.c: 963
> #14 0x... in swi_net (dummy=0x0) at ../../../net/net_isr.c: 236
> #15 0x... in ithread_loop (arg=0xc0d33200)
> at ../../../kern/kern_intr.c: 534
> #16 0x... in fork_exit (callout=0xc01b3900 <ithread_loop>, arg=0x0,
> frame=0x0) at ../../../kern/kern_fork.c: 796
>
> (kgdb) up 8
> #8 0x... in trap (frame=
> {tf_fs = 24, tf_es = -1039597552, tf_ds = 16, tf_edi = 1, tf_esi ) -1070431840, tf_ebp = -889029704, tf_isp = -889029736, tf_ebx = 0, tf_edx = 0, tf_ecx = 32, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1070703196, tf_cs = 8, tf_eflags = 642, tf_esp = -1070363254, tf_ss = -1070440292})
> 577 if (kbd_trap (type, 0, &frame)
>
> (kgdb) frame frame->tf_ebp frame->tf_eip
>
> Too many args in frame specification ...
> hmmmm "/&%"(/&%(" does the developer handbook need and update ? ;-)
>
> http://www.freebsd.org/doc/en_US.ISO8859-1/books/developers-handbook/kerneldebug.html#KERNELDEBUG-GDB
>
> Here it ends , have no clue how to select correct frames ... :-)
>
>
> Andreas ///
>
> --
> Andreas Klemm - Powered by FreeBSD 5.1-CURRENT
> Need a magic printfilter today ? -> http://www.apsfilter.org/
> _______________________________________________
> freebsd-mobile@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-mobile
> To unsubscribe, send any mail to "freebsd-mobile-unsubscribe@freebsd.org"
Andreas ///
--
Andreas Klemm - Powered by FreeBSD 5.1-CURRENT
Need a magic printfilter today ? -> http://www.apsfilter.org/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030921111022.GA7415>